Moderate: kernel security update

Summary

Fixed packages 74

Vulnerabilities 7

• Critical 9.8
  CVE-2025-68811

  svcrdma: use rc_pageoff for memcpy byte offset

  In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_range added rc_curpage (page index) to the page base instead of the byte offset rc_pageoff. Use rc_pageoff so copies land w…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 13, 2026
• High 7.8
  CVE-2025-40064

  smc: Fix use-after-free in __pnet_find_base_ndev().

  In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in __pnet_find_base_ndev(). syzbot reported use-after-free of net_device in __pnet_find_base_ndev(), which was called during connect(). [0] smc_pnet_find_ism_resource(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 28, 2025
• High 7.8
  CVE-2025-40304

  fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

  In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• High 7.5
  CVE-2025-68349

  NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

  In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 24, 2025
• High 7.5
  CVE-2026-22998

  nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

  In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 25, 2026
• High 7.1
  CVE-2023-53034

  ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

  In the Linux kernel, the following vulnerability has been resolved: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• High 7.1
  CVE-2025-40322

  fbdev: bitblit: bound-check glyph index in bit_putcs*

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025

References

• report
  https://access.redhat.com/security/cve/CVE-2023-53034
• report
  https://access.redhat.com/security/cve/CVE-2025-40064
• report
  https://access.redhat.com/security/cve/CVE-2025-40304
• report
  https://access.redhat.com/security/cve/CVE-2025-40322
• report
  https://access.redhat.com/security/cve/CVE-2025-68349
• report
  https://access.redhat.com/security/cve/CVE-2025-68811
• report
  https://access.redhat.com/security/cve/CVE-2026-22998
• report
  https://bugzilla.redhat.com/2360239
• report
  https://bugzilla.redhat.com/2406747
• report
  https://bugzilla.redhat.com/2419870
• report
  https://bugzilla.redhat.com/2419902
• report
  https://bugzilla.redhat.com/2424880
• report
  https://bugzilla.redhat.com/2429116
• report
  https://bugzilla.redhat.com/2432671
• advisory
  https://errata.almalinux.org/9/ALSA-2026-2722.html