Summary
[6.12.0-104.43.4.3]
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (Jens Axboe) [Orabug: 38572958] {CVE-2025-39698}
- fs: writeback: fix use-after-free in __mark_inode_dirty() (Jiufei Xue) [Orabug: 38572953] {CVE-2025-39866}
- kernfs: Fix UAF in polling when open file is released (Chen Ridong) [Orabug: 38572951] {CVE-2025-3988}
- vsock/virtio: Validate length in packet header before skb_put() (Will Deacon) [Orabug: 38572950] {CVE-2025-39718}
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38572948] {CVE-2025-39964}
- io_uring: fix incorrect io_kiocb reference in io_link_skb (Yang Xiuwei) [Orabug: 38572947] {CVE-2025-39963}
- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [Orabug: 38572946] {CVE-2025-39965}
- tls: make sure to abort the stream if headers are bogus (Jakub Kicinski) [Orabug: 38572944] {CVE-2025-39946}
- futex: Prevent use-after-free during requeue-PI (Sebastian Andrzej Siewior) [Orabug: 38572943] {CVE-2025-39977}
- i40e: add validation for ring_len param (Lukasz Czapnik) [Orabug: 38572941] {CVE-2025-39973}
Fixed packages 35
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel-uek | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-core | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-debug | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-core | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-devel | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-core | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-deprecated | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-desktop | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra-netfilter | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-usb | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-wireless | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-devel | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-doc | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-modules | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-core | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-deprecated | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-desktop | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra-netfilter | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-usb | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-wireless | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek-tools | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek64k | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek64k-core | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek64k-devel | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-core | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-deprecated | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-desktop | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra-netfilter | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-usb | 0:6.12.0-104.43.4.3.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-wireless | 0:6.12.0-104.43.4.3.el10uek |
Vulnerabilities 10
-
High 7.8
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, c…
KEV Sep 18, 2026 -
Critical 9.8
tls: make sure to abort the stream if headers are bogus
In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus Normally we wait for the socket to buffer up the whole record before we service it. If the socket has a tiny buffer, however, we read o…
-
High 8.8
i40e: add validation for ring_len param
In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To add…
-
High 8.4
vsock/virtio: Validate length in packet header before skb_put()
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unf…
-
High 7.8
io_uring/futex: ensure io_futex_wait() cleans up properly on failure
In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with RE…
-
High 7.8CVE-2025-39866 Public exploit
fs: writeback: fix use-after-free in __mark_inode_dirty()
In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 5…
-
High 7.8
kernfs: Fix UAF in polling when open file is released
In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in polling when open file is released A use-after-free (UAF) vulnerability was identified in the PSI (Pressure Stall Information) monitoring mechanism: BUG: KASAN: slab-use-af…
-
High 7.8
io_uring: fix incorrect io_kiocb reference in io_link_skb
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function, there is a bug where prev_notif is incorrectly assigned using 'nd' instead of 'prev_nd'. This causes the con…
-
High 7.8CVE-2025-39965 Public exploit
xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the by…
-
High 7.8
futex: Prevent use-after-free during requeue-PI
In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() futex_do_wait() schedule() futex_requeue() futex_proxy_trylock_atom…