https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 13:14:13 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-04622 bdu:2025-04622 https://cve.radiocsirt.org/vuln/bdu:2025-04622 https://cve.radiocsirt.org/vuln/bell-cve-2025-21939 <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-21939 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0559 certfr-2025-avi-0559 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0559 https://cve.radiocsirt.org/vuln/euvd-2026-346715 EUVD-2026-346715 https://cve.radiocsirt.org/vuln/euvd-2026-346715 https://cve.radiocsirt.org/vuln/fkie_cve-2025-21939 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/xe/hmm: Don&#39;t dereference struct page pointers without notifier lock</p> <p>The pnfs that we obtain from hmm_range_fault() point to pages that we don&#39;t have a reference on, and the guarantee that they are still in the cpu page-tables is that the notifier lock must be held and the notifier seqno is still valid.</p> <p>So while building the sg table and marking the pages accesses / dirty we need to hold this lock with a validated seqno.</p> <p>However, the lock is reclaim tainted which makes sg_alloc_table_from_pages_segment() unusable, since it internally allocates memory.</p> <p>Instead build the sg-table manually. For the non-iommu case this might lead to fewer coalesces, but if that&#39;s a problem it can be fixed up later in the resource cursor code. For the iommu case, the whole sg-table may still be coalesced to a single contigous device va region.</p> <p>This avoids marking pages that we don&#39;t own dirty and accessed, and it also avoid dereferencing struct pages that we don&#39;t own.</p> <p>v2: - Use assert to check whether hmm pfns are valid (Matthew Auld) - Take into account that large pages may cross range boundaries (Matthew Auld)</p> <p>v3: - Don&#39;t unnecessarily check for a non-freed sg-table. (Matthew Auld) - Add a missing up_read() in an error path. (Matthew Auld)</p> <p>(cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/xe/hmm: Don&#39;t dereference struct page pointers without notifier lock</p> <p>The pnfs that we obtain from hmm_range_fault() point to pages that we don&#39;t have a reference on, and the guarantee that they are still in the cpu page-tables is that the notifier lock must be held and the notifier seqno is still valid.</p> <p>So while building the sg table and marking the pages accesses / dirty we need to hold this lock with a validated seqno.</p> <p>However, the lock is reclaim tainted which makes sg_alloc_table_from_pages_segment() unusable, since it internally allocates memory.</p> <p>Instead build the sg-table manually. For the non-iommu case this might lead to fewer coalesces, but if that&#39;s a problem it can be fixed up later in the resource cursor code. For the iommu case, the whole sg-table may still be coalesced to a single contigous device va region.</p> <p>This avoids marking pages that we don&#39;t own dirty and accessed, and it also avoid dereferencing struct pages that we don&#39;t own.</p> <p>v2: - Use assert to check whether hmm pfns are valid (Matthew Auld) - Take into account that large pages may cross range boundaries (Matthew Auld)</p> <p>v3: - Don&#39;t unnecessarily check for a non-freed sg-table. (Matthew Auld) - Add a missing up_read() in an error path. (Matthew Auld)</p> <p>(cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-21939 https://cve.radiocsirt.org/vuln/ghsa-5jw6-g45h-9h97 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/xe/hmm: Don&#39;t dereference struct page pointers without notifier lock</p> <p>The pnfs that we obtain from hmm_range_fault() point to pages that we don&#39;t have a reference on, and the guarantee that they are still in the cpu page-tables is that the notifier lock must be held and the notifier seqno is still valid.</p> <p>So while building the sg table and marking the pages accesses / dirty we need to hold this lock with a validated seqno.</p> <p>However, the lock is reclaim tainted which makes sg_alloc_table_from_pages_segment() unusable, since it internally allocates memory.</p> <p>Instead build the sg-table manually. For the non-iommu case this might lead to fewer coalesces, but if that&#39;s a problem it can be fixed up later in the resource cursor code. For the iommu case, the whole sg-table may still be coalesced to a single contigous device va region.</p> <p>This avoids marking pages that we don&#39;t own dirty and accessed, and it also avoid dereferencing struct pages that we don&#39;t own.</p> <p>v2: - Use assert to check whether hmm pfns are valid (Matthew Auld) - Take into account that large pages may cross range boundaries (Matthew Auld)</p> <p>v3: - Don&#39;t unnecessarily check for a non-freed sg-table. (Matthew Auld) - Add a missing up_read() in an error path. (Matthew Auld)</p> <p>(cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/xe/hmm: Don&#39;t dereference struct page pointers without notifier lock</p> <p>The pnfs that we obtain from hmm_range_fault() point to pages that we don&#39;t have a reference on, and the guarantee that they are still in the cpu page-tables is that the notifier lock must be held and the notifier seqno is still valid.</p> <p>So while building the sg table and marking the pages accesses / dirty we need to hold this lock with a validated seqno.</p> <p>However, the lock is reclaim tainted which makes sg_alloc_table_from_pages_segment() unusable, since it internally allocates memory.</p> <p>Instead build the sg-table manually. For the non-iommu case this might lead to fewer coalesces, but if that&#39;s a problem it can be fixed up later in the resource cursor code. For the iommu case, the whole sg-table may still be coalesced to a single contigous device va region.</p> <p>This avoids marking pages that we don&#39;t own dirty and accessed, and it also avoid dereferencing struct pages that we don&#39;t own.</p> <p>v2: - Use assert to check whether hmm pfns are valid (Matthew Auld) - Take into account that large pages may cross range boundaries (Matthew Auld)</p> <p>v3: - Don&#39;t unnecessarily check for a non-freed sg-table. (Matthew Auld) - Add a missing up_read() in an error path. (Matthew Auld)</p> <p>(cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)</p> https://cve.radiocsirt.org/vuln/ghsa-5jw6-g45h-9h97 https://cve.radiocsirt.org/vuln/suse-su-2025:02333-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2025:02333-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-21939 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 76 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: drm/xe/hmm: Don&#39;t dereference struct page pointers without notifier lock The pnfs that we obtain from hmm_range_fault() point to pages that we don&#39;t have a reference on, and the guarantee that they are still in the cpu page-tables is that the notifier lock must be held and the notifier seqno is still valid. So while building the sg table and marking the pages accesses / dirty we need to hold this lock with a validated seqno. However, the lock is reclaim tainted which makes sg_alloc_table_from_pages_segment() unusable, since it internally allocates memory. Instead build the sg-table manually. For the non-iommu case this might lead to fewer coalesces, but if that&#39;s a problem it can be fixed up later in the resource cursor code. For the iommu case, the whole sg-table may still be coalesced to a single contigous device va region. This avoids marking pages that we don&#39;t own dirty and accessed, and it also avoid dereferencing struct pages that we don&#39;t own. v2: - Use assert to check whether hmm pfns are valid (Matthew Auld) - Take into account that large pages may cross range boundaries (Matthew Auld) v3: - Don&#39;t unnecessarily check for a non-freed sg-table. (Matthew Auld) - Add a missing up_read() in an error path. (Matthew Auld) (cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 76 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: drm/xe/hmm: Don&#39;t dereference struct page pointers without notifier lock The pnfs that we obtain from hmm_range_fault() point to pages that we don&#39;t have a reference on, and the guarantee that they are still in the cpu page-tables is that the notifier lock must be held and the notifier seqno is still valid. So while building the sg table and marking the pages accesses / dirty we need to hold this lock with a validated seqno. However, the lock is reclaim tainted which makes sg_alloc_table_from_pages_segment() unusable, since it internally allocates memory. Instead build the sg-table manually. For the non-iommu case this might lead to fewer coalesces, but if that&#39;s a problem it can be fixed up later in the resource cursor code. For the iommu case, the whole sg-table may still be coalesced to a single contigous device va region. This avoids marking pages that we don&#39;t own dirty and accessed, and it also avoid dereferencing struct pages that we don&#39;t own. v2: - Use assert to check whether hmm pfns are valid (Matthew Auld) - Take into account that large pages may cross range boundaries (Matthew Auld) v3: - Don&#39;t unnecessarily check for a non-freed sg-table. (Matthew Auld) - Add a missing up_read() in an error path. (Matthew Auld) (cherry picked from commit ea3e66d280ce2576664a862693d1da8fd324c317)</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-21939 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0683 <p>Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial-of-Service auszulösen und um nicht näher spezifizierte Auswirkungen zu erzielen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial-of-Service auszulösen und um nicht näher spezifizierte Auswirkungen zu erzielen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0683