Skip to content
OpenAdvisories
High ALSA-2025:14009 5 CVEs

Important: kernel security update

Published Aug 18, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CVE-2025-21867)
* kernel: net: fix udp gso skb_segment after pull from frag_list (CVE-2025-38124)
* kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250)
* kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380)
* kernel: tls: always refresh the queue when reading sock (CVE-2025-38471)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-55.28.1.el10_0
AlmaLinux · 10 kernel-doc 6.12.0-55.28.1.el10_0

Vulnerabilities 5

  • Critical 9.8
    CVE-2025-38471

    tls: always refresh the queue when reading sock

    In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old sk…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-21867

    bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()

    In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38250

    Bluetooth: hci_core: Fix use-after-free in vhci_flush()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file descriptor while its de…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-38124

    net: fix udp gso skb_segment after pull from frag_list

    In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skb…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38380 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-21867
  • report
    https://access.redhat.com/security/cve/CVE-2025-38124
  • report
    https://access.redhat.com/security/cve/CVE-2025-38250
  • report
    https://access.redhat.com/security/cve/CVE-2025-38380
  • report
    https://access.redhat.com/security/cve/CVE-2025-38471
  • report
    https://bugzilla.redhat.com/2355334
  • report
    https://bugzilla.redhat.com/2376041
  • report
    https://bugzilla.redhat.com/2378982
  • report
    https://bugzilla.redhat.com/2383381
  • report
    https://bugzilla.redhat.com/2383893
  • advisory
    https://errata.almalinux.org/10/ALSA-2025-14009.html