Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 21

• High 8.8
  CVE-2025-38052

  net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done

  In the Linux kernel, the following vulnerability has been resolved: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done Syzbot reported a slab-use-after-free with the following call trace: =========================================================…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 18, 2025
• High 7.8
  CVE-2024-26659

  xhci: handle isoc Babble and Buffer Overrun events properly

  In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Buffer Overrun events properly xHCI 4.9 explicitly forbids assuming that the xHC has released its ownership of a multi-TRB TD when it reports an error on one of t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 2, 2024
• High 7.8
  CVE-2024-43888

  mm: list_lru: fix UAF for memory cgroup

  In the Linux kernel, the following vulnerability has been resolved: mm: list_lru: fix UAF for memory cgroup The mem_cgroup_from_slab_obj() is supposed to be called under rcu lock or cgroup_mutex or others which could prevent returned memcg from being freed. F…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 26, 2024
• High 7.8
  CVE-2024-58002

  media: uvcvideo: Remove dangling pointers

  In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done.…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• High 7.8
  CVE-2025-21727

  padata: fix UAF in padata_reorder

  In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u11…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 7.8
  CVE-2025-21928

  HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()

  In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handli…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 1, 2025
• High 7.8
  CVE-2025-21991

  x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes

  In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their CPU masks and unconditionally accesses p…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 2, 2025
• High 7.8
  CVE-2025-37890

  net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc

  In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 16, 2025
• High 7.5
  CVE-2024-36945

  net/smc: fix neighbour and rtable leak in smc_ib_find_route()

  In the Linux kernel, the following vulnerability has been resolved: net/smc: fix neighbour and rtable leak in smc_ib_find_route() In smc_ib_find_route(), the neighbour found by neigh_lookup() and rtable resolved by ip_route_output_flow() are not released or p…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• High 7.1
  CVE-2022-49395

  um: Fix out-of-bounds read in LDT setup

  In the Linux kernel, the following vulnerability has been resolved: um: Fix out-of-bounds read in LDT setup syscall_stub_data() expects the data_count parameter to be the number of longs, not bytes. ============================================================…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Medium 5.5
  CVE-2022-48669

  powerpc/pseries: Fix potential memleak in papr_get_attr()

  In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix potential memleak in papr_get_attr() `buf` is allocated in papr_get_attr(), and krealloc() of `buf` could fail. We need to free the original `buf` in the case of failure.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• Unscored —
  CVE-2021-47527

  serial: core: fix transmit-buffer reset and memleak

  In the Linux kernel, the following vulnerability has been resolved: serial: core: fix transmit-buffer reset and memleak Commit 761ed4a94582 ("tty: serial_core: convert uart_close to use tty_port_close") converted serial core to use tty_port_close() but failed…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 24, 2024
• Unscored —
  CVE-2022-49788

  misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()

  In the Linux kernel, the following vulnerability has been resolved: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() `struct vmci_event_qp` allocated by qp_notify_peer() contains padding, which may carry uninitialized data to the userspace, a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2025
• Unscored —
  CVE-2023-52451

  powerpc/pseries/memhp: Fix access beyond end of drmem array

  In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 22, 2024
• Unscored —
  CVE-2023-52764

  media: gspca: cpia1: shift-out-of-bounds in set_flicker

  In the Linux kernel, the following vulnerability has been resolved: media: gspca: cpia1: shift-out-of-bounds in set_flicker Syzkaller reported the following issue: UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27 shift exponent 245 is too…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Unscored —
  CVE-2023-52877

  usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()

  In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() It is possible that typec_register_partner() returns ERR_PTR on failure. When port->partner is an error, a NULL pointer derefe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Unscored —
  CVE-2024-26934

  USB: core: Fix deadlock in usb_deauthorize_interface()

  In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in usb_deauthorize_interface() Among the attribute file callback routines in drivers/usb/core/sysfs.c, the interface_authorized_store() function is the only one which …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• Unscored —
  CVE-2024-26964

  usb: xhci: Add error handling in xhci_map_urb_for_dma

  In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Add error handling in xhci_map_urb_for_dma Currently xhci_map_urb_for_dma() creates a temporary buffer and copies the SG list to the new linear buffer. But if the kzalloc_node() fa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• Unscored —
  CVE-2024-27059

  USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command

  In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and he…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• Unscored —
  CVE-2024-57980

  media: uvcvideo: Fix double free in error path

  In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. Thi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• Unscored —
  CVE-2025-37958

  mm/huge_memory: fix dereferencing invalid pmd migration entry

  In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address ac…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 20, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265650
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2272780
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278169
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278237
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278398
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278537
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282712
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282780
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2283424
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284465
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2307861
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2347899
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348516
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348599
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2356592
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2356917
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363378
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2366848
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2367572
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373380
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13135.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47527
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47527
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47527
• article
  https://lore.kernel.org/linux-cve-announce/2024052435-CVE-2021-47527-e6f5@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-48669
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48669
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48669
• article
  https://lore.kernel.org/linux-cve-announce/2024050131-CVE-2022-48669-15cf@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-49395
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-49395
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-49395
• article
  https://lore.kernel.org/linux-cve-announce/2025022650-CVE-2022-49395-7419@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-49788
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-49788
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-49788
• article
  https://lore.kernel.org/linux-cve-announce/2025050121-CVE-2022-49788-6e84@gregkh/T