Red Hat Security Advisory: kernel security update

Fixed packages 160

Vulnerabilities 10

• High 8.4
  CVE-2025-22121

  ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() There's issue as follows: BUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790 Read of size 4 at addr ffff88807…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 16, 2025
• High 7.8
  CVE-2025-22085

  RDMA/core: Fix use-after-free when rename device name

  In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use-after-free when rename device name Syzbot reported a slab-use-after-free with the following call trace: ================================================================== B…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• High 7.8
  CVE-2025-37797

  net_sched: hfsc: Fix a UAF vulnerability in class handling

  In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-us…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 2, 2025
• High 7.8
  CVE-2025-38110

  net/mdiobus: Fix potential out-of-bounds clause 45 read/write access

  In the Linux kernel, the following vulnerability has been resolved: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via C45 (cl…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 3, 2025
• High 7.1
  CVE-2025-21905

  wifi: iwlwifi: limit printed string from FW file

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 1, 2025
• Unscored —
  CVE-2024-57980

  media: uvcvideo: Fix double free in error path

  In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. Thi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• Unscored —
  CVE-2025-22091

  RDMA/mlx5: Fix page_size variable overflow

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix page_size variable overflow Change all variables storing mlx5_umem_mkc_find_best_pgsz() result to unsigned long to support values larger than 31 and avoid overflow. For example…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• Unscored —
  CVE-2025-22113

  ext4: avoid journaling sb update on error if journal is destroying

  In the Linux kernel, the following vulnerability has been resolved: ext4: avoid journaling sb update on error if journal is destroying Presently we always BUG_ON if trying to start a transaction on a journal marked with JBD2_UNMOUNT, since this should never h…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 16, 2025
• Unscored —
  CVE-2025-37958

  mm/huge_memory: fix dereferencing invalid pmd migration entry

  In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address ac…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 20, 2025
• Unscored —
  CVE-2025-38086

  net: ch9200: fix uninitialised access during mii_nway_restart

  In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 28, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348599
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2356613
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360186
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360199
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360212
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360219
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363672
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2367572
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2375305
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2376035
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11861.json
• report
  https://access.redhat.com/security/cve/CVE-2024-57980
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-57980
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-57980
• article
  https://lore.kernel.org/linux-cve-announce/2025022634-CVE-2024-57980-4b5a@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-21905
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-21905
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-21905
• article
  https://lore.kernel.org/linux-cve-announce/2025040129-CVE-2025-21905-348b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-22085
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-22085
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-22085
• article
  https://lore.kernel.org/linux-cve-announce/2025041615-CVE-2025-22085-d167@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-22091
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-22091
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-22091
• article
  https://lore.kernel.org/linux-cve-announce/2025041617-CVE-2025-22091-462d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-22113
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-22113
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-22113
• article
  https://lore.kernel.org/linux-cve-announce/2025041625-CVE-2025-22113-34cd@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-22121
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-22121
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-22121
• article
  https://lore.kernel.org/linux-cve-announce/2025041628-CVE-2025-22121-52fd@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-37797
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-37797
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-37797