https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:46:16 +0000 https://cve.radiocsirt.org/vuln/cve-2025-38257 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>s390/pkey: Prevent overflow in size calculation for memdup_user()</p> <p>Number of apqn target list entries contained in &#39;nr_apqns&#39; variable is determined by userspace via an ioctl call so the result of the product in calculation of size passed to memdup_user() may overflow.</p> <p>In this case the actual size of the allocated area and the value describing it won&#39;t be in sync leading to various types of unpredictable behaviour later.</p> <p>Use a proper memdup_array_user() helper which returns an error if an overflow is detected. Note that it is different from when nr_apqns is initially zero - that case is considered valid and should be handled in subsequent pkey_handler implementations.</p> <p>Found by Linux Verification Center (linuxtesting.org).</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>s390/pkey: Prevent overflow in size calculation for memdup_user()</p> <p>Number of apqn target list entries contained in &#39;nr_apqns&#39; variable is determined by userspace via an ioctl call so the result of the product in calculation of size passed to memdup_user() may overflow.</p> <p>In this case the actual size of the allocated area and the value describing it won&#39;t be in sync leading to various types of unpredictable behaviour later.</p> <p>Use a proper memdup_array_user() helper which returns an error if an overflow is detected. Note that it is different from when nr_apqns is initially zero - that case is considered valid and should be handled in subsequent pkey_handler implementations.</p> <p>Found by Linux Verification Center (linuxtesting.org).</p> https://cve.radiocsirt.org/vuln/cve-2025-38257