Red Hat Security Advisory: kernel security update

Fixed packages 160

Vulnerabilities 9

• Critical 9.8
  CVE-2025-38471

  tls: always refresh the queue when reading sock

  In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old sk…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 28, 2025
• High 7.8
  CVE-2025-21867

  bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()

  In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• High 7.8
  CVE-2025-38084

  mm/hugetlb: unshare page tables during VMA split, not before

  In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables during VMA split, not before Currently, __split_vma() triggers hugetlb page table unsharing through vm_ops->may_split(). This happens before the VMA lock and r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 28, 2025
• High 7.8
  CVE-2025-38085

  mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

  In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a n…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 28, 2025
• High 7.8
  CVE-2025-38250

  Bluetooth: hci_core: Fix use-after-free in vhci_flush()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file descriptor while its de…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 9, 2025
• High 7.5
  CVE-2025-38124

  net: fix udp gso skb_segment after pull from frag_list

  In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skb…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 3, 2025
• Medium 5.6
  CVE-2024-28956

  Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Alpine
  May 13, 2025
• Unscored —
  CVE-2025-38159

  wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds

  In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', whi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 3, 2025
• Unscored —
  CVE-2025-38380 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Jul 25, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2355334
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2366125
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2375303
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2375304
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2376041
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2376064
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2378982
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383381
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383893
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13962.json
• report
  https://access.redhat.com/security/cve/CVE-2024-28956
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-28956
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-28956
• article
  https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01153.html
• article
  https://www.vusec.net/projects/training-solo/
• report
  https://access.redhat.com/security/cve/CVE-2025-21867
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-21867
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-21867
• article
  https://lore.kernel.org/linux-cve-announce/2025032732-CVE-2025-21867-3138@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38084
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38084
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38084
• article
  https://lore.kernel.org/linux-cve-announce/2025062834-CVE-2025-38084-9121@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38085
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38085
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38085
• article
  https://lore.kernel.org/linux-cve-announce/2025062836-CVE-2025-38085-8075@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38124
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38124
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38124
• article
  https://lore.kernel.org/linux-cve-announce/2025070328-CVE-2025-38124-bc19@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38159
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38159
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38159
• article
  https://lore.kernel.org/linux-cve-announce/2025070339-CVE-2025-38159-0c95@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38250
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38250
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38250