Skip to content
OpenAdvisories
High ELSA-2025-9080 7 CVEs

Important: kernel security update (Oracle Linux 9)

Published Jun 17, 2025 · Updated Jun 17, 2025

Ecosystem: Oracle Linux

Summary

[5.14.0-570.22.1.0.1_6.OL9]
- nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-570.22.1_6]
- Bluetooth: L2CAP: Fix corrupted list in hci_chan_del (David Marlin) [RHEL-87890] {CVE-2025-21969}
- Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd (David Marlin) [RHEL-87890] {CVE-2025-21969}
- Revert 'SUNRPC: Revert e0a912e8ddba' (Benjamin Coddington) [RHEL-94811]
- mm/hugetlb: fix kernel NULL pointer dereference when migrating hugetlb folio (Jay Shin) [RHEL-92291]
- mm: fix crashes from deferred split racing folio migration (Jay Shin) [RHEL-92291] {CVE-2024-42234}
- mm: memcg: fix split queue list crash when large folio migration (Jay Shin) [RHEL-92291]
- proc: fix UAF in proc_get_inode() (Ian Kent) [RHEL-86808] {CVE-2025-21999}
- cifs: Fix integer overflow while processing acdirmax mount option (Paulo Alcantara) [RHEL-87941] {CVE-2025-21963}
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (CKI Backport Bot) [RHEL-87931] {CVE-2025-21979}
- wifi: cfg80211: cancel wiphy_work before freeing wiphy (CKI Backport Bot) [RHEL-87931] {CVE-2025-21979}
- eth: bnxt: fix truesize for mb-xdp-pass case (CKI Backport Bot) [RHEL-88328] {CVE-2025-21961}
- vmxnet3: unregister xdp rxq info in the reset path (CKI Backport Bot) [RHEL-92471]
- md: fix mddev uaf while iterating all_mddevs list (CKI Backport Bot) [RHEL-89062] {CVE-2025-22126}
- nvme: print firmware bug note for non-unique identifiers (Bryan Gurney) [RHEL-91163]
- nvme-pci: add BOGUS_NID quirk for Samsung PM1733 (Bryan Gurney) [RHEL-91163]
- media: v4l2-mediabus: Drop V4L2_MBUS_CSI2_CONTINUOUS_CLOCK flag (Kate Hsuan) [RHEL-90323]
- media: v4l2-mediabus: Drop legacy V4L2_MBUS_CSI2_CHANNEL_* flags (Kate Hsuan) [RHEL-90323]
- media: v4l2-mediabus: Use structures to describe bus configuration (Kate Hsuan) [RHEL-90323]
- media: v4l2-fwnode: Move bus config structure to v4l2_mediabus.h (Kate Hsuan) [RHEL-90323]
- sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-86302]
- smb: client: fix UAF in decryption with multichannel (CKI Backport Bot) [RHEL-94460] {CVE-2025-37750}

Fixed packages 29

ReleasePackageFixed in
Oracle Linux · 9 kernel 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-abi-stablelists 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-core 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-cross-headers 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-debug 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-core 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-devel 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-devel-matched 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-modules 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-modules-core 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-modules-extra 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-uki-virt 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-devel 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-devel-matched 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-doc 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-headers 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-modules 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-modules-core 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-modules-extra 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-tools 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-tools-libs 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-tools-libs-devel 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-uki-virt 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 kernel-uki-virt-addons 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 libperf 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 perf 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 python3-perf 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 rtla 0:5.14.0-570.22.1.0.1.el9_6
Oracle Linux · 9 rv 0:5.14.0-570.22.1.0.1.el9_6

Vulnerabilities 7

  • Critical 9.8
    CVE-2025-37750

    smb: client: fix UAF in decryption with multichannel

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in decryption with multichannel After commit f7025d861694 ("smb: client: allocate crypto only for primary server") and commit b0abcd65ec54 ("smb: client: fix UAF in async…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-21969

    Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd After the hci sync command releases l2cap_conn, the hci receive data work queue references the released l2cap_conn when sendin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-21979

    wifi: cfg80211: cancel wiphy_work before freeing wiphy

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel wiphy_work before freeing wiphy A wiphy_work can be queued from the moment the wiphy is allocated and initialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-21999

    proc: fix UAF in proc_get_inode()

    In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferenc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2025-21961

    eth: bnxt: fix truesize for mb-xdp-pass case

    In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix truesize for mb-xdp-pass case When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb().…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2025-21963

    cifs: Fix integer overflow while processing acdirmax mount option

    In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acdirmax mount option User-provided mount parameter acdirmax of type u32 is intended to have an upper limit, but before it is validated, the value …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-22126

    md: fix mddev uaf while iterating all_mddevs list

    In the Linux kernel, the following vulnerability has been resolved: md: fix mddev uaf while iterating all_mddevs list While iterating all_mddevs list from md_notify_reboot() and md_exit(), list_for_each_entry_safe is used, and this can race with deletint the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu