CVE-2025-21631
NoneCVSS
—
EPSS
0.2%
Published
Jan 19, 2025
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel's disk handling code can let someone who already has access to the machine crash it or take over more control.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Privilege Gain
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in bfq_init_rq after bfq_split_bfqq leads to invalid memory access when a waker_bfqq pointer is dereferenced during request insertion in the BFQ I/O scheduler.
Why it matters to the business
Attackers with local access can trigger kernel crashes or potential privilege escalation on Linux systems, leading to denial of service or unauthorized code execution; high prevalence in enterprise kernels increases exposure for servers and containers.
How an attack unfolds
An attacker crafts file system operations or I/O patterns that trigger bfq queue splitting during bio submission, then reuses the freed bfqq structure to corrupt kernel memory and escalate privileges, as seen in similar kernel UAF chains.
How to fix it
Upgrade the Linux kernel to version 5.15.177 or later, or apply commit f587c1ac68956c4703857d650d9b1cd7bb2ac4d7 from stable git trees; rebuild and reboot affected systems.
How to confirm the fix worked
Confirm the running kernel version is at or above the fixed release; reproduce the original syzkaller reproducer and verify absence of KASAN reports in dmesg; check git log for the referenced commit.
Typical attack path
- Obtain local unprivileged access on a vulnerable Linux system
- Trigger repeated file open/read operations or fiemap ioctls to force bfq queue splits
- Race the split with request initialization to hit the freed waker_bfqq pointer
- Leverage the resulting UAF for memory corruption and privilege escalation
How to detect it
Inspect kernel logs and dmesg for KASAN slab-use-after-free reports referencing bfq_init_rq or bfq_split_bfqq; look for crash dumps involving ext4 fiemap or bio submission paths.
What your security team should do
- Prioritize patching production kernels within the next maintenance window due to local exploit potential
- Monitor for similar BFQ-related UAF reports in future kernel releases
- Restrict unprivileged local access where feasible until patches are deployed
The record
In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UAF for v6.6: BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read of size 8 at addr ffff8881b57147d8 by task fsstress/232726 CPU: 2 PID: 232726 Comm: fsstress Not tainted 6.6.0-g3629d1885222 #39 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 print_address_description.constprop.0+0x66/0x300 mm/kasan/report.c:364 print_report+0x3e/0x70 mm/kasan/report.c:475 kasan_report+0xb8/0xf0 mm/kasan/report.c:588 hlist_add_head include/linux/list.h:1023 [inline] bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323 blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660 blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143 __submit_bio+0xa0/0x6b0 block/blk-core.c:639 __submit_bio_noacct_mq block/blk-core.c:718 [inline] submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747 submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847 __ext4_read_bh fs/ext4/super.c:205 [inline] ext4_read_bh+0x15e/0x2e0 fs/ext4/super.c:230 __read_extent_tree_block+0x304/0x6f0 fs/ext4/extents.c:567 ext4_find_extent+0x479/0xd20 fs/ext4/extents.c:947 ext4_ext_map_blocks+0x1a3/0x2680 fs/ext4/extents.c:4182 ext4_map_blocks+0x929/0x15a0 fs/ext4/inode.c:660 ext4_iomap_begin_report+0x298/0x480 fs/ext4/inode.c:3569 iomap_iter+0x3dd/0x1010 fs/iomap/iter.c:91 iomap_fiemap+0x1f4/0x360 fs/iomap/fiemap.c:80 ext4_fiemap+0x181/0x210 fs/ext4/extents.c:5051 ioctl_fiemap.isra.0+0x1b4/0x290 fs/ioctl.c:220 do_vfs_ioctl+0x31c/0x11a0 fs/ioctl.c:811 __do_sys_ioctl fs/ioctl.c:869 [inline] __se_sys_ioctl+0xae/0x190 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 Allocated by task 232719: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:768 [inline] slab_alloc_node mm/slub.c:3492 [inline] kmem_cache_alloc_node+0x1b8/0x6f0 mm/slub.c:3537 bfq_get_queue+0x215/0x1f00 block/bfq-iosched.c:5869 bfq_get_bfqq_handle_split+0x167/0x5f0 block/bfq-iosched.c:6776 bfq_init_rq+0x13a4/0x17a0 block/bfq-iosched.c:6938 bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323 blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660 blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143 __submit_bio+0xa0/0x6b0 block/blk-core.c:639 __submit_bio_noacct_mq block/blk-core.c:718 [inline] submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747 submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847 __ext4_read_bh fs/ext4/super.c:205 [inline] ext4_read_bh_nowait+0x15a/0x240 fs/ext4/super.c:217 ext4_read_bh_lock+0xac/0xd0 fs/ext4/super.c:242 ext4_bread_batch+0x268/0x500 fs/ext4/inode.c:958 __ext4_find_entry+0x448/0x10f0 fs/ext4/namei.c:1671 ext4_lookup_entry fs/ext4/namei.c:1774 [inline] ext4_lookup.part.0+0x359/0x6f0 fs/ext4/namei.c:1842 ext4_lookup+0x72/0x90 fs/ext4/namei.c:1839 __lookup_slow+0x257/0x480 fs/namei.c:1696 lookup_slow fs/namei.c:1713 [inline] walk_component+0x454/0x5c0 fs/namei.c:2004 link_path_walk.part.0+0x773/0xda0 fs/namei.c:2331 link_path_walk fs/namei.c:3826 [inline] path_openat+0x1b9/0x520 fs/namei.c:3826 do_filp_open+0x1b7/0x400 fs/namei.c:3857 do_sys_openat2+0x5dc/0x6e0 fs/open.c:1428 do_sys_open fs/open.c:1443 [inline] __do_sys_openat fs/open.c:1459 [inline] __se_sys_openat fs/open.c:1454 [inline] __x64_sys_openat+0x148/0x200 fs/open.c:1454 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_6 ---truncated---
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:9 | kernel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug-devel-matched | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-debug-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-devel-matched | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-64k-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-abi-stablelists | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-cross-headers | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-devel-matched | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-debug-uki-virt | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-devel-matched | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-doc | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-headers | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-debug | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-debug-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-debug-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-debug-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-debug-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-debug-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-64k-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-debug | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-debug-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-debug-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-debug-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-debug-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-debug-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-rt-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-tools | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-tools-libs | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-tools-libs-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-uki-virt | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-uki-virt-addons | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump-devel | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump-devel-matched | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump-modules | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump-modules-core | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | kernel-zfcpdump-modules-extra | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | libperf | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | perf | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | python3-perf | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | rtla | 0 | 5.14.0-611.5.1.el9_7 |
| AlmaLinux:9 | rv | 0 | 5.14.0-611.5.1.el9_7 |
| Debian:11 | linux-6.1 | 0 | 6.1.128-1~deb11u1 |
| Debian:11 | linux-6.1 | 0 | 6.1.6.1.128-1~deb11u1 |
| Debian:12 | linux | 0 | No fix |
| Debian:12 | linux | 0 | 6.1.128-1 |
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.10-1 |
| Linux | Kernel | 0 | 5.15.177 |
| Mageia:9 | dwarves | 0 | 1.29-1.mga9 |
| Mageia:9 | kernel | 0 | 6.6.74-1.mga9 |
| Mageia:9 | kernel-linus | 0 | 6.6.74-1.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.0.24-64.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-70.mga9 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.47.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.47.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_10 | 0 | 1-150600.1.5.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_10 | 0 | 1-150600.13.5.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.47.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.47.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.47.2.150600.12.20.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.47.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.47.2 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.47.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.47.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.47.2 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.47.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.47.2 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.34.2 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.34.2 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.34.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.47.2 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.34.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.34.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.34.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.34.1 |
| Ubuntu:16.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gke-4.15 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gke-5.4 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gkeop-5.4 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-hwe | 0 | No fix |
| Ubuntu:18.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oem | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.3 | 0 | No fix |
| Ubuntu:20.04:LTS | linux | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.15 | 0 | 5.15.0-1080.87~20.04.1 |
| Ubuntu:20.04:LTS | linux-aws-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.15 | 0 | 5.15.0-1086.95~20.04.1 |
| Ubuntu:20.04:LTS | linux-azure-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-fde | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-fde-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-bluefield | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.15 | 0 | 5.15.0-1081.90~20.04.1 |
| Ubuntu:20.04:LTS | linux-gcp-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gke | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gke-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gkeop | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gkeop-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.15 | 0 | 5.15.0-136.147~20.04.1 |
| Ubuntu:20.04:LTS | linux-hwe-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-ibm | 0 | No fix |
| Ubuntu:20.04:LTS | linux-ibm-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-ibm-5.15 | 0 | 5.15.0-1074.77~20.04.1 |
| Ubuntu:20.04:LTS | linux-intel-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-intel-iotg-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-intel-iotg-5.15 | 0 | 5.15.0-1077.83~20.04.1 |
| Ubuntu:20.04:LTS | linux-iot | 0 | No fix |
| Ubuntu:20.04:LTS | linux-kvm | 0 | No fix |
| Ubuntu:20.04:LTS | linux-lowlatency-hwe-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-lowlatency-hwe-5.15 | 0 | 5.15.0-135.146~20.04.1 |
| Ubuntu:20.04:LTS | linux-oem-5.10 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.14 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.6 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.15 | 0 | 5.15.0-1077.83~20.04.1 |
| Ubuntu:20.04:LTS | linux-oracle-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-raspi | 0 | No fix |
| Ubuntu:20.04:LTS | linux-raspi2 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.15 | 0 | 5.15.0-1075.79~20.04.1 |
| Ubuntu:20.04:LTS | linux-riscv-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-xilinx-zynqmp | 0 | No fix |
| Ubuntu:22.04:LTS | linux | 0 | No fix |
| Ubuntu:22.04:LTS | linux | 0 | 5.15.0-135.146 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws | 0 | 5.15.0-1080.87 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.8 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.8 | 0 | 6.8.0-1029.31~22.04.1 |
| Ubuntu:22.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure | 0 | 5.15.0-1084.93 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | 0 | No fix |
Related vulnerabilities
- CVE-2025-68285 In the Linux kernel, the following vulnerability has been resolved: libceph: fix… Also affects kernel
- CVE-2025-68287 In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race… Also affects kernel
- CVE-2025-40277 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate… Also affects kernel
- CVE-2025-40240 In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL… Also affects kernel
- CVE-2025-40185 In the Linux kernel, the following vulnerability has been resolved: ice: ice_adapter… Also affects kernel
- CVE-2025-40176 In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending… Also affects kernel
- CVE-2025-40058 In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow… Also affects kernel
- CVE-2025-39682 In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of… Also affects kernel