Red Hat Security Advisory: kernel security update

Fixed packages 81

Vulnerabilities 9

• High 8.8
  CVE-2021-47670

  can: peak_usb: fix use after free bugs

  In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_u…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2025
• High 7.8
  CVE-2022-49977

  ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead

  In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_func…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• High 7.8
  CVE-2025-37890

  net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc

  In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 16, 2025
• High 7.8
  CVE-2025-38000

  sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()

  In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 6, 2025
• High 7.8
  CVE-2025-38001 Public exploit

  net_sched: hfsc: Address reentrant enqueue adding class to eltree twice

  In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: "We are writing to report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) [1] can be byp…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 6, 2025
• High 7.8
  CVE-2025-38079

  crypto: algif_hash - fix double free in hash_accept

  In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also fr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 18, 2025
• High 7.8
  CVE-2025-38177

  sch_hfsc: make hfsc_qlen_notify() idempotent

  In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 4, 2025
• High 7.8
  CVE-2025-38250

  Bluetooth: hci_core: Fix use-after-free in vhci_flush()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file descriptor while its de…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 9, 2025
• High 7.8
  CVE-2025-38350

  net/sched: Always pass notifications when child class becomes empty

  In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 19, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360786
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2366848
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2370776
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2370786
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373574
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2376354
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2378982
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2382054
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14692.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47670
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47670
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47670
• article
  https://lore.kernel.org/linux-cve-announce/2025041734-CVE-2021-47670-2b77@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-49977
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-49977
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-49977
• article
  https://lore.kernel.org/linux-cve-announce/2025061819-CVE-2022-49977-3826@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-37890
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-37890
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-37890
• article
  https://kernelcve.org/list/?q=CVE-2025-37890
• article
  https://lore.kernel.org/linux-cve-announce/2025051617-CVE-2025-37890-437b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38000
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38000
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38000
• article
  https://lore.kernel.org/linux-cve-announce/2025060639-CVE-2025-38000-f5a4@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38001
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38001
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38001
• article
  https://lore.kernel.org/linux-cve-announce/2025060650-CVE-2025-38001-f921@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38079
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38079
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38079
• article
  https://lore.kernel.org/linux-cve-announce/2025061841-CVE-2025-38079-7fa5@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38177
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38177
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38177