Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: a3583028 by Salvatore Bonaccorso at 2025-10-01T12:48:19+02:00 Merge Linux CVEs from kernel-sec - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -1,3 +1,79 @@ +CVE-2025-39917 [bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt] + - linux 6.16.8-1 + [trixie] - linux 6.12.48-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + [bullseye] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/f9bb6ffa7f5ad0f8ee0f53fc4a10655872ee4a14 (6.17-rc6) +CVE-2025-39916 [mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()] + - linux 6.16.8-1 + [trixie] - linux 6.12.48-1 + [bookworm] - linux 6.1.153-1 + [bullseye] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/e6b543ca9806d7bced863f43020e016ee996c057 (6.17-rc6) +CVE-2025-39915 [net: phy: transfer phy_config_inband() locking responsibility to phylink] + - linux 6.16.8-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + [bullseye] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/e2a10daba84968f6b5777d150985fd7d6abc9c84 (6.17-rc6) +CVE-2025-39914 [tracing: Silence warning when chunk allocation fails in trace_pid_write] + - linux 6.16.8-1 + [trixie] - linux 6.12.48-1 + [bookworm] - linux 6.1.153-1 + [bullseye] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/cd4453c5e983cf1fd5757e9acb915adb1e4602b6 (6.17-rc6) +CVE-2025-39913 [tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.] + - linux 6.16.8-1 + [trixie] - linux 6.12.48-1 + [bookworm] - linux 6.1.153-1 + NOTE: https://git.kernel.org/linus/a3967baad4d533dc254c31e0d221e51c8d223d58 (6.17-rc6) +CVE-2025-39912 [nfs/localio: restore creds before releasing pageio data] + - linux 6.16.8-1 + [trixie] - linux 6.12.48-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + [bullseye] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/992203a1fba51b025c60ec0c8b0d9223343dea95 (6.17-rc6) +CVE-2025-39911 [i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path] + - linux 6.16.8-1 + [trixie] - linux 6.12.48-1 + [bookworm] - linux 6.1.153-1 + NOTE: https://git.kernel.org/linus/915470e1b44e71d1dd07ee067276f003c3521ee3 (6.17-rc6) +CVE-2025-39910 [mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()] + - linux 6.16.8-1 + [bullseye] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/79357cd06d41d0f5a11b17d7c86176e395d10ef2 (6.17-rc6) +CVE-2025-39909 [mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters()] + - linux 6.16.8-1 + [trixie] - linux 6.12.48-1 + [bookworm] - linux 6.1.153-1 + [bullseye] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/711f19dfd783ffb37ca4324388b9c4cb87e71363 (6.17-rc6) +CVE-2025-39908 [net: dev_ioctl: take ops lock in hwtstamp lower paths] + - linux 6.16.8-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + [bullseye] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/686cab5a18e443e1d5f2abb17bed45837836425f (6.17-rc6) +CVE-2025-39907 [mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer] + - linux 6.16.8-1 + [trixie] - linux 6.12.48-1 + [bookworm] - linux 6.1.153-1 + NOTE: https://git.kernel.org/linus/513c40e59d5a414ab763a9c84797534b5e8c208d (6.17-rc6) +CVE-2025-39906 [drm/amd/display: remove oem i2c adapter on finish] + - linux 6.16.8-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + [bullseye] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/1dfd2864a1c4909147663e5a27c055f50f7c2796 (6.17-rc6) +CVE-2025-39905 [net: phylink: add lock for serializing concurrent pl->phydev writes with resolver] + - linux 6.16.8-1 + NOTE: https://git.kernel.org/linus/0ba5b2f2c381dbec9ed9e4ab3ae5d3e667de0dc3 (6.17-rc6) +CVE-2025-39904 [arm64: kexec: initialize kexec_buf struct in load_other_segments()] + - linux 6.16.8-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + [bullseye] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/04d3cd43700a2d0fe4bfb1012a8ec7f2e34a3507 (6.17-rc6) CVE-2025-39903 [of_numa: fix uninitialized memory nodes causing kernel panic] - linux 6.16.6-1 [trixie] - linux 6.12.48-1 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a358302814ddfa82310e8b8166398abfc57f8719 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a358302814ddfa82310e8b8166398abfc57f8719 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
