Skip to content
OpenAdvisories
Medium ALSA-2025:15005 7 CVEs

Moderate: kernel security update

Published Sep 2, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: udp: Fix memory accounting leak. (CVE-2025-22058)
* kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823)
* kernel: ext4: only dirty folios when data journaling regular files (CVE-2025-38220)
* kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)
* kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464)
* kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461)
* kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-55.30.1.el10_0
AlmaLinux · 10 kernel-doc 6.12.0-55.30.1.el10_0

Vulnerabilities 7

  • Critical 9.8
    CVE-2025-38211

    RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

    In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-38472

    netfilter: nf_conntrack: fix crash due to removal of uninitialised entry

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: [exception RIP…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-37823

    net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too

    In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38464

    tipc: Fix use-after-free in tipc_conn_close().

    In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-ptr-deref in tipc_conn_close() during netns dismantle. [0] tipc_topsrv_stop() iterates tipc_net(net)->topsrv->conn_idr an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2025-38461

    vsock: Fix transport_* TOCTOU

    In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_* TOCTOU Transport assignment may race with module unload. Protect new_transport from becoming a stale pointer. This also takes care of an insecure call in vsock_use_loca…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-22058

    udp: Fix memory accounting leak.

    In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. Matt Dowling reported a weird UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. Howev…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38220

    ext4: only dirty folios when data journaling regular files

    In the Linux kernel, the following vulnerability has been resolved: ext4: only dirty folios when data journaling regular files fstest generic/388 occasionally reproduces a crash that looks as follows: BUG: kernel NULL pointer dereference, address: 00000000000…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-22058
  • report
    https://access.redhat.com/security/cve/CVE-2025-37823
  • report
    https://access.redhat.com/security/cve/CVE-2025-38211
  • report
    https://access.redhat.com/security/cve/CVE-2025-38220
  • report
    https://access.redhat.com/security/cve/CVE-2025-38461
  • report
    https://access.redhat.com/security/cve/CVE-2025-38464
  • report
    https://access.redhat.com/security/cve/CVE-2025-38472
  • report
    https://bugzilla.redhat.com/2360276
  • report
    https://bugzilla.redhat.com/2365024
  • report
    https://bugzilla.redhat.com/2376363
  • report
    https://bugzilla.redhat.com/2376406
  • report
    https://bugzilla.redhat.com/2383509
  • report
    https://bugzilla.redhat.com/2383513
  • report
    https://bugzilla.redhat.com/2383916
  • advisory
    https://errata.almalinux.org/10/ALSA-2025-15005.html