Skip to content
OpenAdvisories
Medium ALSA-2025:19102 7 CVEs

Moderate: kernel security update

Published Oct 27, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CVE-2023-53297)
* kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)
* kernel: Bluetooth: Fix potential use-after-free when clear keys (CVE-2023-53386)
* kernel: Bluetooth: L2CAP: Fix user-after-free (CVE-2022-50386)
* kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849)
* kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 25

ReleasePackageFixed in
AlmaLinux · 8 bpftool 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-abi-stablelists 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-core 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-cross-headers 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-debug 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-debug-core 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-debug-devel 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-debug-modules 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-debug-modules-extra 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-devel 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-doc 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-headers 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-modules 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-modules-extra 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-tools 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-tools-libs 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-tools-libs-devel 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-zfcpdump 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-core 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-devel 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules 4.18.0-553.81.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules-extra 4.18.0-553.81.1.el8_10
AlmaLinux · 8 perf 4.18.0-553.81.1.el8_10
AlmaLinux · 8 python3-perf 4.18.0-553.81.1.el8_10

Vulnerabilities 7

  • Critical 9.8
    CVE-2025-39841

    scsi: lpfc: Fix buffer free/clear order in deferred receive path

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buff…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2022-50386

    Bluetooth: L2CAP: Fix user-after-free

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2023-53297

    Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balan…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2025-39849

    wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checkin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-53386

    Bluetooth: Fix potential use-after-free when clear keys

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix potential use-after-free when clear keys Similar to commit c5d2b6fa26b5 ("Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk"). We can not access k after kfree_rcu(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-22045

    x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs

    In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) tog…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-39817

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

    In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-50386
  • report
    https://access.redhat.com/security/cve/CVE-2023-53297
  • report
    https://access.redhat.com/security/cve/CVE-2023-53386
  • report
    https://access.redhat.com/security/cve/CVE-2025-39817
  • report
    https://access.redhat.com/security/cve/CVE-2025-39841
  • report
    https://access.redhat.com/security/cve/CVE-2025-39849
  • report
    https://bugzilla.redhat.com/2395681
  • report
    https://bugzilla.redhat.com/2395805
  • report
    https://bugzilla.redhat.com/2396419
  • report
    https://bugzilla.redhat.com/2396431
  • report
    https://bugzilla.redhat.com/2396928
  • report
    https://bugzilla.redhat.com/2396944
  • advisory
    https://errata.almalinux.org/8/ALSA-2025-19102.html
  • report
    https://www.redhat.com/security/data/cve/CVE-2025-22045.html