Skip to content
OpenAdvisories
Medium ALSA-2025:17776 3 CVEs

Moderate: kernel security update

Published Oct 13, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)
* kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling (CVE-2025-39761)
* kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-55.39.1.el10_0
AlmaLinux · 10 kernel-doc 6.12.0-55.39.1.el10_0

Vulnerabilities 3

  • High 8.8
    CVE-2025-39761

    wifi: ath12k: Decrement TID on RX peer frag setup error handling

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not decremented before peer cleanup, during error handling path of ath12k_dp_rx_peer_frag_setup(). This coul…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38556

    HID: core: Harden s32ton() against conversion to 0 bits

    In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39757

    ALSA: usb-audio: Validate UAC3 cluster segment descriptors

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-38556
  • report
    https://access.redhat.com/security/cve/CVE-2025-39757
  • report
    https://access.redhat.com/security/cve/CVE-2025-39761
  • report
    https://bugzilla.redhat.com/2389456
  • report
    https://bugzilla.redhat.com/2394606
  • report
    https://bugzilla.redhat.com/2394615
  • advisory
    https://errata.almalinux.org/10/ALSA-2025-17776.html