Summary
[5.4.17-2136.351.3.2]
- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Kuniyuki Iwashima) [Orabug: 38855323] {CVE-2025-40280}
- tipc: simplify the finalize work queue (Xin Long) [Orabug: 38855323]
- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38855319] {CVE-2025-40248}
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38855313] {CVE-2025-39964}
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | kernel-uek | 0:5.4.17-2136.351.3.2.el8uek |
| Oracle Linux · 7 | kernel-uek-container | 0:5.4.17-2136.351.3.2.el8uek |
| Oracle Linux · 7 | kernel-uek-container-debug | 0:5.4.17-2136.351.3.2.el8uek |
| Oracle Linux · 7 | kernel-uek-debug | 0:5.4.17-2136.351.3.2.el8uek |
| Oracle Linux · 7 | kernel-uek-debug-devel | 0:5.4.17-2136.351.3.2.el8uek |
| Oracle Linux · 7 | kernel-uek-devel | 0:5.4.17-2136.351.3.2.el8uek |
| Oracle Linux · 7 | kernel-uek-doc | 0:5.4.17-2136.351.3.2.el8uek |
| Oracle Linux · 7 | kernel-uek-tools | 0:5.4.17-2136.351.3.2.el7uek |
Vulnerabilities 3
-
High 7.8
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, c…
KEV Sep 18, 2026 -
High 7.8
vsock: Ignore signal/timeout on connect() if already established
In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connec…
-
High 7.8
tipc: Fix use-after-free in tipc_mon_reinit_self().
In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_mon_reinit_self(). syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0] The array is protected by RTNL, but tipc_mon_rei…