openEuler 24.03 LTS update for kernel



Risk Low
Patch available YES
Number of vulnerabilities 19
CVE-ID CVE-2023-52926
CVE-2024-54456
CVE-2024-57899
CVE-2024-57981
CVE-2024-58001
CVE-2024-58070
CVE-2025-21729
CVE-2025-21732
CVE-2025-21736
CVE-2025-21743
CVE-2025-21767
CVE-2025-21776
CVE-2025-21782
CVE-2025-21783
CVE-2025-21789
CVE-2025-21795
CVE-2025-21796
CVE-2025-21814
CVE-2025-21817
CWE-ID CWE-416
CWE-119
CWE-190
CWE-476
CWE-399
CWE-667
CWE-125
CWE-20
Exploitation vector Local
Public exploit N/A
Vulnerable software
 openEuler
Operating systems & Components / Operating system

python3-perf-debuginfo
Operating systems & Components / Operating system package or component

python3-perf
Operating systems & Components / Operating system package or component

perf-debuginfo
Operating systems & Components / Operating system package or component

perf
Operating systems & Components / Operating system package or component

kernel-tools-devel
Operating systems & Components / Operating system package or component

kernel-tools-debuginfo
Operating systems & Components / Operating system package or component

kernel-tools
Operating systems & Components / Operating system package or component

kernel-source
Operating systems & Components / Operating system package or component

kernel-headers
Operating systems & Components / Operating system package or component

kernel-devel
Operating systems & Components / Operating system package or component

kernel-debugsource
Operating systems & Components / Operating system package or component

kernel-debuginfo
Operating systems & Components / Operating system package or component

bpftool-debuginfo
Operating systems & Components / Operating system package or component

bpftool
Operating systems & Components / Operating system package or component

kernel
Operating systems & Components / Operating system package or component

Vendor openEuler

Security Bulletin

This security bulletin contains information about 19 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU104163

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:U/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52926

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the io_rw_init_file() function in io_uring/rw.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU105054

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-54456

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the nfs_sysfs_link_rpc_client() function in fs/nfs/sysfs.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU102964

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-57899

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the ieee80211_mbss_info_change_notify() function in net/mac80211/mesh.c. A local user can execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) NULL pointer dereference

EUVDB-ID: #VU105016

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-57981

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the xhci_handle_stopped_cmd_ring() function in drivers/usb/host/xhci-ring.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource management error

EUVDB-ID: #VU105070

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-58001

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ocfs2_fast_symlink_read_folio() function in fs/ocfs2/symlink.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper locking

EUVDB-ID: #VU105413

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-58070

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the bpf_local_storage_map_alloc() function in kernel/bpf/bpf_local_storage.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU104967

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21729

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rtw89_ops_cancel_hw_scan() function in drivers/net/wireless/realtek/rtw89/mac80211.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU104955

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21732

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mlx5_ib_invalidate_range() function in drivers/infiniband/hw/mlx5/odp.c, within the mlx5_revoke_mr() function in drivers/infiniband/hw/mlx5/mr.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Integer overflow

EUVDB-ID: #VU105049

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21736

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the nilfs_fiemap() function in fs/nilfs2/inode.c. A local user can execute arbitrary code.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Out-of-bounds read

EUVDB-ID: #VU104979

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21743

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ipheth_rcvbulk_callback_ncm() function in drivers/net/usb/ipheth.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improper locking

EUVDB-ID: #VU105021

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21767

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the clocksource_verify_percpu() function in kernel/time/clocksource.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) NULL pointer dereference

EUVDB-ID: #VU104995

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21776

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hub_probe() function in drivers/usb/core/hub.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Out-of-bounds read

EUVDB-ID: #VU104981

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21782

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the orangefs_debug_write() function in fs/orangefs/orangefs-debugfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) NULL pointer dereference

EUVDB-ID: #VU104992

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21783

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the gpiochip_get_ngpios() function in drivers/gpio/gpiolib.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Out-of-bounds read

EUVDB-ID: #VU104983

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21789

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the do_csum() function in arch/loongarch/lib/csum.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Input validation error

EUVDB-ID: #VU105087

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21795

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the nfsd4_run_cb_work() function in fs/nfsd/nfs4callback.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Use-after-free

EUVDB-ID: #VU104953

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21796

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the posix_acl_release() function in fs/nfsd/nfs3acl.c, within the posix_acl_release() function in fs/nfsd/nfs2acl.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) NULL pointer dereference

EUVDB-ID: #VU105141

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21814

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ptp_getcycles64() and ptp_clock_register() functions in drivers/ptp/ptp_clock.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Use-after-free

EUVDB-ID: #VU105135

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21817

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the queue_attr_store() function in block/blk-sysfs.c. A local user can escalate privileges on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 24.03 LTS

python3-perf-debuginfo: before 6.6.0-82.0.0.75

python3-perf: before 6.6.0-82.0.0.75

perf-debuginfo: before 6.6.0-82.0.0.75

perf: before 6.6.0-82.0.0.75

kernel-tools-devel: before 6.6.0-82.0.0.75

kernel-tools-debuginfo: before 6.6.0-82.0.0.75

kernel-tools: before 6.6.0-82.0.0.75

kernel-source: before 6.6.0-82.0.0.75

kernel-headers: before 6.6.0-82.0.0.75

kernel-devel: before 6.6.0-82.0.0.75

kernel-debugsource: before 6.6.0-82.0.0.75

kernel-debuginfo: before 6.6.0-82.0.0.75

bpftool-debuginfo: before 6.6.0-82.0.0.75

bpftool: before 6.6.0-82.0.0.75

kernel: before 6.6.0-82.0.0.75

CPE2.3 External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1285


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###