SB2026041765 - Ubuntu update for linux-nvidia

Description

This security bulletin contains information about 173 secuirty vulnerabilities.

1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2024-36347)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper signature verification of x86 instruction execution. A local privileged user can load malicious microcode and execute it on the system.

2) Use-after-free (CVE-ID: CVE-2026-23209)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the macvlan_common_newlink() function in drivers/net/macvlan.c. A local user can escalate privileges on the system.

3) Memory leak (CVE-ID: CVE-2025-71154)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the async_set_registers() function in drivers/net/usb/rtl8150.c. A local user can perform a denial of service (DoS) attack.

4) Memory leak (CVE-ID: CVE-2025-71153)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the get_file_all_info() function in fs/smb/server/smb2pdu.c. A local user can perform a denial of service (DoS) attack.

5) Memory leak (CVE-ID: CVE-2025-71151)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the smb3_reconfigure() function in fs/smb/client/fs_context.c. A local user can perform a denial of service (DoS) attack.

6) Memory leak (CVE-ID: CVE-2025-71150)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ksmbd_session_lookup_all() function in fs/smb/server/mgmt/user_session.c. A local user can perform a denial of service (DoS) attack.

7) Resource management error (CVE-ID: CVE-2025-71149)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the io_poll_remove() function in io_uring/poll.c. A local user can perform a denial of service (DoS) attack.

8) Memory leak (CVE-ID: CVE-2025-71148)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the handshake_req_submit() function in net/handshake/request.c. A local user can perform a denial of service (DoS) attack.

9) Memory leak (CVE-ID: CVE-2025-71147)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tpm2_load_cmd() function in security/keys/trusted-keys/trusted_tpm2.c. A local user can perform a denial of service (DoS) attack.

10) Resource management error (CVE-ID: CVE-2025-71144)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the net/mptcp/protocol.h. A local user can perform a denial of service (DoS) attack.

11) Out-of-bounds read (CVE-ID: CVE-2025-71143)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the exynos_clkout_probe() function in drivers/clk/samsung/clk-exynos-clkout.c. A local user can perform a denial of service (DoS) attack.

12) Improper error handling (CVE-ID: CVE-2025-71141)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the drivers/gpu/drm/tilcdc/tilcdc_drv.h. A local user can perform a denial of service (DoS) attack.

13) NULL pointer dereference (CVE-ID: CVE-2025-71140)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the handle_enc_encode_msg() function in drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c. A local user can perform a denial of service (DoS) attack.

14) NULL pointer dereference (CVE-ID: CVE-2025-71138)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dpu_encoder_phys_wb_setup_ctl() function in drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c. A local user can perform a denial of service (DoS) attack.

15) Out-of-bounds read (CVE-ID: CVE-2025-71137)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the otx2_set_ringparam() function in drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c. A local user can perform a denial of service (DoS) attack.

16) Out-of-bounds read (CVE-ID: CVE-2025-71136)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the adv7842_cp_log_status() function in drivers/media/i2c/adv7842.c. A local user can perform a denial of service (DoS) attack.

17) NULL pointer dereference (CVE-ID: CVE-2025-71135)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the raid5_store_group_thread_cnt() function in drivers/md/raid5.c. A local user can perform a denial of service (DoS) attack.

18) Out-of-bounds read (CVE-ID: CVE-2025-71133)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the irdma_net_event() function in drivers/infiniband/hw/irdma/utils.c. A local user can perform a denial of service (DoS) attack.

19) Memory leak (CVE-ID: CVE-2025-71132)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the smc_rcv() function in drivers/net/ethernet/smsc/smc91x.c. A local user can perform a denial of service (DoS) attack.

20) Double free (CVE-ID: CVE-2025-71131)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the seqiv_aead_encrypt() function in crypto/seqiv.c. A local user can perform a denial of service (DoS) attack.

21) NULL pointer dereference (CVE-ID: CVE-2025-71130)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the eb_lookup_vmas(), i915_gem_do_execbuffer() and i915_gem_execbuffer2_ioctl() functions in drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c. A local user can perform a denial of service (DoS) attack.

22) Resource management error (CVE-ID: CVE-2025-71127)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ieee80211_rx_h_mgmt_check() function in net/mac80211/rx.c. A local user can perform a denial of service (DoS) attack.

23) Improper locking (CVE-ID: CVE-2025-71126)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __mptcp_retrans() function in net/mptcp/protocol.c. A local user can perform a denial of service (DoS) attack.

24) NULL pointer dereference (CVE-ID: CVE-2025-71125)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the trace_event_reg() function in kernel/trace/trace_events.c. A local user can perform a denial of service (DoS) attack.

25) Memory leak (CVE-ID: CVE-2025-71123)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the parse_apply_sb_mount_options() function in fs/ext4/super.c. A local user can perform a denial of service (DoS) attack.

26) Input validation error (CVE-ID: CVE-2025-71122)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the iommufd_test_add_reserved() function in drivers/iommu/iommufd/selftest.c. A local user can perform a denial of service (DoS) attack.

27) Input validation error (CVE-ID: CVE-2025-71121)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the gsc_set_affinity_irq() function in drivers/parisc/gsc.c. A local user can perform a denial of service (DoS) attack.

28) NULL pointer dereference (CVE-ID: CVE-2025-71120)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the gss_read_proxy_verf() function in net/sunrpc/auth_gss/svcauth_gss.c. A local user can perform a denial of service (DoS) attack.

29) Resource management error (CVE-ID: CVE-2025-71119)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the kexec_prepare_cpus_wait() and wake_offline_cpus() functions in arch/powerpc/kexec/core_64.c. A local user can perform a denial of service (DoS) attack.

30) NULL pointer dereference (CVE-ID: CVE-2025-71118)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the acpi_ns_walk_namespace() function in drivers/acpi/acpica/nswalk.c. A local user can perform a denial of service (DoS) attack.

31) Out-of-bounds read (CVE-ID: CVE-2025-71116)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the decode_pool() function in net/ceph/osdmap.c. A local user can perform a denial of service (DoS) attack.

32) Buffer overflow (CVE-ID: CVE-2025-71114)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the wdt_probe() function in drivers/watchdog/via_wdt.c. A local user can perform a denial of service (DoS) attack.

33) Use of uninitialized resource (CVE-ID: CVE-2025-71113)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the rng_accept_parent() function in crypto/algif_rng.c. A local user can perform a denial of service (DoS) attack.

34) Out-of-bounds read (CVE-ID: CVE-2025-71112)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the hclge_set_vlan_filter() function in drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c. A local user can perform a denial of service (DoS) attack.

35) Race condition (CVE-ID: CVE-2025-71111)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in drivers/hwmon/w83791d.c. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

36) Integer overflow (CVE-ID: CVE-2025-71109)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the ftrace_dyn_arch_init_insns() and ftrace_make_call() functions in arch/mips/kernel/ftrace.c. A local user can execute arbitrary code.

37) Input validation error (CVE-ID: CVE-2025-71108)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ucsi_init() function in drivers/usb/typec/ucsi/ucsi.c. A local user can perform a denial of service (DoS) attack.

38) Memory leak (CVE-ID: CVE-2025-71107)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the f2fs_put_super() function in fs/f2fs/super.c. A local user can perform a denial of service (DoS) attack.

39) Resource management error (CVE-ID: CVE-2025-71105)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the fs/f2fs/xattr.h. A local user can perform a denial of service (DoS) attack.

40) Improper locking (CVE-ID: CVE-2025-71104)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the advance_periodic_target_expiration() function in arch/x86/kvm/lapic.c. A local user can perform a denial of service (DoS) attack.

41) Input validation error (CVE-ID: CVE-2025-71102)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the scs_check_usage() function in kernel/scs.c. A local user can perform a denial of service (DoS) attack.

42) Out-of-bounds read (CVE-ID: CVE-2025-71101)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the hp_populate_string_elements_from_package() function in drivers/platform/x86/hp/hp-bioscfg/string-attributes.c. A local user can perform a denial of service (DoS) attack.

43) Improper error handling (CVE-ID: CVE-2025-71098)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the ip6gre_header() function in net/ipv6/ip6_gre.c. A local user can perform a denial of service (DoS) attack.

44) Memory leak (CVE-ID: CVE-2025-71097)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the fib_table_flush() function in net/ipv4/fib_trie.c. A local user can perform a denial of service (DoS) attack.

45) NULL pointer dereference (CVE-ID: CVE-2025-71096)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ib_nl_handle_ip_res_resp() function in drivers/infiniband/core/addr.c. A local user can perform a denial of service (DoS) attack.

46) Race condition (CVE-ID: CVE-2025-71095)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within the MODULE_PARM_DESC(), stmmac_xdp_get_tx_queue(), stmmac_xdp_xmit_back() and stmmac_rx_zc() functions in drivers/net/ethernet/stmicro/stmmac/stmmac_main.c. A local user can perform a denial of service (DoS) attack.

47) Resource management error (CVE-ID: CVE-2025-71094)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the asix_read_phy_addr() function in drivers/net/usb/asix_common.c. A local user can perform a denial of service (DoS) attack.

48) Buffer overflow (CVE-ID: CVE-2025-71093)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the e1000_tbi_should_accept() function in drivers/net/ethernet/intel/e1000/e1000_main.c. A local user can escalate privileges on the system.

49) Improper error handling (CVE-ID: CVE-2025-71091)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the __team_queue_override_enabled_check() function in drivers/net/team/team_core.c. A local user can perform a denial of service (DoS) attack.

50) Double free (CVE-ID: CVE-2025-71089)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the iommu_sva_bind_device() function in drivers/iommu/iommu-sva.c. A local user can perform a denial of service (DoS) attack.

51) Improper locking (CVE-ID: CVE-2025-71088)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the subflow_state_change() function in net/mptcp/subflow.c. A local user can perform a denial of service (DoS) attack.

52) Off-by-one (CVE-ID: CVE-2025-71087)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an off-by-one error within the iavf_config_rss_reg() function in drivers/net/ethernet/intel/iavf/iavf_main.c. A local user can perform a denial of service (DoS) attack.

53) Memory leak (CVE-ID: CVE-2025-71086)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the rose_kill_by_device() function in net/rose/af_rose.c. A local user can perform a denial of service (DoS) attack.

54) Resource management error (CVE-ID: CVE-2025-71085)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the calipso_skbuff_setattr() function in net/ipv6/calipso.c. A local user can perform a denial of service (DoS) attack.

55) Improper resource shutdown or release (CVE-ID: CVE-2025-71084)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to failure to properly release resources within the destroy_mc() function in drivers/infiniband/core/cma.c. A local user can perform a denial of service (DoS) attack.

56) NULL pointer dereference (CVE-ID: CVE-2025-71083)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ttm_bo_vm_access() function in drivers/gpu/drm/ttm/ttm_bo_vm.c. A local user can perform a denial of service (DoS) attack.

57) Use-after-free (CVE-ID: CVE-2025-71082)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the btusb_probe() and btusb_disconnect() functions in drivers/bluetooth/btusb.c. A local user can escalate privileges on the system.

58) Memory leak (CVE-ID: CVE-2025-71081)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the stm32_sai_sub_parse_of(), stm32_sai_sub_probe() and stm32_sai_sub_remove() functions in sound/soc/stm/stm32_sai_sub.c. A local user can perform a denial of service (DoS) attack.

59) Improper locking (CVE-ID: CVE-2025-71079)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the EXPORT_SYMBOL() and nfc_unregister_device() functions in net/nfc/core.c. A local user can perform a denial of service (DoS) attack.

60) Resource management error (CVE-ID: CVE-2025-71078)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the preload_age() function in arch/powerpc/mm/book3s64/slb.c. A local user can perform a denial of service (DoS) attack.

61) Out-of-bounds read (CVE-ID: CVE-2025-71077)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the include/linux/tpm.h. A local user can perform a denial of service (DoS) attack.

62) Race condition (CVE-ID: CVE-2025-71075)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the asd_pci_remove() function in drivers/scsi/aic94xx/aic94xx_init.c. A local user can escalate privileges on the system.

63) Input validation error (CVE-ID: CVE-2025-71072)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the shmem_rename2() function in mm/shmem.c. A local user can perform a denial of service (DoS) attack.

64) Use-after-free (CVE-ID: CVE-2025-71071)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mtk_iommu_mm_dts_parse(), mtk_iommu_probe() and mtk_iommu_remove() functions in drivers/iommu/mtk_iommu.c. A local user can escalate privileges on the system.

65) Buffer overflow (CVE-ID: CVE-2025-71069)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the f2fs_rename() function in fs/f2fs/namei.c. A local user can perform a denial of service (DoS) attack.

66) Buffer overflow (CVE-ID: CVE-2025-71068)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the svc_rdma_copy_inline_range() function in net/sunrpc/xprtrdma/svc_rdma_rw.c. A local user can perform a denial of service (DoS) attack.

67) Improper error handling (CVE-ID: CVE-2025-71067)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the ntfs_init_from_boot() function in fs/ntfs3/super.c. A local user can perform a denial of service (DoS) attack.

68) Use-after-free (CVE-ID: CVE-2025-71066)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ets_qdisc_change() function in net/sched/sch_ets.c. A local user can escalate privileges on the system.

69) Improper locking (CVE-ID: CVE-2025-71065)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the f2fs_save_errors() function in fs/f2fs/super.c. A local user can perform a denial of service (DoS) attack.

70) Use of uninitialized resource (CVE-ID: CVE-2025-71064)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the hclgevf_knic_setup() function in drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c. A local user can perform a denial of service (DoS) attack.

71) Use-after-free (CVE-ID: CVE-2025-68821)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the fuse_file_put() and fuse_file_open() functions in fs/fuse/file.c. A local user can escalate privileges on the system.

72) NULL pointer dereference (CVE-ID: CVE-2025-68820)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ext4_xattr_inode_dec_ref_all() function in fs/ext4/xattr.c. A local user can perform a denial of service (DoS) attack.

73) Out-of-bounds read (CVE-ID: CVE-2025-68819)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the dtv5100_i2c_msg() function in drivers/media/usb/dvb-usb/dtv5100.c. A local user can perform a denial of service (DoS) attack.

74) Input validation error (CVE-ID: CVE-2025-68818)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __qla2x00_abort_all_cmds() function in drivers/scsi/qla2xxx/qla_os.c. A local user can perform a denial of service (DoS) attack.

75) Use-after-free (CVE-ID: CVE-2025-68817)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the smb2_tree_disconnect() function in fs/smb/server/smb2pdu.c. A local user can escalate privileges on the system.

76) Input validation error (CVE-ID: CVE-2025-68816)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h. A local user can perform a denial of service (DoS) attack.

77) Resource management error (CVE-ID: CVE-2025-68815)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ets_qdisc_change() function in net/sched/sch_ets.c. A local user can perform a denial of service (DoS) attack.

78) Memory leak (CVE-ID: CVE-2025-68814)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the __io_openat_prep() function in io_uring/openclose.c. A local user can perform a denial of service (DoS) attack.

79) NULL pointer dereference (CVE-ID: CVE-2025-68813)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __ip_vs_get_out_rt() function in net/netfilter/ipvs/ip_vs_xmit.c. A local user can perform a denial of service (DoS) attack.

80) Input validation error (CVE-ID: CVE-2025-68811)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the svc_rdma_copy_inline_range() function in net/sunrpc/xprtrdma/svc_rdma_rw.c. A local user can perform a denial of service (DoS) attack.

81) Use-after-free (CVE-ID: CVE-2025-68810)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the __kvm_set_memory_region() function in virt/kvm/kvm_main.c. A local user can escalate privileges on the system.

82) Race condition within a thread (CVE-ID: CVE-2025-68809)

The vulnerability allows a local user to corrupt data.

The vulnerability exists due to a data race within the ksmbd_query_inode_status() and __ksmbd_inode_close() functions in fs/smb/server/vfs_cache.c. A local user can corrupt data.

83) Use-after-free (CVE-ID: CVE-2025-68808)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vidtv_channel_si_init() function in drivers/media/test-drivers/vidtv/vidtv_channel.c. A local user can escalate privileges on the system.

84) Input validation error (CVE-ID: CVE-2025-68806)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the smb2_set_ea() function in fs/smb/server/smb2pdu.c. A local user can perform a denial of service (DoS) attack.

85) Use-after-free (CVE-ID: CVE-2025-68804)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cros_ec_ishtp_remove() function in drivers/platform/chrome/cros_ec_ishtp.c. A local user can escalate privileges on the system.

86) Use-after-free (CVE-ID: CVE-2025-68801)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mlxsw_sp_neigh_entry_alloc(), mlxsw_sp_nexthop_dead_neigh_replace(), mlxsw_sp_nexthop_neigh_init() and mlxsw_sp_nexthop_neigh_fini() functions in drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c. A local user can escalate privileges on the system.

87) Use-after-free (CVE-ID: CVE-2025-68800)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mlxsw_sp_mr_route_add() function in drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c. A local user can escalate privileges on the system.

88) Use of uninitialized resource (CVE-ID: CVE-2025-68799)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the cffrml_receive() function in net/caif/cffrml.c. A local user can perform a denial of service (DoS) attack.

89) NULL pointer dereference (CVE-ID: CVE-2025-68798)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the amd_pmu_enable_all() function in arch/x86/events/amd/core.c. A local user can perform a denial of service (DoS) attack.

90) NULL pointer dereference (CVE-ID: CVE-2025-68797)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ac_ioctl() function in drivers/char/applicom.c. A local user can perform a denial of service (DoS) attack.

91) Improper error handling (CVE-ID: CVE-2025-68796)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the f2fs_do_zero_range() function in fs/f2fs/file.c. A local user can perform a denial of service (DoS) attack.

92) Buffer overflow (CVE-ID: CVE-2025-68795)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the ethtool_get_strings(), ethtool_get_stats(), ethtool_get_phy_stats_phydev(), ethtool_get_phy_stats_ethtool() and ethtool_get_phy_stats() functions in net/ethtool/ioctl.c. A local user can perform a denial of service (DoS) attack.

93) Integer underflow (CVE-ID: CVE-2025-68794)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the iomap_adjust_read_range() function in fs/iomap/buffered-io.c. A local user can execute arbitrary code.

94) Input validation error (CVE-ID: CVE-2025-68788)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __fsnotify_parent() function in fs/notify/fsnotify.c. A local user can perform a denial of service (DoS) attack.

95) Memory leak (CVE-ID: CVE-2025-68787)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nr_output() function in net/netrom/nr_out.c. A local user can perform a denial of service (DoS) attack.

96) Improper locking (CVE-ID: CVE-2025-68786)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the check_lock_range() and ksmbd_vfs_truncate() functions in fs/smb/server/vfs.c. A local user can perform a denial of service (DoS) attack.

97) Out-of-bounds read (CVE-ID: CVE-2025-68785)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the validate_and_copy_set_tun() and __ovs_nla_copy_actions() functions in net/openvswitch/flow_netlink.c. A local user can perform a denial of service (DoS) attack.

98) Input validation error (CVE-ID: CVE-2025-68783)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the get_meter_levels_from_urb() function in sound/usb/mixer_us16x08.c. A local user can perform a denial of service (DoS) attack.

99) NULL pointer dereference (CVE-ID: CVE-2025-68782)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the target_cmd_init_cdb() function in drivers/target/target_core_transport.c. A local user can perform a denial of service (DoS) attack.

100) Improper locking (CVE-ID: CVE-2025-68780)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the dec_dl_deadline(), rq_online_dl() and rq_offline_dl() functions in kernel/sched/deadline.c. A local user can perform a denial of service (DoS) attack.

101) Use-after-free (CVE-ID: CVE-2025-68778)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the conflicting_inode_is_dir(), add_conflicting_inode() and log_conflicting_inodes() functions in fs/btrfs/tree-log.c. A local user can escalate privileges on the system.

102) Out-of-bounds read (CVE-ID: CVE-2025-68777)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the titsc_config_wires() function in drivers/input/touchscreen/ti_am335x_tsc.c. A local user can perform a denial of service (DoS) attack.

103) NULL pointer dereference (CVE-ID: CVE-2025-68776)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the prp_get_untagged_frame() function in net/hsr/hsr_forward.c. A local user can perform a denial of service (DoS) attack.

104) Memory leak (CVE-ID: CVE-2025-68775)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the handshake_req_cancel() function in net/handshake/request.c. A local user can perform a denial of service (DoS) attack.

105) Incorrect calculation (CVE-ID: CVE-2025-68774)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the __hfs_bnode_create() function in fs/hfsplus/bnode.c. A local user can perform a denial of service (DoS) attack.

106) Buffer overflow (CVE-ID: CVE-2025-68773)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the fsl_spi_prepare_message() function in drivers/spi/spi-fsl-spi.c. A local user can perform a denial of service (DoS) attack.

107) Improper locking (CVE-ID: CVE-2025-68772)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the f2fs_alloc_inode() function in fs/f2fs/super.c. A local user can perform a denial of service (DoS) attack.

108) Improper error handling (CVE-ID: CVE-2025-68771)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the ocfs2_claim_suballoc_bits() function in fs/ocfs2/suballoc.c. A local user can perform a denial of service (DoS) attack.

109) Resource management error (CVE-ID: CVE-2025-68770)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the bnxt_rx_xdp() function in drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c. A local user can perform a denial of service (DoS) attack.

110) Improper error handling (CVE-ID: CVE-2025-68769)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the f2fs_fill_super() function in fs/f2fs/super.c. A local user can perform a denial of service (DoS) attack.

111) Improper privilege management (CVE-ID: CVE-2025-68767)

The vulnerability allows a local user to read and manipulate data.

The vulnerability exists due to improperly imposed permissions within the hfsplus_get_perms() and hfsplus_cat_read_inode() functions in fs/hfsplus/inode.c. A local user can read and manipulate data.

112) Out-of-bounds read (CVE-ID: CVE-2025-68766)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the mchp_eic_domain_alloc() function in drivers/irqchip/irq-mchp-eic.c. A local user can perform a denial of service (DoS) attack.

113) Memory leak (CVE-ID: CVE-2025-68765)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mt7615_mcu_wtbl_sta_add() function in drivers/net/wireless/mediatek/mt76/mt7615/mcu.c. A local user can perform a denial of service (DoS) attack.

114) Improper locking (CVE-ID: CVE-2025-68764)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nfs_get_tree_common() function in fs/nfs/super.c. A local user can perform a denial of service (DoS) attack.

115) Improper error handling (CVE-ID: CVE-2025-68763)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the starfive_hash_digest() function in drivers/crypto/starfive/jh7110-hash.c. A local user can perform a denial of service (DoS) attack.

116) Memory leak (CVE-ID: CVE-2025-68759)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the rtl8180_init_rx_ring() and rtl8180_start() functions in drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c. A local user can perform a denial of service (DoS) attack.

117) NULL pointer dereference (CVE-ID: CVE-2025-68758)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the led_bl_probe() function in drivers/video/backlight/led_bl.c. A local user can perform a denial of service (DoS) attack.

118) Improper locking (CVE-ID: CVE-2025-68757)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the vgem_fence_create() function in drivers/gpu/drm/vgem/vgem_fence.c. A local user can perform a denial of service (DoS) attack.

119) Improper locking (CVE-ID: CVE-2025-68756)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the blk_mq_quiesce_tagset(), blk_mq_unquiesce_tagset(), blk_mq_del_queue_tag_set() and blk_mq_add_queue_tag_set() functions in block/blk-mq.c. A local user can perform a denial of service (DoS) attack.

120) NULL pointer dereference (CVE-ID: CVE-2025-68755)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the function in drivers/staging/most/i2c/i2c.c. A local user can perform a denial of service (DoS) attack.

121) Buffer overflow (CVE-ID: CVE-2025-68753)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the hwdep_read() function in sound/firewire/motu/motu-hwdep.c. A local user can escalate privileges on the system.

122) Use-after-free (CVE-ID: CVE-2025-68744)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the free_htab_elem() function in kernel/bpf/hashtab.c. A local user can escalate privileges on the system.

123) Resource management error (CVE-ID: CVE-2025-68742)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the bpf_prog_inc_misses_counter() function in kernel/bpf/syscall.c. A local user can perform a denial of service (DoS) attack.

124) Use-after-free (CVE-ID: CVE-2025-68741)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the qla2xxx_process_purls_iocb() function in drivers/scsi/qla2xxx/qla_nvme.c. A local user can escalate privileges on the system.

125) Improper error handling (CVE-ID: CVE-2025-68740)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the ima_match_rules() function in security/integrity/ima/ima_policy.c. A local user can perform a denial of service (DoS) attack.

126) Resource management error (CVE-ID: CVE-2025-68733)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the do_setattr() function in security/smack/smack_lsm.c. A local user can perform a denial of service (DoS) attack.

127) Improper locking (CVE-ID: CVE-2025-68732)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the syncpt_release() and host1x_syncpt_put() functions in drivers/gpu/host1x/syncpt.c. A local user can perform a denial of service (DoS) attack.

128) Buffer overflow (CVE-ID: CVE-2025-68728)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the ntfs_get_bh() function in fs/ntfs3/fsntfs.c. A local user can perform a denial of service (DoS) attack.

129) Buffer overflow (CVE-ID: CVE-2025-68727)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the ntfs_link_inode() function in fs/ntfs3/inode.c. A local user can perform a denial of service (DoS) attack.

130) Integer overflow (CVE-ID: CVE-2025-68724)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the asymmetric_key_generate_id() function in crypto/asymmetric_keys/asymmetric_type.c. A local user can execute arbitrary code.

131) Resource management error (CVE-ID: CVE-2025-68380)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ath11k_wmi_send_peer_assoc_cmd() function in drivers/net/wireless/ath/ath11k/wmi.c. A local user can perform a denial of service (DoS) attack.

132) NULL pointer dereference (CVE-ID: CVE-2025-68379)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the rxe_srq_from_attr() function in drivers/infiniband/sw/rxe/rxe_srq.c. A local user can perform a denial of service (DoS) attack.

133) Out-of-bounds read (CVE-ID: CVE-2025-68378)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the __bpf_get_stackid() and BPF_CALL_3() functions in kernel/bpf/stackmap.c. A local user can perform a denial of service (DoS) attack.

134) Use-after-free (CVE-ID: CVE-2025-68374)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the drivers/md/md.h. A local user can escalate privileges on the system.

135) Use-after-free (CVE-ID: CVE-2025-68372)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the recv_work() function in drivers/block/nbd.c. A local user can escalate privileges on the system.

136) Use-after-free (CVE-ID: CVE-2025-68371)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the pqi_device_reset() and pqi_sdev_destroy() functions in drivers/scsi/smartpqi/smartpqi_init.c. A local user can escalate privileges on the system.

137) Improper locking (CVE-ID: CVE-2025-68369)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ntfs_read_mft() function in fs/ntfs3/inode.c. A local user can perform a denial of service (DoS) attack.

138) Improper locking (CVE-ID: CVE-2025-68367)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the mac_hid_toggle_emumouse() function in drivers/macintosh/mac_hid.c. A local user can perform a denial of service (DoS) attack.

139) Use-after-free (CVE-ID: CVE-2025-68366)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nbd_genl_connect() function in drivers/block/nbd.c. A local user can escalate privileges on the system.

140) Input validation error (CVE-ID: CVE-2025-68364)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __ocfs2_move_extent() function in fs/ocfs2/move_extents.c. A local user can perform a denial of service (DoS) attack.

141) Resource management error (CVE-ID: CVE-2025-68363)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the BPF_CALL_5() function in net/core/filter.c. A local user can perform a denial of service (DoS) attack.

142) Integer underflow (CVE-ID: CVE-2025-68362)

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the rtl8187_rx_cb() function in drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c. A local user can execute arbitrary code.

143) Use-after-free (CVE-ID: CVE-2025-68354)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the regulator_supply_alias(), regulator_register_supply_alias() and regulator_unregister_supply_alias() functions in drivers/regulator/core.c. A local user can escalate privileges on the system.

144) Buffer overflow (CVE-ID: CVE-2025-68349)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the pnfs_mark_layout_stateid_invalid() function in fs/nfs/pnfs.c. A local user can perform a denial of service (DoS) attack.

145) Buffer overflow (CVE-ID: CVE-2025-68347)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the hwdep_read() function in sound/firewire/motu/motu-hwdep.c. A local user can escalate privileges on the system.

146) Out-of-bounds read (CVE-ID: CVE-2025-68346)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the detect_stream_formats() function in sound/firewire/dice/dice-extension.c. A local user can perform a denial of service (DoS) attack.

147) NULL pointer dereference (CVE-ID: CVE-2025-68345)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cs35l41_hda_read_acpi() function in sound/hda/codecs/side-codecs/cs35l41_hda.c. A local user can perform a denial of service (DoS) attack.

148) Input validation error (CVE-ID: CVE-2025-68344)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the function in sound/isa/wavefront/wavefront_synth.c. A local user can perform a denial of service (DoS) attack.

149) Reachable assertion (CVE-ID: CVE-2025-68337)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to reachable assertion within the jbd2_journal_get_create_access() function in fs/jbd2/transaction.c. A local user can perform a denial of service (DoS) attack.

150) Improper locking (CVE-ID: CVE-2025-68336)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the do_raw_read_unlock() function in kernel/locking/spinlock_debug.c. A local user can perform a denial of service (DoS) attack.

151) NULL pointer dereference (CVE-ID: CVE-2025-68335)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pcl818_detach() function in drivers/comedi/drivers/pcl818.c. A local user can perform a denial of service (DoS) attack.

152) Resource management error (CVE-ID: CVE-2025-68332)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the c6xdigio_attach() function in drivers/comedi/drivers/c6xdigio.c. A local user can perform a denial of service (DoS) attack.

153) NULL pointer dereference (CVE-ID: CVE-2025-68325)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cake_drop(), cake_reconfigure() and cake_enqueue() functions in net/sched/sch_cake.c. A local user can perform a denial of service (DoS) attack.

154) Use of uninitialized resource (CVE-ID: CVE-2025-68291)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the mptcp_do_fastclose() function in net/mptcp/protocol.c. A local user can perform a denial of service (DoS) attack.

155) Buffer overflow (CVE-ID: CVE-2025-68266)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the bfs_iget() function in fs/bfs/inode.c. A local user can perform a denial of service (DoS) attack.

156) Use-after-free (CVE-ID: CVE-2025-68265)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nvme_remove_admin_tag_set() and nvme_free_ctrl() functions in drivers/nvme/host/core.c. A local user can escalate privileges on the system.

157) Improper locking (CVE-ID: CVE-2025-68264)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ext4_prepare_inline_data() function in fs/ext4/inline.c. A local user can perform a denial of service (DoS) attack.

158) Use-after-free (CVE-ID: CVE-2025-68263)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ipc_msg_send_request() function in fs/smb/server/transport_ipc.c. A local user can escalate privileges on the system.

159) Reachable assertion (CVE-ID: CVE-2025-68261)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to reachable assertion within the ext4_destroy_inline_data_nolock() function in fs/ext4/inline.c. A local user can perform a denial of service (DoS) attack.

160) Resource management error (CVE-ID: CVE-2025-68259)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the is_vmware_backdoor_opcode() and x86_emulate_instruction() functions in arch/x86/kvm/x86.c. A local user can perform a denial of service (DoS) attack.

161) Improper locking (CVE-ID: CVE-2025-68258)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the multiq3_attach() function in drivers/comedi/drivers/multiq3.c. A local user can perform a denial of service (DoS) attack.

162) NULL pointer dereference (CVE-ID: CVE-2025-68257)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the compat_chaninfo(), compat_rangeinfo(), compat_cmd(), compat_cmdtest(), compat_insnlist() and compat_insn() functions in drivers/comedi/comedi_fops.c. A local user can perform a denial of service (DoS) attack.

163) Out-of-bounds read (CVE-ID: CVE-2025-68256)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the rtw_get_ie() function in drivers/staging/rtl8723bs/core/rtw_ieee80211.c. A local user can perform a denial of service (DoS) attack.

164) Buffer overflow (CVE-ID: CVE-2025-68255)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the OnAssocReq() function in drivers/staging/rtl8723bs/core/rtw_mlme_ext.c. A local user can escalate privileges on the system.

165) Out-of-bounds read (CVE-ID: CVE-2025-68254)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the OnBeacon() function in drivers/staging/rtl8723bs/core/rtw_mlme_ext.c. A local user can perform a denial of service (DoS) attack.

166) Resource management error (CVE-ID: CVE-2025-68206)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the nft_ct_helper_obj_eval() function in net/netfilter/nft_ct.c. A local user can perform a denial of service (DoS) attack.

167) Resource management error (CVE-ID: CVE-2025-40325)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the raid10_handle_discard() function in drivers/md/raid10.c. A local user can perform a denial of service (DoS) attack.

168) Resource management error (CVE-ID: CVE-2025-40164)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the usbnet_resume_rx() function in drivers/net/usb/usbnet.c. A local user can perform a denial of service (DoS) attack.

169) Improper locking (CVE-ID: CVE-2025-38234)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the find_lowest_rq() and find_lock_lowest_rq() functions in kernel/sched/rt.c. A local user can perform a denial of service (DoS) attack.

170) Use-after-free (CVE-ID: CVE-2025-38022)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ib_device_notify_register() and ib_register_device() functions in drivers/infiniband/core/device.c. A local user can escalate privileges on the system.

171) Improper locking (CVE-ID: CVE-2025-22111)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the sock_write_iter(), brioctl_set(), br_ioctl_call(), sock_ioctl() and compat_sock_ioctl_trans() functions in net/socket.c, within the dev_ifsioc() and dev_ioctl() functions in net/core/dev_ioctl.c, within the old_deviceless() and br_ioctl_stub() functions in net/bridge/br_ioctl.c. A local user can perform a denial of service (DoS) attack.

172) Improper locking (CVE-ID: CVE-2025-22022)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the drivers/usb/host/xhci.h. A local user can perform a denial of service (DoS) attack.

173) Use-after-free (CVE-ID: CVE-2024-57795)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rxe_query_port(), rxe_enable_driver(), INIT_RDMA_OBJ_SIZE() and rxe_register_device() functions in drivers/infiniband/sw/rxe/rxe_verbs.c, within the rxe_parent_name(), rxe_net_add() and rxe_port_down() functions in drivers/infiniband/sw/rxe/rxe_net.c, within the rxe_mcast_add() function in drivers/infiniband/sw/rxe/rxe_mcast.c, within the rxe_dealloc(), rxe_init_device_param(), rxe_init_port_param() and rxe_set_mtu() functions in drivers/infiniband/sw/rxe/rxe.c. A local user can escalate privileges on the system.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-8185-1