Поиск уязвимостей
Количество 31
Количество 31
CVE-2025-39860
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the "Freed by task" part. Let's call l...
CVE-2025-39860
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the "Freed by task" part. Let's call l...
CVE-2025-39860
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk)
CVE-2025-39860
Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
CVE-2025-39860
In the Linux kernel, the following vulnerability has been resolved: B ...
GHSA-c684-q9wg-vhh9
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) ...
BDU:2025-13682
Уязвимость функции l2cap_sock_cleanup_listen() ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
ROS-20260806-80-0010
Уязвимость kernel-lt
ROS-20260806-73-0010
Уязвимость kernel-lt
ELSA-2025-25755
ELSA-2025-25755: Unbreakable Enterprise kernel security update (IMPORTANT)
ALT-PU-2025-16621
ALT-PU-2025-16621: package `kernel-image-rt` update to version 5.10.243-alt1.rt137
ALT-PU-2025-11619
ALT-PU-2025-11619: package `kernel-image-std-def` update to version 5.10.244-alt1
ELSA-2025-25757
ELSA-2025-25757: Unbreakable Enterprise kernel security update (IMPORTANT)
ELSA-2025-25754
ELSA-2025-25754: Unbreakable Enterprise kernel security update (IMPORTANT)
SUSE-SU-2025:03614-1
Security update for the Linux Kernel
ALT-PU-2025-12715
ALT-PU-2025-12715: package `kernel-image-rt` update to version 6.12.51-alt1
ALT-PU-2025-12713
ALT-PU-2025-12713: package `kernel-image-6.12` update to version 6.12.51-alt1
ALT-PU-2025-16600
ALT-PU-2025-16600: package `kernel-image-un-def` update to version 6.1.151-alt1
SUSE-SU-2025:03628-1
Security update for the Linux Kernel
SUSE-SU-2025:3751-1
Security update for the Linux Kernel
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2025-39860 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the "Freed by task" part. Let's call l... | CVSS3: 7.8 | 0% Низкий | около 1 года назад |
 | CVE-2025-39860 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the "Freed by task" part. Let's call l... | CVSS3: 4.7 | 0% Низкий | около 1 года назад |
 | CVE-2025-39860 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) | CVSS3: 7.8 | 0% Низкий | около 1 года назад |
 | CVE-2025-39860 Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() | CVSS3: 7.1 | 0% Низкий | около 1 года назад |
| CVE-2025-39860 In the Linux kernel, the following vulnerability has been resolved: B ... | CVSS3: 7.8 | 0% Низкий | около 1 года назад |
| GHSA-c684-q9wg-vhh9 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) ... | CVSS3: 7.8 | 0% Низкий | около 1 года назад |
 | BDU:2025-13682 Уязвимость функции l2cap_sock_cleanup_listen() ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 8 | 0% Низкий | больше 1 года назад |
 | ROS-20260806-80-0010 Уязвимость kernel-lt | CVSS3: 8 | 0% Низкий | 3 месяца назад |
| ROS-20260806-73-0010 Уязвимость kernel-lt | CVSS3: 8 | 0% Низкий | 3 месяца назад |
| ELSA-2025-25755 ELSA-2025-25755: Unbreakable Enterprise kernel security update (IMPORTANT) | 12 месяцев назад | ||
| ALT-PU-2025-16621 ALT-PU-2025-16621: package `kernel-image-rt` update to version 5.10.243-alt1.rt137 | CVSS3: 8 | около 1 года назад | |
| ALT-PU-2025-11619 ALT-PU-2025-11619: package `kernel-image-std-def` update to version 5.10.244-alt1 | CVSS3: 8 | около 1 года назад | |
| ELSA-2025-25757 ELSA-2025-25757: Unbreakable Enterprise kernel security update (IMPORTANT) | 12 месяцев назад | ||
| ELSA-2025-25754 ELSA-2025-25754: Unbreakable Enterprise kernel security update (IMPORTANT) | 12 месяцев назад | ||
 | SUSE-SU-2025:03614-1 Security update for the Linux Kernel | около 1 года назад | ||
| ALT-PU-2025-12715 ALT-PU-2025-12715: package `kernel-image-rt` update to version 6.12.51-alt1 | CVSS3: 8 | около 1 года назад | |
| ALT-PU-2025-12713 ALT-PU-2025-12713: package `kernel-image-6.12` update to version 6.12.51-alt1 | CVSS3: 8 | около 1 года назад | |
| ALT-PU-2025-16600 ALT-PU-2025-16600: package `kernel-image-un-def` update to version 6.1.151-alt1 | CVSS3: 9.8 | около 1 года назад | |
| SUSE-SU-2025:03628-1 Security update for the Linux Kernel | около 1 года назад | ||
| SUSE-SU-2025:3751-1 Security update for the Linux Kernel | около 1 года назад |
Уязвимостей на страницу