Important: kernel security update

Summary

Fixed packages 74

Vulnerabilities 8

• Critical 9.8
  CVE-2025-40258

  mptcp: fix race condition in mptcp_schedule_work()

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 4, 2025
• Critical 9.8
  CVE-2025-68301

  net: atlantic: fix fragment overflow handling in RX path

  In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 16, 2025
• High 7.8
  CVE-2025-38141

  dm: fix dm_blk_report_zones

  In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was never called. Also, it is possible that md->zone_revalidate_map will change while calling this functi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 3, 2025
• High 7.8
  CVE-2025-38349

  eventpoll: don't decrement ep refcount while still holding the ep mutex

  In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. Th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 18, 2025
• High 7.8
  CVE-2025-38731

  drm/xe: Fix vm_bind_ioctl double free bug

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. ===…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 5, 2025
• High 7.8
  CVE-2025-40248

  vsock: Ignore signal/timeout on connect() if already established

  In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connec…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 4, 2025
• Unscored —
  CVE-2025-40294

  Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(25…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• Unscored —
  CVE-2025-68305

  Bluetooth: hci_sock: Prevent race in socket write iter and sock bind

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 16, 2025

References

• report
  https://access.redhat.com/security/cve/CVE-2025-38141
• report
  https://access.redhat.com/security/cve/CVE-2025-38349
• report
  https://access.redhat.com/security/cve/CVE-2025-38731
• report
  https://access.redhat.com/security/cve/CVE-2025-40248
• report
  https://access.redhat.com/security/cve/CVE-2025-40258
• report
  https://access.redhat.com/security/cve/CVE-2025-40294
• report
  https://access.redhat.com/security/cve/CVE-2025-68301
• report
  https://access.redhat.com/security/cve/CVE-2025-68305
• report
  https://bugzilla.redhat.com/2376052
• report
  https://bugzilla.redhat.com/2381870
• report
  https://bugzilla.redhat.com/2393488
• report
  https://bugzilla.redhat.com/2418872
• report
  https://bugzilla.redhat.com/2418876
• report
  https://bugzilla.redhat.com/2419891
• report
  https://bugzilla.redhat.com/2422836
• report
  https://bugzilla.redhat.com/2422840
• advisory
  https://errata.almalinux.org/9/ALSA-2026-1143.html