Skip to content
OpenAdvisories
High ALSA-2025:11428 6 CVEs

Important: kernel security update

Published Jul 21, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: media: uvcvideo: Remove dangling pointers (CVE-2024-58002)
* kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980)
* kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905)
* kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958)
* kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (CVE-2025-38089)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-55.22.1.el10_0
AlmaLinux · 10 kernel-doc 6.12.0-55.22.1.el10_0

Vulnerabilities 6

  • Critical 9.8
    CVE-2025-38089 Public exploit

    sunrpc: handle SVC_GARBAGE during svc auth processing as auth error

    In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-58002

    media: uvcvideo: Remove dangling pointers

    In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done.…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38425

    i2c: tegra: check msg length in SMBUS block read

    In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: check msg length in SMBUS block read For SMBUS block read, do not continue to read if the message length passed from the device is '0' or greater than the maximum allowed bytes.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-21905

    wifi: iwlwifi: limit printed string from FW file

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-57980

    media: uvcvideo: Fix double free in error path

    In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. Thi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-37958

    mm/huge_memory: fix dereferencing invalid pmd migration entry

    In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address ac…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-57980
  • report
    https://access.redhat.com/security/cve/CVE-2024-58002
  • report
    https://access.redhat.com/security/cve/CVE-2025-21905
  • report
    https://access.redhat.com/security/cve/CVE-2025-37958
  • report
    https://access.redhat.com/security/cve/CVE-2025-38089
  • report
    https://bugzilla.redhat.com/2348513
  • report
    https://bugzilla.redhat.com/2348599
  • report
    https://bugzilla.redhat.com/2356613
  • report
    https://bugzilla.redhat.com/2367572
  • report
    https://bugzilla.redhat.com/2375529
  • advisory
    https://errata.almalinux.org/10/ALSA-2025-11428.html
  • report
    https://www.redhat.com/security/data/cve/CVE-2025-38425.html