Skip to content
OpenAdvisories
High ALSA-2025:13962 9 CVEs

Important: kernel security update

Published Aug 18, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CVE-2025-21867)
* microcode_ctl: From CVEorg collector (CVE-2024-28956)
* kernel: mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084)
* kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)
* kernel: net: fix udp gso skb_segment after pull from frag_list (CVE-2025-38124)
* kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159)
* kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250)
* kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380)
* kernel: tls: always refresh the queue when reading sock (CVE-2025-38471)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 76

ReleasePackageFixed in
AlmaLinux · 9 kernel 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-debug 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-devel 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-modules 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-cross-headers 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-debug 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-debug-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-debug-devel 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-debug-modules 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-devel 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-devel-matched 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-doc 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-headers 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-modules 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-modules-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-modules-extra 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-64k 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-64k-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-64k-debug 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-64k-debug-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-64k-debug-devel 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-64k-debug-modules 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-64k-debug-modules-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-64k-debug-modules-extra 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-64k-devel 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-64k-modules 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-64k-modules-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-64k-modules-extra 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-debug 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-debug-kvm 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-devel 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-kvm 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-modules 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-tools 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-tools-libs 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-uki-virt 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-uki-virt-addons 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-zfcpdump 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-570.35.1.el9_6
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-570.35.1.el9_6
AlmaLinux · 9 libperf 5.14.0-570.35.1.el9_6
AlmaLinux · 9 perf 5.14.0-570.35.1.el9_6
AlmaLinux · 9 python3-perf 5.14.0-570.35.1.el9_6
AlmaLinux · 9 rtla 5.14.0-570.35.1.el9_6
AlmaLinux · 9 rv 5.14.0-570.35.1.el9_6

Vulnerabilities 9

  • Critical 9.8
    CVE-2025-38471

    tls: always refresh the queue when reading sock

    In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old sk…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-21867

    bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()

    In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38084

    mm/hugetlb: unshare page tables during VMA split, not before

    In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables during VMA split, not before Currently, __split_vma() triggers hugetlb page table unsharing through vm_ops->may_split(). This happens before the VMA lock and r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38085

    mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

    In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38250

    Bluetooth: hci_core: Fix use-after-free in vhci_flush()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file descriptor while its de…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-38124

    net: fix udp gso skb_segment after pull from frag_list

    In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skb…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.6
    CVE-2024-28956

    Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) …

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Alpine
  • Unscored —
    CVE-2025-38159

    wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds

    In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', whi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38380 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-28956
  • report
    https://access.redhat.com/security/cve/CVE-2025-21867
  • report
    https://access.redhat.com/security/cve/CVE-2025-38084
  • report
    https://access.redhat.com/security/cve/CVE-2025-38085
  • report
    https://access.redhat.com/security/cve/CVE-2025-38124
  • report
    https://access.redhat.com/security/cve/CVE-2025-38159
  • report
    https://access.redhat.com/security/cve/CVE-2025-38250
  • report
    https://access.redhat.com/security/cve/CVE-2025-38380
  • report
    https://access.redhat.com/security/cve/CVE-2025-38471
  • report
    https://bugzilla.redhat.com/2355334
  • report
    https://bugzilla.redhat.com/2366125
  • report
    https://bugzilla.redhat.com/2375303
  • report
    https://bugzilla.redhat.com/2375304
  • report
    https://bugzilla.redhat.com/2376041
  • report
    https://bugzilla.redhat.com/2376064
  • report
    https://bugzilla.redhat.com/2378982
  • report
    https://bugzilla.redhat.com/2383381
  • report
    https://bugzilla.redhat.com/2383893
  • advisory
    https://errata.almalinux.org/9/ALSA-2025-13962.html