Skip to content
OpenAdvisories
Medium ALSA-2025:13589 6 CVEs

Moderate: kernel security update

Published Aug 11, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)
* kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)
* kernel: can: peak_usb: fix use after free bugs (CVE-2021-47670)
* kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)
* kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 25

ReleasePackageFixed in
AlmaLinux · 8 bpftool 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-abi-stablelists 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-core 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-cross-headers 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-debug 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-debug-core 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-debug-devel 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-debug-modules 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-debug-modules-extra 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-devel 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-doc 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-headers 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-modules 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-modules-extra 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-tools 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-tools-libs 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-tools-libs-devel 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-zfcpdump 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-core 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-devel 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules 4.18.0-553.69.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules-extra 4.18.0-553.69.1.el8_10
AlmaLinux · 8 perf 4.18.0-553.69.1.el8_10
AlmaLinux · 8 python3-perf 4.18.0-553.69.1.el8_10

Vulnerabilities 6

  • High 8.8
    CVE-2021-47670

    can: peak_usb: fix use after free bugs

    In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_u…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-21727

    padata: fix UAF in padata_reorder

    In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u11…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-21759

    ipv6: mcast: extend RCU protection in igmp6_send()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6_send() igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a pot…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38085

    mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

    In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2024-56644

    net/ipv6: release expired exception dst cached in socket

    In the Linux kernel, the following vulnerability has been resolved: net/ipv6: release expired exception dst cached in socket Dst objects get leaked in ip6_negative_advice() when this function is executed for an expired IPv6 route located in the exception tabl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38159

    wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds

    In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', whi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2021-47670
  • report
    https://access.redhat.com/security/cve/CVE-2024-56644
  • report
    https://access.redhat.com/security/cve/CVE-2025-21727
  • report
    https://access.redhat.com/security/cve/CVE-2025-21759
  • report
    https://access.redhat.com/security/cve/CVE-2025-38085
  • report
    https://access.redhat.com/security/cve/CVE-2025-38159
  • report
    https://bugzilla.redhat.com/2334551
  • report
    https://bugzilla.redhat.com/2348516
  • report
    https://bugzilla.redhat.com/2348596
  • report
    https://bugzilla.redhat.com/2360786
  • report
    https://bugzilla.redhat.com/2375304
  • report
    https://bugzilla.redhat.com/2376064
  • advisory
    https://errata.almalinux.org/8/ALSA-2025-13589.html