Red Hat Security Advisory: kernel security update

Fixed packages 160

Vulnerabilities 5

• High 8.6
  CVE-2025-22004

  net: atm: fix use after free in lec_send()

  In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 3, 2025
• High 8.6
  CVE-2025-37799

  vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp

  In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that is, packet sizes between 128 - 3k bytes). We noticed MTU-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 3, 2025
• High 7.8
  CVE-2022-49846

  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()

  In the Linux kernel, the following vulnerability has been resolved: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() Syzbot reported a slab-out-of-bounds Write bug: loop0: detected capacity change from 0 to 2048 ====================================…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2025
• High 7.8
  CVE-2025-21759

  ipv6: mcast: extend RCU protection in igmp6_send()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6_send() igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a pot…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• High 7.8
  CVE-2025-21887

  ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up

  In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still acces…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 27, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348596
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2355405
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2357142
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363876
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10379.json
• report
  https://access.redhat.com/security/cve/CVE-2022-49846
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-49846
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-49846
• article
  https://kernelcve.org/list/?q=CVE-2022-49846
• article
  https://lore.kernel.org/linux-cve-announce/2025050142-CVE-2022-49846-728c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-21759
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-21759
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-21759
• article
  https://kernelcve.org/list/?q=CVE-2025-21759
• article
  https://lore.kernel.org/linux-cve-announce/2025022604-CVE-2025-21759-ad7c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-21887
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-21887
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-21887
• article
  https://lore.kernel.org/linux-cve-announce/2025032714-CVE-2025-21887-48e8@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-22004
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-22004
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-22004
• article
  https://lore.kernel.org/linux-cve-announce/2025040349-CVE-2025-22004-64f9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-37799
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-37799
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-37799
• article
  https://kernelcve.org/list/?q=CVE-2025-37799
• article
  https://lore.kernel.org/linux-cve-announce/2025050349-CVE-2025-37799-bb83@gregkh/T