Skip to content
OpenAdvisories
Critical 1 exploited CVE LSN-0114-1 8 CVEs

Kernel Live Patch Security Notice

Published Aug 18, 2025 · Updated Jun 3, 2026

Ecosystem: Ubuntu

Summary

In the Linux kernel, the following vulnerability has been
resolved: bfq: fix use-after-free in bfq_dispatch_request KASAN reports a
use-after-free report when doing normal scsi-mq test .

In the Linux kernel, the following vulnerability has been
resolved: block, bfq: don't move oom_bfqq Our test report a UAF: .

In the Linux kernel, the following vulnerability has been
resolved: Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() When
l2cap_recv_frame() is invoked to receive data, and the cid is
L2CAP_CID_A2MP, if the channel does not exist, it will create a channel.
However, after a channel is created, the hold operation of the channel is
not performed.

In the Linux kernel, the following vulnerability has been
resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener
svc_sock is freed, and before invoking svc_tcp_accept() for the established
child sock, there is a window that the newsock retaining a freed listener
svc_sock in sk_user_data which cloning from parent.

In the Linux kernel, the following vulnerability has been
resolved: ext4: aovid use-after-free in ext4_ext_insert_extent() As Ojaswin
mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated
in ext4_ext_create_new_leaf(), we'll use the stale path and cause UAF.
Below is a sample trace with dummy values: ext4_ext_insert_extent path .

In the Linux kernel, the following vulnerability has been
resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy
and Mbox devices A bogus device can provide a bNumConfigurations value that
exceeds the initial value used in usb_get_configuration for allocating
dev->config.

In the Linux kernel, the following vulnerability has been
resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in
ovl_link_up The issue was caused by dput(upper) being called before
ovl_dentry_update_reval(), while upper->d_flags was still accessed in
ovl_dentry_remote().

In the Linux kernel, the following vulnerability has been
resolved: RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
After the erdma_cep_put(new_cep) being called, new_cep will be freed, and
the following dereference will cause a UAF problem.

Fixed packages 32

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS linux-lts-xenial 4.4.0-271.305~14.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux 4.4.0-271.305
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-aws 4.4.0-1184.199
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-aws-hwe 4.15.0-1183.196~16.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-azure 4.15.0-1191.206~16.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-gcp 4.15.0-1176.193~16.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-hwe 4.15.0-240.252~16.04.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux 4.15.0-240.252
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-aws 4.15.0-1183.196
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-azure-4.15 4.15.0-1191.206
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-gcp-4.15 4.15.0-1176.193
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-oracle 4.15.0-1145.156
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-aws-5.15 5.15.0-1084.91~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-azure-5.15 5.15.0-1089.98~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-gcp-5.15 5.15.0-1083.92~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-hwe-5.15 5.15.0-142.152~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-ibm-5.15 5.15.0-1076.79~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-lowlatency-hwe-5.15 5.15.0-140.150~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-oracle-5.15 5.15.0-1081.87~20.04.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux 5.15.0-140.150
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-aws 5.15.0-1084.91
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-azure 5.15.0-1089.98
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-gcp 5.15.0-1083.92
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-gke 5.15.0-1081.87
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-ibm 5.15.0-1076.79
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-oracle 5.15.0-1081.87
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux 6.8.0-79.79
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-aws 6.8.0-1036.38
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-azure 6.8.0-1038.44
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-gcp 6.8.0-1037.39
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-ibm 6.8.0-1036.36
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-oracle 6.8.0-1033.34

Vulnerabilities 8

  • High 7.8
    CVE-2024-53197 Exploited

    ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configura…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
    KEV Apr 9, 2025
  • Critical 9.8
    CVE-2025-22088

    RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() After the erdma_cep_put(new_cep) being called, new_cep will be freed, and the following dereference will cause a UAF problem. Fix …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2023-52885

    SUNRPC: Fix UAF in svc_tcp_listen_data_ready()

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener svc_sock is freed, and before invoking svc_tcp_accept() for the established child sock, there is a window that the newsock re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-49176

    bfq: fix use-after-free in bfq_dispatch_request

    In the Linux kernel, the following vulnerability has been resolved: bfq: fix use-after-free in bfq_dispatch_request KASAN reports a use-after-free report when doing normal scsi-mq test [69832.239032] ===========================================================…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-49179

    block, bfq: don't move oom_bfqq

    In the Linux kernel, the following vulnerability has been resolved: block, bfq: don't move oom_bfqq Our test report a UAF: [ 2073.019181] ================================================================== [ 2073.019188] BUG: KASAN: use-after-free in __bfq_put…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-49883

    ext4: aovid use-after-free in ext4_ext_insert_extent()

    In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4_ext_insert_extent() As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-21887

    ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up

    In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still acces…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2022-49909 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2022-49176
  • report
    https://ubuntu.com/security/CVE-2022-49179
  • report
    https://ubuntu.com/security/CVE-2022-49909
  • report
    https://ubuntu.com/security/CVE-2023-52885
  • report
    https://ubuntu.com/security/CVE-2024-49883
  • report
    https://ubuntu.com/security/CVE-2024-53197
  • report
    https://ubuntu.com/security/CVE-2025-21887
  • report
    https://ubuntu.com/security/CVE-2025-22088