Skip to content
OpenAdvisories
Medium ALSA-2026:2212 16 CVEs

Moderate: kernel security update

Published Feb 9, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: net: openvswitch: fix nested key length validation in the set() action (CVE-2025-37789)
* kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819)
* kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CVE-2025-38022)
* kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code execution (CVE-2025-38024)
* kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation (CVE-2025-38415)
* kernel: vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403)
* kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion (CVE-2025-38459)
* kernel: Linux kernel: Data corruption and system instability due to improper io_uring/net buffer handling (CVE-2025-38730)
* kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing (CVE-2025-39760)
* kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)
* kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)
* kernel: Bluetooth: ISO: Fix possible UAF on iso_conn_free (CVE-2025-40141)
* kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)
* kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. (CVE-2025-40271)
* kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service (CVE-2025-40269)
* kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 74

ReleasePackageFixed in
AlmaLinux · 9 kernel 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-debug 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-devel 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-modules 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-cross-headers 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-debug 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-debug-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-debug-devel 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-debug-modules 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-devel 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-devel-matched 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-doc 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-headers 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-modules 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-modules-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-modules-extra 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-64k 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-64k-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-64k-debug 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-64k-debug-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-64k-debug-devel 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-64k-debug-modules 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-64k-debug-modules-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-64k-debug-modules-extra 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-64k-devel 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-64k-modules 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-64k-modules-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-64k-modules-extra 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-debug 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-devel 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-modules 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-tools 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-tools-libs 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-uki-virt 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-uki-virt-addons 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-zfcpdump 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-611.30.1.el9_7
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-611.30.1.el9_7
AlmaLinux · 9 libperf 5.14.0-611.30.1.el9_7
AlmaLinux · 9 perf 5.14.0-611.30.1.el9_7
AlmaLinux · 9 python3-perf 5.14.0-611.30.1.el9_7
AlmaLinux · 9 rtla 5.14.0-611.30.1.el9_7
AlmaLinux · 9 rv 5.14.0-611.30.1.el9_7

Vulnerabilities 16

  • High 8.8
    CVE-2025-40318

    Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2025-40135

    ipv6: use RCU in ip6_xmit()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2025-40158

    ipv6: use RCU in ip6_output()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.0
    CVE-2025-40141

    Bluetooth: ISO: Fix possible UAF on iso_conn_free

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-37789

    net: openvswitch: fix nested key length validation in the set() action

    In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38022

    RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

    In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38024

    RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_descri…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38730

    io_uring/net: commit partial buffers on retry

    In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and in…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40170

    net: use dst_dev_rcu() in sk_setup_caps()

    In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40269

    ALSA: usb-audio: Fix potential overflow of PCM transfer buffer

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamical…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40271 Public exploit

    fs/proc: fix uaf in proc_readdir_de()

    In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-37819

    irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()

    In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() With ACPI in place, gicv2m_get_fwnode() is registered with the pci subsystem as pci_msi_get_fwnode_cb(), which may get invoked a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38403

    vsock/vmci: Clear the vmci transport packet properly when initializing it

    In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialise…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38415

    Squashfs: check return result of sb_min_blocksize

    In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squas…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-38459

    atm: clip: Fix infinite recursive call of clip_push().

    In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39760

    usb: core: config: Prevent OOB read in SS endpoint companion parsing

    In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-37789
  • report
    https://access.redhat.com/security/cve/CVE-2025-37819
  • report
    https://access.redhat.com/security/cve/CVE-2025-38022
  • report
    https://access.redhat.com/security/cve/CVE-2025-38024
  • report
    https://access.redhat.com/security/cve/CVE-2025-38403
  • report
    https://access.redhat.com/security/cve/CVE-2025-38415
  • report
    https://access.redhat.com/security/cve/CVE-2025-38459
  • report
    https://access.redhat.com/security/cve/CVE-2025-38730
  • report
    https://access.redhat.com/security/cve/CVE-2025-39760
  • report
    https://access.redhat.com/security/cve/CVE-2025-40135
  • report
    https://access.redhat.com/security/cve/CVE-2025-40141
  • report
    https://access.redhat.com/security/cve/CVE-2025-40158
  • report
    https://access.redhat.com/security/cve/CVE-2025-40170
  • report
    https://access.redhat.com/security/cve/CVE-2025-40269
  • report
    https://access.redhat.com/security/cve/CVE-2025-40271
  • report
    https://access.redhat.com/security/cve/CVE-2025-40318
  • report
    https://bugzilla.redhat.com/2363315
  • report
    https://bugzilla.redhat.com/2365032
  • report
    https://bugzilla.redhat.com/2373326
  • report
    https://bugzilla.redhat.com/2373354
  • report
    https://bugzilla.redhat.com/2383404
  • report
    https://bugzilla.redhat.com/2383421
  • report
    https://bugzilla.redhat.com/2383487
  • report
    https://bugzilla.redhat.com/2393191
  • report
    https://bugzilla.redhat.com/2394601
  • report
    https://bugzilla.redhat.com/2414506
  • report
    https://bugzilla.redhat.com/2414521
  • report
    https://bugzilla.redhat.com/2414522
  • report
    https://bugzilla.redhat.com/2414523
  • report
    https://bugzilla.redhat.com/2419837
  • report
    https://bugzilla.redhat.com/2419919
  • report
    https://bugzilla.redhat.com/2419920
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-2212.html