Anolis OS update for kernel:6.6

1) Resource management error

EUVDB-ID: #VU96178

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43840

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the prepare_trampoline() function in arch/arm64/net/bpf_jit_comp.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Incorrect calculation

EUVDB-ID: #VU97561

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46751

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the btrfs_item_ptr() and spin_lock() functions in fs/btrfs/extent-tree.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) NULL pointer dereference

EUVDB-ID: #VU102398

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56758

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the relocate_one_folio() function in fs/btrfs/relocation.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Resource management error

EUVDB-ID: #VU108686

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-58098

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the check_func_call(), mark_subprog_changes_pkt_data(), visit_func_call_insn() and visit_insn() functions in kernel/bpf/verifier.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource management error

EUVDB-ID: #VU108687

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-58100

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the kvfree(), jit_subprogs(), bpf_check_attach_target() and bpf_check() functions in kernel/bpf/verifier.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource management error

EUVDB-ID: #VU108688

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-58237

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the subprog_tc() function in tools/testing/selftests/bpf/progs/tc_bpf2bpf.c, within the bpf_helper_changes_pkt_data() function in net/core/filter.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Resource management error

EUVDB-ID: #VU105157

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21816

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the HRTIMER_ACTIVE_SOFT(), DEFINE_PER_CPU(), hrtimer_base_is_online(), lock_hrtimer_base(), raw_spin_unlock(), WRITE_ONCE(), hrtimer_is_hres_enabled() and __hrtimer_start_range_ns() functions in kernel/time/hrtimer.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Infinite loop

EUVDB-ID: #VU105468

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21839

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the vcpu_enter_guest() function in arch/x86/kvm/x86.c, within the vmx_sync_dirty_debug_regs() and vmx_vcpu_run() functions in arch/x86/kvm/vmx/vmx.c, within the new_asid() and svm_vcpu_run() functions in arch/x86/kvm/svm/svm.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer overflow

EUVDB-ID: #VU106844

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21927

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the nvme_tcp_queue_id() and nvme_tcp_recv_pdu() functions in drivers/nvme/host/tcp.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper locking

EUVDB-ID: #VU106783

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21931

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the do_migrate_range() function in mm/memory_hotplug.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Resource management error

EUVDB-ID: #VU107785

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22028

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the vimc_streamer_pipeline_terminate() function in drivers/media/test-drivers/vimc/vimc-streamer.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) NULL pointer dereference

EUVDB-ID: #VU107727

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22062

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the proc_sctp_do_auth() and proc_sctp_do_udp_port() functions in net/sctp/sysctl.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Improper locking

EUVDB-ID: #VU107744

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22102

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nxp_download_firmware() function in drivers/bluetooth/btnxpuart.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Improper locking

EUVDB-ID: #VU107742

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22119

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the INIT_WORK() function in net/wireless/core.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Improper locking

EUVDB-ID: #VU107796

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22120

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ext4_setattr() function in fs/ext4/inode.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Use-after-free

EUVDB-ID: #VU108236

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37777

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the alloc_transport() function in fs/smb/server/transport_tcp.c, within the ksmbd_conn_free() function in fs/smb/server/connection.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Input validation error

EUVDB-ID: #VU108391

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37797

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the hfsc_change_class() function in net/sched/sch_hfsc.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Memory leak

EUVDB-ID: #VU108401

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37799

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the vmxnet3_process_xdp() function in drivers/net/vmxnet3/vmxnet3_xdp.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) NULL pointer dereference

EUVDB-ID: #VU108796

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37800

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dev_uevent_name() and dev_uevent() functions in drivers/base/core.c, within the bus_rescan_devices_helper() function in drivers/base/bus.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) NULL pointer dereference

EUVDB-ID: #VU108797

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37801

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the spi_imx_transfer_one() function in drivers/spi/spi-imx.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Buffer overflow

EUVDB-ID: #VU108822

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37803

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the udmabuf_create() function in drivers/dma-buf/udmabuf.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Improper locking

EUVDB-ID: #VU108809

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37805

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the virtsnd_pcm_parse_cfg() function in sound/virtio/virtio_pcm.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Resource management error

EUVDB-ID: #VU108820

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37808

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the DEFINE_MUTEX(), MODULE_ALIAS_CRYPTO() and EXPORT_SYMBOL_GPL() functions in crypto/crypto_null.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Out-of-bounds read

EUVDB-ID: #VU108791

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37810

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the dwc3_check_event_buf() function in drivers/usb/dwc3/gadget.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) NULL pointer dereference

EUVDB-ID: #VU108800

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37811

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cpu_latency_qos_remove_request() and ci_hdrc_imx_remove() functions in drivers/usb/chipidea/ci_hdrc_imx.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Improper locking

EUVDB-ID: #VU108810

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37812

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the cdns3_device_thread_irq_handler() function in drivers/usb/cdns3/cdns3-gadget.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Input validation error

EUVDB-ID: #VU108813

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37813

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the xhci_queue_ctrl_tx() function in drivers/usb/host/xhci-ring.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Improper locking

EUVDB-ID: #VU108811

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37815

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the pci1xxxx_gpio_irq_handler() function in drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Double free

EUVDB-ID: #VU108815

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37817

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the chameleon_parse_gdd() function in drivers/mcb/mcb-parse.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Input validation error

EUVDB-ID: #VU108814

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37818

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the huge_pte_offset() function in arch/loongarch/mm/hugetlbpage.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Double free

EUVDB-ID: #VU108816

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37819

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the gicv2m_of_init() function in drivers/irqchip/irq-gic-v2m.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Memory leak

EUVDB-ID: #VU108789

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37820

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the xennet_run_xdp() function in drivers/net/xen-netfront.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Input validation error

EUVDB-ID: #VU108825

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37823

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the hfsc_dequeue() function in net/sched/sch_hfsc.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) NULL pointer dereference

EUVDB-ID: #VU108803

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37824

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the tipc_mon_reinit_self() function in net/tipc/monitor.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) NULL pointer dereference

EUVDB-ID: #VU108804

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37828

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ufshcd_mcq_abort() function in drivers/ufs/core/ufs-mcq.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) NULL pointer dereference

EUVDB-ID: #VU108805

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37829

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the scpi_cpufreq_get_rate() function in drivers/cpufreq/scpi-cpufreq.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) NULL pointer dereference

EUVDB-ID: #VU108806

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37830

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the scmi_cpufreq_get_rate() function in drivers/cpufreq/scmi-cpufreq.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) NULL pointer dereference

EUVDB-ID: #VU108807

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37831

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the apple_soc_cpufreq_get_rate() function in drivers/cpufreq/apple-soc-cpufreq.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Memory leak

EUVDB-ID: #VU108851

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37836

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the pci_register_host_bridge() function in drivers/pci/probe.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Resource management error

EUVDB-ID: #VU108895

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37878

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the inherit_event() function in kernel/events/core.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Incorrect calculation

EUVDB-ID: #VU108897

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37879

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the p9_client_read_once(), p9_client_write(), EXPORT_SYMBOL_GPL() and p9_client_readdir() functions in net/9p/client.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Improper error handling

EUVDB-ID: #VU108880

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37881

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the ast_vhub_init_dev() function in drivers/usb/gadget/udc/aspeed-vhub/dev.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Memory leak

EUVDB-ID: #VU108857

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37883

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the __sclp_console_free_pages() and sclp_console_init() functions in drivers/s390/char/sclp_con.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Improper locking

EUVDB-ID: #VU108878

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37884

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __set_printk_clr_event() and bpf_get_trace_vprintk_proto() functions in kernel/trace/bpf_trace.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Use-after-free

EUVDB-ID: #VU108860

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37885

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vmx_pi_update_irte() function in arch/x86/kvm/vmx/posted_intr.c, within the avic_pi_update_irte() function in arch/x86/kvm/svm/avic.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Buffer overflow

EUVDB-ID: #VU108890

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37886

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the pdsc_q_map() function in drivers/net/ethernet/amd/pds_core/core.c, within the pdsc_process_notifyq(), pdsc_process_adminq(), pdsc_adminq_isr(), __pdsc_adminq_post() and pdsc_adminq_post() functions in drivers/net/ethernet/amd/pds_core/adminq.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Buffer overflow

EUVDB-ID: #VU108891

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37887

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the pdsc_dl_info_get() function in drivers/net/ethernet/amd/pds_core/devlink.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Use-after-free

EUVDB-ID: #VU109282

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37890

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the hfsc_enqueue() function in net/sched/sch_hfsc.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Buffer overflow

EUVDB-ID: #VU109432

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37891

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the include/sound/ump_convert.h. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Improper locking

EUVDB-ID: #VU109540

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37897

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the plfxlc_mac_init_hw() function in drivers/net/wireless/purelifi/plfxlc/mac.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Input validation error

EUVDB-ID: #VU109543

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37901

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the qcom_mpm_alloc() function in drivers/irqchip/irq-qcom-mpm.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Use-after-free

EUVDB-ID: #VU109501

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37903

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the hdcp_update_display(), hdcp_remove_display(), hdcp_reset_display() and update_config() functions in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Memory leak

EUVDB-ID: #VU109492

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37905

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the scmi_child_dev_find() function in drivers/firmware/arm_scmi/bus.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Memory leak

EUVDB-ID: #VU109493

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37909

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the lan743x_tx_frame_add_lso(), lan743x_tx_frame_add_fragment() and lan743x_tx_frame_end() functions in drivers/net/ethernet/microchip/lan743x_main.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Out-of-bounds read

EUVDB-ID: #VU109514

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37911

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the bnxt_hwrm_dbg_dma_data() function in drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) NULL pointer dereference

EUVDB-ID: #VU109521

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37912

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ice_vc_add_fdir_fltr() function in drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Use-after-free

EUVDB-ID: #VU109502

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37913

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cl_is_active() and qfq_enqueue() functions in net/sched/sch_qfq.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Use-after-free

EUVDB-ID: #VU109503

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37914

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cl_is_active() and ets_qdisc_enqueue() functions in net/sched/sch_ets.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Use-after-free

EUVDB-ID: #VU109504

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37915

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cl_is_active() and drr_enqueue() functions in net/sched/sch_drr.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Use-after-free

EUVDB-ID: #VU109505

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37916

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the pdsc_auxbus_dev_del() function in drivers/net/ethernet/amd/pds_core/auxbus.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Improper locking

EUVDB-ID: #VU109538

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37917

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the mtk_star_tx_poll() and mtk_star_rx_poll() functions in drivers/net/ethernet/mediatek/mtk_star_emac.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) NULL pointer dereference

EUVDB-ID: #VU109522

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37918

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the btusb_coredump_qca(), handle_dump_pkt_qca() and acl_pkt_is_dump_qca() functions in drivers/bluetooth/btusb.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Improper locking

EUVDB-ID: #VU109536

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37921

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the vxlan_vni_delete_group() function in drivers/net/vxlan/vxlan_vnifilter.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Use-after-free

EUVDB-ID: #VU109506

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37922

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the radix__vmemmap_populate() function in arch/powerpc/mm/book3s64/radix_pgtable.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Buffer overflow

EUVDB-ID: #VU109575

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37923

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the tracing_splice_read_pipe() function in kernel/trace/trace.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Use-after-free

EUVDB-ID: #VU109507

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37924

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the krb5_authenticate() function in fs/smb/server/smb2pdu.c, within the ksmbd_krb5_authenticate() function in fs/smb/server/auth.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Improper locking

EUVDB-ID: #VU107734

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37925

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the duplicateIXtree() function in fs/jfs/jfs_imap.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Buffer overflow

EUVDB-ID: #VU109555

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37927

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the drivers/iommu/amd/init.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Improper error handling

EUVDB-ID: #VU109549

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37928

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the __scan() function in drivers/md/dm-bufio.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Improper error handling

EUVDB-ID: #VU109550

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37929

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the spectre_bhb_loop_affected() function in arch/arm64/kernel/proton-pack.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Resource management error

EUVDB-ID: #VU109571

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37930

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the nouveau_fence_context_kill() function in drivers/gpu/drm/nouveau/nouveau_fence.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Resource management error

EUVDB-ID: #VU109572

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37932

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the htb_qlen_notify() function in net/sched/sch_htb.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Input validation error

EUVDB-ID: #VU109584

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37933

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the octep_hb_timeout_task() function in drivers/net/ethernet/marvell/octeon_ep/octep_main.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Input validation error

EUVDB-ID: #VU109577

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37935

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the drivers/net/ethernet/mediatek/mtk_eth_soc.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Resource management error

EUVDB-ID: #VU109561

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37936

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the intel_guest_get_msrs() function in arch/x86/events/intel/core.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Use-after-free

EUVDB-ID: #VU109509

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37938

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the test_event_printk() function in kernel/trace/trace_events.c. A local user can escalate privileges on the system.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Out-of-bounds read

EUVDB-ID: #VU109515

Risk: Low

CVSSv4.0: 5.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2025-37947

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: Yes

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ksmbd_vfs_stream_write() function in fs/smb/server/vfs.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5

kernel-64k-debug: before 6.6.102-5

kernel-64k: before 6.6.102-5

python3-perf: before 6.6.102-5

perf: before 6.6.102-5

kernel-tools-libs-devel: before 6.6.102-5

kernel-tools-libs: before 6.6.102-5

kernel-tools: before 6.6.102-5

kernel-headers: before 6.6.102-5

kernel-devel: before 6.6.102-5

kernel-debug-devel: before 6.6.102-5

kernel-debug: before 6.6.102-5

kernel: before 6.6.102-5

bpftool: before 6.6.102-5

• cpe:2.3:o:openanolis:anolis_os:23:*:*:*:*:*:*:*
• cpe:2.3:a:openanolis:kernel-64k-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-64k:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:python3-perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:perf:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools-libs:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-tools:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-headers:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug-devel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel-debug:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:kernel:*:*:*:*:*:anolis_os:*:*
• cpe:2.3:a:openanolis:bpftool:*:*:*:*:*:anolis_os:*:*

https://anas.openanolis.cn/errata/detail/ANSA-2025:0719

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

78) Input validation error

EUVDB-ID: #VU109581

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37948

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the pr_fmt(), build_plt(), build_epilogue() and bpf_int_jit_compile() functions in arch/arm64/net/bpf_jit_comp.c, within the this_cpu_set_vectors() function in arch/arm64/kernel/proton-pack.c. A local user can perform a denial of service (DoS) attack.

Install updates from vendor's repository.

Anolis OS: 23

kernel-64k-devel: before 6.6.102-5

kernel-64k-debug-devel: before 6.6.102-5