https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:24:59 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-15025 bdu:2025-15025 https://cve.radiocsirt.org/vuln/bdu:2025-15025 https://cve.radiocsirt.org/vuln/bell-cve-2025-38691 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-38691 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0825 certfr-2025-avi-0825 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0825 https://cve.radiocsirt.org/vuln/euvd-2026-336344 EUVD-2026-336344 https://cve.radiocsirt.org/vuln/euvd-2026-336344 https://cve.radiocsirt.org/vuln/fkie_cve-2025-38691 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>pNFS: Fix uninited ptr deref in block/scsi layout</p> <p>The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the &#34;layoutupdate_pages&#34; page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers.</p> <p>An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server.</p> <p>During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>pNFS: Fix uninited ptr deref in block/scsi layout</p> <p>The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the &#34;layoutupdate_pages&#34; page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers.</p> <p>An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server.</p> <p>During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-38691 https://cve.radiocsirt.org/vuln/ghsa-94hx-q75x-2q84 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>pNFS: Fix uninited ptr deref in block/scsi layout</p> <p>The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the &#34;layoutupdate_pages&#34; page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers.</p> <p>An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server.</p> <p>During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>pNFS: Fix uninited ptr deref in block/scsi layout</p> <p>The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the &#34;layoutupdate_pages&#34; page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers.</p> <p>An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server.</p> <p>During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again.</p> https://cve.radiocsirt.org/vuln/ghsa-94hx-q75x-2q84 https://cve.radiocsirt.org/vuln/icsa-25-162-05 <p>sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash. A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags. A buffer overflow was discovered in the GNU C Library&#39;s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment var…</p> <p>sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash. A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags. A buffer overflow was discovered in the GNU C Library&#39;s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment var…</p> https://cve.radiocsirt.org/vuln/icsa-25-162-05 https://cve.radiocsirt.org/vuln/msrc_cve-2025-38691 msrc_CVE-2025-38691 https://cve.radiocsirt.org/vuln/msrc_cve-2025-38691 https://cve.radiocsirt.org/vuln/ncsc-2026-0147 NCSC-2026-0147 https://cve.radiocsirt.org/vuln/ncsc-2026-0147 https://cve.radiocsirt.org/vuln/oesa-2025-2310 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/tls: fix kernel panic when alloc_page failed</p> <p>We cannot set frag_list to NULL pointer when alloc_page failed. It will be used in tls_strp_check_queue_ok when the next time tls_strp_read_sock is called.</p> <p>This is because we don&amp;apos;t reset full_len in tls_strp_flush_anchor_copy() so the recv path will try to continue handling the partial record on the next call but we dettached the rcvq from the frag list. Alternative fix would be to reset full_len.</p> <p>Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Call trace: tls_strp_check_rcv+0x128/0x27c tls_strp_data_ready+0x34/0x44 tls_data_ready+0x3c/0x1f0 tcp_data_ready+0x9c/0xe4 tcp_data_queue+0xf6c/0x12d0 tcp_rcv_established+0x52c/0x798(CVE-2025-38018)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>calipso: Don&amp;apos;t call calipso functions for AF_INET sk.</p> <p>syzkaller reported a null-ptr-deref in txopt_get(). [0]</p> <p>The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.</p> <p>However, this never happens for IPv6 sockets as inet_sk(sk)-&amp;gt;pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.</p> <p>The root cause is missing validation in netlbl_conn_setattr().</p> <p>netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace.…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/tls: fix kernel panic when alloc_page failed</p> <p>We cannot set frag_list to NULL pointer when alloc_page failed. It will be used in tls_strp_check_queue_ok when the next time tls_strp_read_sock is called.</p> <p>This is because we don&amp;apos;t reset full_len in tls_strp_flush_anchor_copy() so the recv path will try to continue handling the partial record on the next call but we dettached the rcvq from the frag list. Alternative fix would be to reset full_len.</p> <p>Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 Call trace: tls_strp_check_rcv+0x128/0x27c tls_strp_data_ready+0x34/0x44 tls_data_ready+0x3c/0x1f0 tcp_data_ready+0x9c/0xe4 tcp_data_queue+0xf6c/0x12d0 tcp_rcv_established+0x52c/0x798(CVE-2025-38018)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>calipso: Don&amp;apos;t call calipso functions for AF_INET sk.</p> <p>syzkaller reported a null-ptr-deref in txopt_get(). [0]</p> <p>The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there.</p> <p>However, this never happens for IPv6 sockets as inet_sk(sk)-&amp;gt;pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one.</p> <p>The root cause is missing validation in netlbl_conn_setattr().</p> <p>netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace.…</p> https://cve.radiocsirt.org/vuln/oesa-2025-2310 https://cve.radiocsirt.org/vuln/opensuse-su-2025:20081-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:20081-1 https://cve.radiocsirt.org/vuln/ssa-032379 <p>In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_res-&gt;hpo_dp_link_enc before using it [WHAT &amp; HOW] Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity. In the Linux kernel, the following vulnerability has been resolved:</p> <p>fs: relax assertions on failure to encode file handles</p> <p>Encoding file handles is usually performed by a filesystem &gt;encode_fh() method that may fail for various reasons.</p> <p>The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle.</p> <p>There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when -&gt;encode_fh() fails. Relax those assertions because they are wrong.</p> <p>The second linked bug report states commit 16aac5ad1fa9 (&#34;ovl: support encoding non-decodable file handles&#34;) in v6.6 as the regressing commit, but this is not accurate.</p> <p>The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches.</p> <p>Triggering this assertion was always possible with other filesystems and other reasons of -&gt;encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlay…</p> <p>In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_res-&gt;hpo_dp_link_enc before using it [WHAT &amp; HOW] Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity. In the Linux kernel, the following vulnerability has been resolved:</p> <p>fs: relax assertions on failure to encode file handles</p> <p>Encoding file handles is usually performed by a filesystem &gt;encode_fh() method that may fail for various reasons.</p> <p>The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle.</p> <p>There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when -&gt;encode_fh() fails. Relax those assertions because they are wrong.</p> <p>The second linked bug report states commit 16aac5ad1fa9 (&#34;ovl: support encoding non-decodable file handles&#34;) in v6.6 as the regressing commit, but this is not accurate.</p> <p>The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches.</p> <p>Triggering this assertion was always possible with other filesystems and other reasons of -&gt;encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlay…</p> https://cve.radiocsirt.org/vuln/ssa-032379 https://cve.radiocsirt.org/vuln/suse-su-2025:03600-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2025:03600-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-38691 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 216 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the &#34;layoutupdate_pages&#34; page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers. An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server. During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 216 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the &#34;layoutupdate_pages&#34; page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers. An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server. During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-38691 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1976 <p>Ein Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder andere nicht spezifizierte Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder andere nicht spezifizierte Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1976