Skip to content
OpenAdvisories
Critical LSN-0115-1 5 CVEs

Kernel Live Patch Security Notice

Published Oct 8, 2025 · Updated Jun 3, 2026

Ecosystem: Ubuntu

Summary

In the Linux kernel, the following vulnerability has been
resolved: fs/ntfs3: Fixed overflow check in mi_enum_attr())(CVE-2024-27407).

In the Linux kernel, the following vulnerability has been
resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot
reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on
the four reserved tcp bits (th->res1) Use skb_put_zero() to clear the whole
TCP header, as done in nf_reject_ip_tcphdr_put() BUG: KMSAN: uninit-value
in nf_reject_ip6_tcphdr_put+0x688/0x6c0
net/ipv6/netfilter/nf_reject_ipv6.c:255
nf_reject_ip6_tcphdr_put+0x688/0x6c0
net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_send_reset6+0xd84/0x15b0
net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880
net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval
net/netfilter/nf_tables_core.c:240 .

In the Linux kernel, the following vulnerability has been
resolved: smb: client: fix UAF in async decryption Doing an async
decryption (large read) crashes with a slab-use-after-free way down in the
crypto API.

In the Linux kernel, the following vulnerability has been
resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in
ovl_link_up The issue was caused by dput(upper) being called before
ovl_dentry_update_reval(), while upper->d_flags was still accessed in
ovl_dentry_remote().

In the Linux kernel, the following vulnerability has been
resolved: RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
After the erdma_cep_put(new_cep) being called, new_cep will be freed, and
the following dereference will cause a UAF problem.

Fixed packages 35

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS linux-lts-xenial 4.4.0-272.306~14.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux 4.4.0-272.306
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-aws 4.4.0-1185.200
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-aws-hwe 4.15.0-1184.197~16.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-azure 4.15.0-1192.207~16.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-gcp 4.15.0-1177.194~16.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-hwe 4.15.0-241.253~16.04.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux 4.15.0-241.253
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-aws 4.15.0-1184.197
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-azure-4.15 4.15.0-1192.207
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-gcp-4.15 4.15.0-1177.194
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-hwe-5.4 5.4.0-219.239~18.04.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS linux-oracle 4.15.0-1146.157
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux 5.4.0-219.239
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-aws 5.4.0-1148.158
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-aws-5.15 5.15.0-1091.98~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-azure-5.15 5.15.0-1095.104~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-gcp-5.15 5.15.0-1091.100~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-hwe-5.15 5.15.0-153.163~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-ibm-5.15 5.15.0-1085.88~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-lowlatency-hwe-5.15 5.15.0-153.163~20.04.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS linux-oracle-5.15 5.15.0-1090.96~20.04.1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux 5.15.0-153.163
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-aws 5.15.0-1091.98
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-azure 5.15.0-1095.104
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-gcp 5.15.0-1091.100
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-gke 5.15.0-1088.94
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-ibm 5.15.0-1085.88
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS linux-oracle 5.15.0-1089.95
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux 6.8.0-79.79
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-aws 6.8.0-1036.38
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-azure 6.8.0-1038.44
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-gcp 6.8.0-1037.39
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-ibm 6.8.0-1036.36
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS linux-oracle 6.8.0-1033.34

Vulnerabilities 5

  • Critical 9.8
    CVE-2024-50047

    smb: client: fix UAF in async decryption

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. Reproducer: # mount.cifs -o ...,seal,esize=1 //s…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-22088

    RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() After the erdma_cep_put(new_cep) being called, new_cep will be freed, and the following dereference will cause a UAF problem. Fix …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-27407

    fs/ntfs3: Fixed overflow check in mi_enum_attr()

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fixed overflow check in mi_enum_attr()

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-21887

    ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up

    In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still acces…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-47685

    netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1) Use skb_put_zer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2024-27407
  • report
    https://ubuntu.com/security/CVE-2024-47685
  • report
    https://ubuntu.com/security/CVE-2024-50047
  • report
    https://ubuntu.com/security/CVE-2025-21887
  • report
    https://ubuntu.com/security/CVE-2025-22088