Summary
[3.10.0-1160.119.1.0.19]
- ext4: fix use-after-free in ext4_orphan_cleanup {CVE-2022-50673} [Orabug: 39036029]
- Squashfs: check return result of sb_min_blocksize {CVE-2025-38415} [Orabug: 39036029]
- atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459} [Orabug: 39036029]
- usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760} [Orabug: 39036029]
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} [Orabug: 39036029]
- media: imon: reorganize serialization [Orabug: 39036029]
- media: rc: fix races with imon_disconnect() {CVE-2025-39993} [Orabug: 39036029]
- fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271} [Orabug: 39036029]
- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349} [Orabug: 39036029]
- net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074} [Orabug: 39036029]
[3.10.0-1160.119.1.0.18]
- e1000e: fix heap overflow in e1000_set_eeprom {CVE-2025-39898} [Orabug: 38904071]
- i40e: fix idx validation in config queues msg {CVE-2025-39971} [Orabug: 38904071]
- vsock: track pkt owner vsock [Orabug: 38904071]
- vhost-vsock: add pkt cancel capability [Orabug: 38904071]
- vsock: cancel packets when failing to connect [Orabug: 38904071]
- vsock: notify server to shutdown when client has pending
signal [Orabug: 38904071]
- vsock: remove vsock from connected table when connect is
interrupted by a signal [Orabug: 38904071]
- vsock: Ignore signal/timeout on connect() if already
established {CVE-2025-40248} [Orabug: 38904071]
[3.10.0-1160.119.1.0.17]
- scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675} [Orabug: 38860426]
- ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-53705} [Orabug: 38860426]
- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823} [Orabug: 38860426]
- libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285} [Orabug: 38860426]
[3.10.0-1160.119.1.0.16]
- net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356} [Orabug: 38790244]
- fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367} [Orabug: 38790244]
- iomap: iomap: fix memory corruption when recording {CVE-2022-50406} [Orabug: 38790244]
- mm: fix zswap writeback race condition {CVE-2023-53178} [Orabug: 38790244]
- Bluetooth: L2CAP: fix 'bad unlock balance' in l2cap_disconnect_rsp {CVE-2023-53297} [Orabug: 38790244]
- scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322} [Orabug: 38790244]
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729} [Orabug: 38790244]
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} [Orabug: 38790244]
- tcp: fix potential double free issue for fastopen_req [Orabug: 38790244]
- tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() {CVE-2025-39955} [Orabug: 38790244]
- NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-50410} [Orabug: 38790244]
- ext4: fix undefined behavior in bit shift for ext4_check_flag_values {CVE-2022-50403} [Orabug: 38790244]
[3.10.0-1160.119.1.0.15]
- Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() {CVE-2022-3640} [Orabug: 38742878]
- Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put [Orabug: 38742878]
- Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386} [Orabug: 38742878]
- wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408} [Orabug: 38742878]
- Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305} [Orabug: 38742878]
- ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365} [Orabug: 38742878]
- sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718} [Orabug: 38742878]
[3.10.0-1160.119.1.0.14]
- HID: core: fix shift-out-of-bounds in hid_report_raw_event {CVE-2022-48978} [Orabug: 38644370]
- crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373} [Orabug: 38644370]
- nfsd: don't ignore the return code of svc_proc_register() {CVE-2025-22026} [Orabug: 38644370]
- net_sched: hfsc: Fix a UAF vulnerability in class handling {CVE-2025-37797} [Orabug: 38644370]
- HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556} [Orabug: 38644370]
- ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751} [Orabug: 38644370]
[3.10.0-1160.119.1.0.13]
- ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() {CVE-2022-48701} [Orabug: 38493400]
- md-raid10: fix KASAN warning {CVE-2022-50211} [Orabug: 38493400]
- ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50229} [Orabug: 38493400]
- net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125} [Orabug: 38493400]
- i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200} [Orabug: 38493400]
- net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477} [Orabug: 38493400]
[3.10.0-1160.119.1.0.12]
- scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332) [Orabug: 38414589]
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352) [Orabug: 38414589]
[3.10.0-1160.119.1.0.11]
- kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980)
- kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928)
- kernel: ext4: fix off-by-one error in do_split (CVE-2025-23150)
- kernel: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788)
- kernel: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (CVE-2025-38000)
- kernel: ext4: avoid resizing to a partial cluster size (CVE-2022-50020)
- kernel: drivers:md:fix a potential use-after-free bug (CVE-2022-50022)
- kernel: sch_hfsc: make hfsc_qlen_notify() idempotent (CVE-2025-38177)
- kernel: net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350)
- crypto: algif_hash - fix double free in hash_accept (CVE-2025-
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | bpftool | 0:3.10.0-1160.119.1.0.19.el7 |
| Oracle Linux · 7 | kernel | 0:3.10.0-1160.119.1.0.19.el7 |
| Oracle Linux · 7 | kernel-abi-whitelists | 0:3.10.0-1160.119.1.0.19.el7 |
| Oracle Linux · 7 | kernel-debug | 0:3.10.0-1160.119.1.0.19.el7 |
| Oracle Linux · 7 | kernel-debug-devel | 0:3.10.0-1160.119.1.0.19.el7 |
| Oracle Linux · 7 | kernel-devel | 0:3.10.0-1160.119.1.0.19.el7 |
| Oracle Linux · 7 | kernel-doc | 0:3.10.0-1160.119.1.0.19.el7 |
| Oracle Linux · 7 | kernel-headers | 0:3.10.0-1160.119.1.0.19.el7 |
| Oracle Linux · 7 | kernel-tools | 0:3.10.0-1160.119.1.0.19.el7 |
| Oracle Linux · 7 | kernel-tools-libs | 0:3.10.0-1160.119.1.0.19.el7 |
| Oracle Linux · 7 | kernel-tools-libs-devel | 0:3.10.0-1160.119.1.0.19.el7 |
| Oracle Linux · 7 | perf | 0:3.10.0-1160.119.1.0.19.el7 |
| Oracle Linux · 7 | python-perf | 0:3.10.0-1160.119.1.0.19.el7 |
Vulnerabilities 9
-
High 7.8
ext4: fix use-after-free in ext4_orphan_cleanup
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+…
-
High 7.8
media: rc: fix races with imon_disconnect()
In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in …
-
High 7.8CVE-2025-40271 Public exploit
fs/proc: fix uaf in proc_readdir_de()
In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…
-
High 7.8
net/sched: Enforce that teql can only be used as root qdisc
In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not impo…
-
High 7.5
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…
-
High 7.1
efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe…
-
Unscored —
Squashfs: check return result of sb_min_blocksize
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squas…
-
Unscored —
atm: clip: Fix infinite recursive call of clip_push().
In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets …
-
Unscored —
usb: core: config: Prevent OOB read in SS endpoint companion parsing
In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…