Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 17

• Critical 9.8
  CVE-2025-38089 Public exploit

  sunrpc: handle SVC_GARBAGE during svc auth processing as auth error

  In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If d…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 30, 2025
• High 7.8
  CVE-2024-50074

  parport: Proper fix for array out-of-bounds access

  In the Linux kernel, the following vulnerability has been resolved: parport: Proper fix for array out-of-bounds access The recent fix for array out-of-bounds accesses replaced sprintf() calls blindly with snprintf(). However, since snprintf() returns the woul…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 29, 2024
• High 7.8
  CVE-2024-50082

  blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race

  In the Linux kernel, the following vulnerability has been resolved: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race We're seeing crashes from rq_qos_wake_function that look like this: BUG: unable to handle page fault for address: ffffafe180…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 29, 2024
• High 7.8
  CVE-2025-21887

  ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up

  In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still acces…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 27, 2025
• High 7.8
  CVE-2025-37803

  udmabuf: fix a buf size overflow issue during udmabuf creation

  In the Linux kernel, the following vulnerability has been resolved: udmabuf: fix a buf size overflow issue during udmabuf creation by casting size_limit_mb to u64 when calculate pglimit.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2025
• High 7.8
  CVE-2025-38087

  net/sched: fix use-after-free in taprio_dev_notifier

  In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in taprio_dev_notifier Since taprio’s taprio_dev_notifier() isn’t protected by an RCU read-side critical section, a race with advance_sched() can lead to a use-a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 30, 2025
• High 7.1
  CVE-2025-21905

  wifi: iwlwifi: limit printed string from FW file

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 1, 2025
• High 7.0
  CVE-2024-26660

  drm/amd/display: Implement bounds check for stream encoder creation in DCN301

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN301 'stream_enc_regs' array is an array of dcn10_stream_enc_registers structures. The array is initialized with four …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 2, 2024
• Medium 4.4
  CVE-2021-47185

  tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc

  In the Linux kernel, the following vulnerability has been resolved: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc When running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup, which look like this one: Workqueue…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 10, 2024
• Unscored —
  CVE-2023-52835

  perf/core: Bail out early if the request AUX area is out of bound

  In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound When perf-record with a large AUX area, e.g 4GB, it fails with: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Unscored —
  CVE-2023-53558

  rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic()

  In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() pr_info() is called with rtp->cbs_gbl_lock spin lock locked. Because pr_info() calls printk() that might sleep, this will re…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2024-27025

  nbd: null check for nla_nest_start

  In the Linux kernel, the following vulnerability has been resolved: nbd: null check for nla_nest_start nla_nest_start() may fail and return NULL. Insert a check and set errno based on other call sites within the same source code.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• Unscored —
  CVE-2024-41039

  firmware: cs_dsp: Fix overflow checking of wmfw header

  In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix overflow checking of wmfw header Fix the checking that firmware file buffer is large enough for the wmfw header, to prevent overrunning the buffer. The original code tes…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• Unscored —
  CVE-2024-41065

  powerpc/pseries: Whitelist dtl slub object for copying to userspace

  In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Whitelist dtl slub object for copying to userspace Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG() when the config CONFIG_HARDENED_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• Unscored —
  CVE-2024-42226 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Jul 30, 2024
• Unscored —
  CVE-2025-22104

  ibmvnic: Use kernel helpers for hex dumps

  In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver was printing hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. If the buffer size was…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• Unscored —
  CVE-2025-22113

  ext4: avoid journaling sb update on error if journal is destroying

  In the Linux kernel, the following vulnerability has been resolved: ext4: avoid journaling sb update on error if journal is destroying Presently we always BUG_ON if trying to start a transaction on a journal marked with JBD2_UNMOUNT, since this should never h…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 16, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2272782
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2274624
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278484
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282735
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300408
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300440
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2301544
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322308
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2322310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2355405
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2356613
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360212
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360265
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2365013
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2375529
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2375531
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11810.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47185
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47185
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47185
• article
  https://lore.kernel.org/linux-cve-announce/2024041033-CVE-2021-47185-c363@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52835
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52835
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52835
• article
  https://lore.kernel.org/linux-cve-announce/2024052109-CVE-2023-52835-80ee@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53558
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2401543
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53558
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53558
• article
  https://lore.kernel.org/linux-cve-announce/2025100449-CVE-2023-53558-e6f7@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26660
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26660
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26660
• article
  https://lore.kernel.org/linux-cve-announce/2024040222-CVE-2024-26660-3f40@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-27025
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-27025
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-27025
• article
  https://lore.kernel.org/linux-cve-announce/2024050107-CVE-2024-27025-babd@gregkh/T