CVE-2025-68214
Linux kernel (Xilinx ZynqMP) vulnerabilities
Description
In the Linux kernel, the following vulnerability has been resolved: timers: Fix NULL function pointer race in timer_shutdown_sync() There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timers(). The issue occurs when timer_shutdown_sync() clears the timer function to NULL while the timer is still running on another CPU. The race scenario looks like this: CPU0 CPU1 <SOFTIRQ> lock_timer_base() expire_timers() base->running_timer = timer; unlock_timer_base() [call_timer_fn enter] mod_timer() ... timer_shutdown_sync() lock_timer_base() // For now, will not detach the timer but only clear its function to NULL if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() [call_timer_fn exit] lock_timer_base() base->running_timer = NULL; unlock_timer_base() ... // Now timer is pending while its function set to NULL. // next timer trigger <SOFTIRQ> expire_timers() WARN_ON_ONCE(!fn) // hit ... lock_timer_base() // Now timer will detach if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() The problem is that timer_shutdown_sync() clears the timer function regardless of whether the timer is currently running. This can leave a pending timer with a NULL function pointer, which triggers the WARN_ON_ONCE(!fn) check in expire_timers(). Fix this by only clearing the timer function when actually detaching the timer. If the timer is running, leave the function pointer intact, which is safe because the timer will be properly detached when it finishes running.
Metrics
Affected operating systems
linux
amazon / amazon_linux
linux
ubuntu / awsbionic
linux
ubuntu / awsjammy
linux
ubuntu / awsnoble
linux
ubuntu / awsresolute
linux
ubuntu / awsxenial
linux
ubuntu / aws-6.8jammy
linux
ubuntu / aws-hwexenial
linux
ubuntu / azurejammy
linux
ubuntu / azurenoble
linux
ubuntu / azureresolute
linux
ubuntu / azurexenial
linux
ubuntu / azure-4.15bionic
linux
suse / basesystem_module15
linux
debian / debian_linux11.0
linux
debian / debian_linux12.0
linux
debian / debian_linux13.0
linux
suse / development_tools_module15
linux
redhat / enterprise_linux10.0
linux
redhat / enterprise_linux8.0
linux
redhat / enterprise_linux9.0
linux
redhat / enterprise_linux_aus8.4
linux
redhat / enterprise_linux_aus8.6
linux
redhat / enterprise_linux_eus10.0
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
arista
cloudvision_agni2024.4.0 – 2025.2.2
arista
cloudvision_portal2024.2.0 – 2026.1.0
arista
velocloud_edge4.5.0 – 6.4.1
arista
velocloud_gateway
arista
velocloud_orchestrator
IBM
QRadar SIEM<7.5.0 UP15 IF06
redhat
openshift_container_platform4.12 – 4.12.89
redhat
openshift_container_platform4.13 – 4.13.66
redhat
openshift_container_platform4.14 – 4.14.65
redhat
openshift_container_platform4.15 – 4.15.64
redhat
openshift_container_platform4.16 – 4.16.61
redhat
openshift_container_platform4.17 – 4.17.53
redhat
openshift_container_platform4.18 – 4.18.40
redhat
openshift_container_platform4.19 – 4.19.30
redhat
openshift_container_platform4.20 – 4.20.21
redhat
openshift_container_platform4.21 – 4.21.14
redhat
openshift_container_platform
siemens
simatic_ax_runtime
suse
caas_platform
suse
enterprise_storage
suse
manager_proxy
suse
manager_retail_branch_server
suse
manager_server
suse
openstack_cloud
References & sources
- https://git.kernel.org/stable/c/414fc5e5a5aff776c150f1b86770e0a25a35df3aeuvd
- https://git.kernel.org/stable/c/02f3ecadb23558bbe068e6504118f1b712d4ece0euvd
- https://git.kernel.org/stable/c/0e43e0a3c94044acc74b8e0927c27972eb5a59e8euvd
- https://git.kernel.org/stable/c/aa9facde6c5005205874c37db3fd25799d741bafeuvd
- https://git.kernel.org/stable/c/5d70eb25b41e9b010828cd12818b06a0c3b04412euvd
- https://git.kernel.org/stable/c/2694d408b0e595024e0fc1d64ff9db0358580f74euvd
- https://git.kernel.org/stable/c/a9b8b18364fffce4c451e6f6fd218fa4ab646705euvd
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://git.kernel.org/stable/c/343fe375a8dd6ee51a193a1c233b999f5ea4d479
- https://git.kernel.org/stable/c/782acde47e127c98a113726e2ff8024bd65c0454
- https://git.kernel.org/stable/c/c3db89ea1ed3d540eebe8f3c36e806fb75ee4a1e
- https://git.kernel.org/stable/c/5b5228964619b180f366940505b77255b1a03929
- https://git.kernel.org/stable/c/857aefc70d4ae3b9bf1ae67434d27d0f79f80c9e
- https://git.kernel.org/stable/c/bea3e1d4467bcf292c8e54f080353d556d355e26
- https://git.kernel.org/stable/c/2ae0afd98432536562fa8261538ae795446f0589euvd
- https://git.kernel.org/stable/c/408e85ee708b6aa03eeb0220ffa0915f4d407181euvd
- https://git.kernel.org/stable/c/b7df9fbd4869fdfe09a3f501ffd228486521e062euvd
- https://git.kernel.org/stable/c/8517b6c8d2c759918ba0058cb6c7e14d59643202euvd
- https://git.kernel.org/stable/c/1c439de70b1c3eb3c6bffa8245c16b9fc318f114euvd
Linked CVEs
- CVE-2026-46333
In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of…
highCVSSv3 7.1 - CVE-2026-46300
A flaw was found in the Linux kernel's XFRM ESP-in-TCP subsystem.
highCVSSv3 7.8 - CVE-2026-46243
A privilege escalation vulnerability was found in the Linux kernel's CIFS client implementation.
highCVSSv3 7.8 - CVE-2026-46195
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers pars…
criticalCVSSv3 9.8 - CVE-2026-46135
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet…
criticalCVSSv3 9.8 - CVE-2026-46119
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix slab-out-of-bounds access in auth message processing I…
criticalCVSSv3 9.1 - CVE-2026-46043
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rx…
criticalCVSSv3 9.1 - CVE-2026-46028
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - snapshot IV for async AEAD requests AF_ALG AEA…
—CVSSv3 0.0 - CVE-2026-45988
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet g…
criticalCVSSv3 9.8 - CVE-2026-43503
A flaw was found in the Linux kernel's networking (skbuff) component.
highCVSSv3 8.8 - CVE-2026-43501
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv…
criticalCVSSv3 9.8 - CVE-2026-43500
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are prese…
highCVSSv3 7.8 - CVE-2026-43494
In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_…
highCVSSv3 7.8 - CVE-2026-43493
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG r…
criticalCVSSv3 9.8 - CVE-2026-43414
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcm…
criticalCVSSv3 9.8 - CVE-2026-43407
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_repl…
criticalCVSSv3 9.1 - CVE-2026-43406
In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in process_message_he…
criticalCVSSv3 9.1 - CVE-2026-43383
In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timi…
criticalCVSSv3 9.4 - CVE-2026-43341
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioa…
criticalCVSSv3 9.8 - CVE-2026-43304
In the Linux kernel, the following vulnerability has been resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the key,…
criticalCVSSv3 9.8 - CVE-2026-43284
A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems.
highCVSSv3 8.8 - CVE-2026-43186
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() O…
criticalCVSSv3 9.8 - CVE-2026-43117
In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: get correct superblock from dentry in event btrf…
criticalCVSSv3 9.1 - CVE-2026-43114
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on e…
criticalCVSSv3 9.4
Show 57 more CVEs
- CVE-2026-43078
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl…
highCVSSv3 7.8 - CVE-2026-43077
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Fix minimum RX size check for decryption The c…
—CVSSv3 0.0 - CVE-2026-43071
In the Linux kernel, the following vulnerability has been resolved: dcache: Limit the minimal number of bucket to two There is an OOB r…
criticalCVSSv3 9.1 - CVE-2026-43038
In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashik…
criticalCVSSv3 9.8 - CVE-2026-43037
A flaw was found in the Linux kernel's IPv6 tunnel implementation.
criticalCVSSv3 9.8 - CVE-2026-43033
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-pla…
highCVSSv3 7.8 - CVE-2026-43011
In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x…
criticalCVSSv3 9.8 - CVE-2026-31685
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `e…
criticalCVSSv3 9.4 - CVE-2026-31682
In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_s…
criticalCVSSv3 9.1 - CVE-2026-31669
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The eha…
criticalCVSSv3 9.8 - CVE-2026-31668
In the Linux kernel, the following vulnerability has been resolved: seg6: separate dst_cache for input and output paths in seg6 lwtunnel…
criticalCVSSv3 9.8 - CVE-2026-31659
In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_p…
criticalCVSSv3 9.8 - CVE-2026-31657
In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by reference batadv_bla_ad…
criticalCVSSv3 9.8 - CVE-2026-31649
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in chain mode The jumbo_frm() ch…
criticalCVSSv3 9.8 - CVE-2026-31637
In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ti…
criticalCVSSv3 9.8 - CVE-2026-31607
In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a…
criticalCVSSv3 9.8 - CVE-2026-31533
In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryptio…
criticalCVSSv3 9.8 - CVE-2026-31504
In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_…
highCVSSv3 7.8 - CVE-2026-31478
In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_o…
criticalCVSSv3 9.8 - CVE-2026-31431Actively exploited
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly r…
criticalCVSSv3 7.8 - CVE-2026-31419
In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit…
highCVSSv3 7.8 - CVE-2026-31418
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: drop logically empty buckets in mtype_del mtype_d…
mediumCVSSv3 5.5 - CVE-2026-31402
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 re…
criticalCVSSv3 9.8 - CVE-2026-23455
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()…
criticalCVSSv3 9.1 - CVE-2026-23450
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Sy…
criticalCVSSv3 9.8 - CVE-2026-23428
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of share_conf in compound request smb2_ge…
criticalCVSSv3 9.8 - CVE-2026-23351
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Y…
highCVSSv3 7.8 - CVE-2026-23278
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always walk all pending catchall elements Dur…
highCVSSv3 7.8 - CVE-2026-23274
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels ID…
highCVSSv3 7.8 - CVE-2026-23272
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally bump set->nelems before insert…
highCVSSv3 7.8 - CVE-2026-23262
In the Linux kernel, the following vulnerability has been resolved: gve: Fix stats report corruption on queue count change The driver a…
—CVSSv3 0.0 - CVE-2026-23258
In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Initialize netdev pointer before queue setup In setu…
—CVSSv3 0.0 - CVE-2026-23257
In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanu…
—CVSSv3 0.0 - CVE-2026-23256
In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanu…
—CVSSv3 0.0 - CVE-2026-23216
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_cou…
—CVSSv3 0.0 - CVE-2026-23206
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero…
—CVSSv3 0.0 - CVE-2026-23202
In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfe…
—CVSSv3 0.0 - CVE-2026-23198
In the Linux kernel, the following vulnerability has been resolved: KVM: Don't clobber irqfd routing type when deassigning irqfd When d…
highCVSSv3 7.8 - CVE-2026-23193
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_…
highCVSSv3 8.8 - CVE-2026-23190
In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: fix memory leak in acp3x pdm dma ops
—CVSSv3 0.0 - CVE-2026-23182
In the Linux kernel, the following vulnerability has been resolved: spi: tegra: Fix a memory leak in tegra_slink_probe() In tegra_slink…
—CVSSv3 0.0 - CVE-2026-23180
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: add bounds check for if_id in IRQ handler The IRQ han…
highCVSSv3 7.0 - CVE-2026-23176
In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_haps: Fix memory leaks in add/remove routines…
—CVSSv3 0.0 - CVE-2025-71224
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: ocb: skip rx_no_sta when interface is not joined ie…
—CVSSv3 0.0 - CVE-2025-71222
In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: ensure skb headroom before skb_push This avoids occas…
—CVSSv3 0.0 - CVE-2025-71220
In the Linux kernel, the following vulnerability has been resolved: smb/server: call ksmbd_session_rpc_close() on error path in create_s…
—CVSSv3 0.0 - CVE-2025-71089
In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale I…
highCVSSv3 7.8 - CVE-2025-68263
In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send…
criticalCVSSv3 9.8 - CVE-2025-40082
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() BUG: KASA…
highCVSSv3 7.1 - CVE-2025-38201
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX…
highCVSSv3 7.8 - CVE-2025-37924
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in kerberos authentication Setting sess->…
criticalCVSSv3 9.8 - CVE-2025-37822
In the Linux kernel, the following vulnerability has been resolved: riscv: uprobes: Add missing fence.i after building the XOL buffer T…
highCVSSv3 7.8 - CVE-2025-37778
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate fr…
criticalCVSSv3 9.8 - CVE-2024-50060
In the Linux kernel, the following vulnerability has been resolved: io_uring: check if we need to reschedule during overflow flush In t…
—CVSSv3 0.0 - CVE-2024-35862
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_network_name_deleted() Sk…
criticalCVSSv3 9.8 - CVE-2023-53673
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn…
highCVSSv3 8.8 - CVE-2022-48816
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: lock against ->sock changing during sysfs read ->sock can b…
highCVSSv3 7.8