Skip to content
OpenAdvisories
Medium ALSA-2025:15782 8 CVEs

Moderate: kernel security update

Published Sep 15, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: ublk: make sure ubq->canceling is set when queue is frozen (CVE-2025-22068)
* kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)
* kernel: idpf: convert control queue mutex to a spinlock (CVE-2025-38392)
* kernel: tcp: Correct signedness in skb remaining space calculation (CVE-2025-38463)
* kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498)
* kernel: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500)
* kernel: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CVE-2025-38550)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-55.33.1.el10_0
AlmaLinux · 10 kernel-doc 6.12.0-55.33.1.el10_0

Vulnerabilities 8

  • High 7.8
    CVE-2025-22068

    ublk: make sure ubq->canceling is set when queue is frozen

    In the Linux kernel, the following vulnerability has been resolved: ublk: make sure ubq->canceling is set when queue is frozen Now ublk driver depends on `ubq->canceling` for deciding if the request can be dispatched via uring_cmd & io_uring_cmd_complete_in_t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38463

    tcp: Correct signedness in skb remaining space calculation

    In the Linux kernel, the following vulnerability has been resolved: tcp: Correct signedness in skb remaining space calculation Syzkaller reported a bug [1] where sk->sk_forward_alloc can overflow. When we send data, if an skb exists at the tail of the write q…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38498

    do_change_type(): refuse to operate on unmounted/not ours mounts

    In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns pe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38500

    xfrm: interface: fix use-after-free after changing collect_md xfrm interface

    In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail whe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38550

    ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() return.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-39770

    net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM

    In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incor…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38332

    scsi: lpfc: Use memcpy() for BIOS version

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38392

    idpf: convert control queue mutex to a spinlock

    In the Linux kernel, the following vulnerability has been resolved: idpf: convert control queue mutex to a spinlock With VIRTCHNL2_CAP_MACFILTER enabled, the following warning is generated on module load: [ 324.701677] BUG: sleeping function called from inval…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-22068
  • report
    https://access.redhat.com/security/cve/CVE-2025-38332
  • report
    https://access.redhat.com/security/cve/CVE-2025-38392
  • report
    https://access.redhat.com/security/cve/CVE-2025-38463
  • report
    https://access.redhat.com/security/cve/CVE-2025-38498
  • report
    https://access.redhat.com/security/cve/CVE-2025-38500
  • report
    https://access.redhat.com/security/cve/CVE-2025-38550
  • report
    https://bugzilla.redhat.com/2360225
  • report
    https://bugzilla.redhat.com/2379246
  • report
    https://bugzilla.redhat.com/2383407
  • report
    https://bugzilla.redhat.com/2383493
  • report
    https://bugzilla.redhat.com/2384422
  • report
    https://bugzilla.redhat.com/2387866
  • report
    https://bugzilla.redhat.com/2388941
  • advisory
    https://errata.almalinux.org/10/ALSA-2025-15782.html
  • report
    https://www.redhat.com/security/data/cve/CVE-2025-39770.html