In the Linux kernel, the following vulnerability has been resolved:
landlock: Fix handling of disconnected directories
Disconnected files or directories can appear when they are visible and
opened from a bind mount, but have been renamed or moved from the source
of the bind mount in a way that makes them inaccessible from the mount
point (i.e. out of scope).
Previously, access rights tied to files or directories opened through a
disconnected directory were collected by walking the related hierarchy
down to the root of the filesystem, without taking into account the
mount point because it couldn't be found. This could lead to
inconsistent access results, potential access right widening, and
hard-to-debug renames, especially since such paths cannot be printed.
For a sandboxed task to create a disconnected directory, it needs to
have write access (i.e. FS_MAKE_REG, FS_REMOVE_FILE, and FS_REFER) to
the underlying source of the bind mount, and read access to the related
mount point. Because a sandboxed task cannot acquire more access
rights than those defined by its Landlock domain, this could lead to
inconsistent access rights due to missing permissions that should be
inherited from the mount point hierarchy, while inheriting permissions
from the filesystem hierarchy hidden by this mount point instead.
Landlock now handles files and directories opened from disconnected
directories by taking into account the filesystem hierarchy when the
mount point is not found in the hierarchy walk, and also always taking
into account the mount point from which these disconnected directories
were opened. This ensures that a rename is not allowed if it would
widen access rights [1].
The rationale is that, even if disconnected hierarchies might not be
visible or accessible to a sandboxed task, relying on the collected
access rights from them improves the guarantee that access rights will
not be widened during a rename because of the access right comparison
between the source and the destination (see LANDLOCK_ACCESS_FS_REFER).
It may look like this would grant more access on disconnected files and
directories, but the security policies are always enforced for all the
evaluated hierarchies. This new behavior should be less surprising to
users and safer from an access control perspective.
Remove a wrong WARN_ON_ONCE() canary in collect_domain_accesses() and
fix the related comment.
Because opened files have their access rights stored in the related file
security properties, there is no impact for disconnected or unlinked
files.
A high-severity vulnerability identified as CVE-2025-68304 affects the Bluetooth hci_core component related to connection lookup on the RX path on the protocol side. The vulnerability involves Microsoft products including Azure Linux kernel version 3.0. No specific CVSS score is provided. There are no known exploits in the wild and no patch or remediation details are available in the provided data.
This vulnerability concerns an issue in the x86 CPU AMD Zen5 architecture related to the RDSEED instruction. It is identified as CVE-2025-68313 and affects Microsoft products including Azure Linux kernel version 3.0. The vulnerability is rated as high severity. No specific patch or remediation details are provided in the available information.
A vulnerability identified as CVE-2025-68174 affects the AMD Kernel Fusion Driver (amdkfd) component related to process checks in partition switching. The vulnerability is associated with Microsoft products including Azure Linux kernel version 3.0. No detailed technical exploit or impact information is provided beyond the general description. The severity is assessed as high based on the available metadata. No patch or remediation details are provided in the source data. No known exploits in the wild have been reported. The affected versions include Microsoft Azure Linux kernel 3.0. No specific geographic targeting is indicated.
A vulnerability identified as CVE-2025-37820 affects the xen-netfront component, specifically due to improper handling of NULL returned by the function xdp_convert_buff_to_frame(). This issue is part of a broader set of security fixes in the Linux kernel addressing multiple subsystems. The vulnerability has been assigned a medium severity level. A patch is available to address this issue.
Multiple security issues were discovered in the Linux kernel, including a vulnerability related to the RISC-V architecture's KVM teardown process. These flaws could potentially allow an attacker to compromise the system. The issues affect various kernel subsystems and architectures, and have been addressed in updated kernel releases.
A vulnerability identified as CVE-2025-22124 affects certain versions of the Linux kernel related to the md/md-bitmap component, specifically involving an incorrect bitmap_limit for clustermd when writing the superblock. This issue is part of a broader set of security fixes released in the Linux kernel addressing multiple subsystems. The vulnerability has a medium severity rating and patches are available.
This vulnerability (CVE-2025-22090) involves a flaw in the x86 memory management subsystem of the Linux kernel related to VM_PAT handling when the fork() system call fails in copy_page_range(). It is one of several security issues fixed in the Linux kernel as part of a broad update addressing multiple architectures and subsystems. The issue could potentially be exploited to compromise affected systems. A patch is available to correct this flaw.