Skip to content
OpenAdvisories
High ALSA-2026:1690 19 CVEs

Important: kernel security update

Published Feb 2, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819)
* kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CVE-2025-38022)
* kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)
* kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453)
* kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)
* kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)
* kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154)
* kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)
* kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)
* kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)
* kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)
* kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)
* kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251)
* kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. (CVE-2025-40271)
* kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service (CVE-2025-40294)
* kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling (CVE-2025-40301)
* kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318)
* kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)
* kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 10 kernel-abi-stablelists 6.12.0-124.31.1.el10_1
AlmaLinux · 10 kernel-doc 6.12.0-124.31.1.el10_1

Vulnerabilities 19

  • Critical 9.8
    CVE-2025-40258

    mptcp: fix race condition in mptcp_schedule_work()

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-68301

    net: atlantic: fix fragment overflow handling in RX path

    In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-40318

    Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2025-40135

    ipv6: use RCU in ip6_xmit()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2025-40158

    ipv6: use RCU in ip6_output()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38022

    RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

    In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38349

    eventpoll: don't decrement ep refcount while still holding the ep mutex

    In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. Th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38453

    io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU

    In the Linux kernel, the following vulnerability has been resolved: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU syzbot reports that defer/local task_work adding via msg_ring can hit a request that has been freed: CPU: 1 UID: 0 PID: 19356 Co…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38568

    net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

    In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MA…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38731

    drm/xe: Fix vm_bind_ioctl double free bug

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. ===…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40170

    net: use dst_dev_rcu() in sk_setup_caps()

    In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40248

    vsock: Ignore signal/timeout on connect() if already established

    In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connec…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40251

    devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

    In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driv…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40271 Public exploit

    fs/proc: fix uaf in proc_readdir_de()

    In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.6
    CVE-2025-40301

    Bluetooth: hci_event: validate skb length for unknown CC opcode

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-37819

    irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()

    In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() With ACPI in place, gicv2m_get_fwnode() is registered with the pci subsystem as pci_msi_get_fwnode_cb(), which may get invoked a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40154

    ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping

    In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This m…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-40294

    Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(25…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-68305

    Bluetooth: hci_sock: Prevent race in socket write iter and sock bind

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-37819
  • report
    https://access.redhat.com/security/cve/CVE-2025-38022
  • report
    https://access.redhat.com/security/cve/CVE-2025-38349
  • report
    https://access.redhat.com/security/cve/CVE-2025-38453
  • report
    https://access.redhat.com/security/cve/CVE-2025-38568
  • report
    https://access.redhat.com/security/cve/CVE-2025-38731
  • report
    https://access.redhat.com/security/cve/CVE-2025-40135
  • report
    https://access.redhat.com/security/cve/CVE-2025-40154
  • report
    https://access.redhat.com/security/cve/CVE-2025-40158
  • report
    https://access.redhat.com/security/cve/CVE-2025-40170
  • report
    https://access.redhat.com/security/cve/CVE-2025-40248
  • report
    https://access.redhat.com/security/cve/CVE-2025-40251
  • report
    https://access.redhat.com/security/cve/CVE-2025-40258
  • report
    https://access.redhat.com/security/cve/CVE-2025-40271
  • report
    https://access.redhat.com/security/cve/CVE-2025-40294
  • report
    https://access.redhat.com/security/cve/CVE-2025-40301
  • report
    https://access.redhat.com/security/cve/CVE-2025-40318
  • report
    https://access.redhat.com/security/cve/CVE-2025-68301
  • report
    https://access.redhat.com/security/cve/CVE-2025-68305
  • report
    https://bugzilla.redhat.com/2365032
  • report
    https://bugzilla.redhat.com/2373326
  • report
    https://bugzilla.redhat.com/2381870
  • report
    https://bugzilla.redhat.com/2383516
  • report
    https://bugzilla.redhat.com/2389507
  • report
    https://bugzilla.redhat.com/2393488
  • report
    https://bugzilla.redhat.com/2414494
  • report
    https://bugzilla.redhat.com/2414506
  • report
    https://bugzilla.redhat.com/2414521
  • report
    https://bugzilla.redhat.com/2414523
  • report
    https://bugzilla.redhat.com/2418872
  • report
    https://bugzilla.redhat.com/2418876
  • report
    https://bugzilla.redhat.com/2418892
  • report
    https://bugzilla.redhat.com/2419837
  • report
    https://bugzilla.redhat.com/2419891
  • report
    https://bugzilla.redhat.com/2419896
  • report
    https://bugzilla.redhat.com/2419920
  • report
    https://bugzilla.redhat.com/2422836
  • report
    https://bugzilla.redhat.com/2422840
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-1690.html