The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed
There is a null-ptr-deref when xps sysfs alloc failed: BUG: KASAN: null-ptr-deref in sysfs_do_create_link_sd+0x40/0xd0 Read of size 8 at addr 0000000000000030 by task gssproxy/457
CPU: 5 PID: 457 Comm: gssproxy Not tainted 6.0.0-09040-g02357b27ee03 #9 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 kasan_report+0xa3/0x120 sysfs_do_create_link_sd+0x40/0xd0 rpc_sysfs_client_setup+0x161/0x1b0 rpc_new_client+0x3fc/0x6e0 rpc_create_xprt+0x71/0x220 rpc_create+0x1d4/0x350 gssp_rpc_create+0xc3/0x160 set_gssp_clnt+0xbc/0x140 write_gssp+0x116/0x1a0 proc_reg_write+0xd6/0x130 vfs_write+0x177/0x690 ksys_write+0xb9/0x150 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
When the xprt_switch sysfs alloc failed, should not add xprt and switch sysfs to it, otherwise, maybe null-ptr-deref; also initialize the 'xps_sysfs' to NULL to avoid oops when destroy it.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade perfUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-livepatch-5.15.79-51.138Upgrade kernel-tools-develUpgrade bpftool | Jun 23, 2025 | May 1, 2025 |
| Debian | — | Upgrade linux | May 5, 2025 | May 1, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 1, 2025 |
| Ubuntu | — | Upgrade linux-riscv-5.15Upgrade linux-azure-fdeUpgrade linux-azureUpgrade linux-nvidiaUpgrade linux-lowlatency-hwe-5.15Upgrade linuxUpgrade linux-realtimeUpgrade linux-lowlatencyUpgrade linux-aws-5.15Upgrade linux-hwe-5.15Upgrade linux-intel-iotgUpgrade linux-oracle-5.15Upgrade linux-raspiUpgrade linux-gkeUpgrade linux-intel-iotg-5.15Upgrade linux-gcpUpgrade linux-oracleUpgrade linux-bluefieldUpgrade linux-gcp-5.15Upgrade linux-awsUpgrade linux-azure-5.15Upgrade linux-ibmUpgrade linux-kvmUpgrade linux-gkeop | May 8, 2025 | May 1, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub