Summary
[5.15.0-312.187.5.3]
- HID: core: do not bypass hid_hw_raw_request (Benjamin Tissoires) [Orabug: 38454666] {CVE-2025-38494}
- vsock: Do not allow binding to VMADDR_PORT_ANY (Budimir Markovic) [Orabug: 38454665] {CVE-2025-38618}
- clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Al Viro) [Orabug: 38454664] {CVE-2025-38499}
- HID: core: ensure the allocated report buffer can contain the reserved report ID (Benjamin Tissoires) [Orabug: 38454662] {CVE-2025-38495}
- nvme-tcp: sanitize request list handling (Hannes Reinecke) [Orabug: 38454661] {CVE-2025-38264}
- llist: add interface to check if a node is on a list. (NeilBrown) [Orabug: 38454661]
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek-container | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek-container-debug | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek-core | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek-debug | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-core | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-devel | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-modules | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-modules-extra | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek-devel | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek-doc | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek-modules | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek-modules-extra | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek64k | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek64k-core | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek64k-devel | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek64k-modules | 0:5.15.0-312.187.5.3.el9uek |
| Oracle Linux · 8 | kernel-uek64k-modules-extra | 0:5.15.0-312.187.5.3.el9uek |
Vulnerabilities 5
-
Critical 9.8
nvme-tcp: sanitize request list handling
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: sanitize request list handling Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of any list, otherwise a malicious R2T PDU might inject a loop in request list p…
-
High 8.8
HID: core: ensure the allocated report buffer can contain the reserved report ID
In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the allocated report buffer can contain the reserved report ID When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, curren…
-
High 7.8
HID: core: do not bypass hid_hw_raw_request
In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hid_hw_raw_request hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver func…
-
High 7.8
clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to …
-
High 7.8
vsock: Do not allow binding to VMADDR_PORT_ANY
In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The so…