Threats Tagged 'cve-2025-40047'

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898) * kernel: i40e: fix idx validation in config queues msg (CVE-2025-39971) * kernel: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CVE-2025-40047) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (CVE-2025-38351) * kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498) * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697) * kernel: kernfs: Fix UAF in polling when open file is released (CVE-2025-39881) * kernel: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CVE-2025-39982) * kernel: i40e: fix idx validation in config queues msg (CVE-2025-39971) * kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CVE-2025-39983) * kernel: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CVE-2025-40047) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelation was in progress, but this can race with another invocation of the wait queue entry callback.

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise buffer to NULL before calling netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it is given. Setting it to NULL means it should start a fresh buffer, but the value is currently undefined.