Skip to content
OpenAdvisories
High RHSA-2025:14744 11 CVEs

Red Hat Security Advisory: kernel security update

Published Aug 31, 2025 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 47

ReleasePackageFixed in
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream bpftool-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-devel 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debug-devel-matched 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-aarch64 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-ppc64le 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-s390x 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-debuginfo-common-x86_64 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-devel 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-devel-matched 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-doc 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-tools-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-devel 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream kernel-zfcpdump-devel-matched 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream perf 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream perf-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::appstream python3-perf-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos bpftool 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos bpftool-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-abi-stablelists 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-core 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-core 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-modules 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debug-modules-extra 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-aarch64 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-ppc64le 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-s390x 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-debuginfo-common-x86_64 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-modules 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-modules-extra 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-tools-libs 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-core 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-modules 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos kernel-zfcpdump-modules-extra 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos perf-debuginfo 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos python3-perf 0:5.14.0-70.144.1.el9_0
Red Hat · RHEL 9.0 E4S rhel_e4s:9.0::baseos python3-perf-debuginfo 0:5.14.0-70.144.1.el9_0

Vulnerabilities 11

  • High 7.8
    CVE-2022-49385

    driver: base: fix UAF when driver_attach failed

    In the Linux kernel, the following vulnerability has been resolved: driver: base: fix UAF when driver_attach failed When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF. To fix it, we need to …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-49977

    ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead

    In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_func…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-49991

    mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte

    In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte In MCOPY_ATOMIC_CONTINUE case with a non-shared VMA, pages in the page cache are installed in the ptes. But hugepage_add…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2023-53047

    tee: amdtee: fix race condition in amdtee_open_session

    In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix race condition in amdtee_open_session There is a potential race condition in amdtee_open_session that may lead to use-after-free. For instance, in amdtee_open_session() after…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-37890

    net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc

    In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38000

    sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()

    In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38001 Public exploit

    net_sched: hfsc: Address reentrant enqueue adding class to eltree twice

    In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: "We are writing to report that this recent patch (141d34391abbb315d68556b7c67ad97885407547) [1] can be byp…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38177

    sch_hfsc: make hfsc_qlen_notify() idempotent

    In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38350

    net/sched: Always pass notifications when child class becomes empty

    In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2022-50044

    net: qrtr: start MHI channel after endpoit creation

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: start MHI channel after endpoit creation MHI channel may generates event/interrupt right after enabling. It may leads to 2 race conditions issues. 1) Such event may be dropped by q…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-22026

    nfsd: don't ignore the return code of svc_proc_register()

    In the Linux kernel, the following vulnerability has been resolved: nfsd: don't ignore the return code of svc_proc_register() Currently, nfsd_proc_stat_init() ignores the return value of svc_proc_register(). If the procfile creation fails, then the kernel wil…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2348020
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2360224
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2363689
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2366848
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2370776
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2370786
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373574
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373627
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373639
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376354
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2382054
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14744.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-49385
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-49385
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-49385
  • article
    https://lore.kernel.org/linux-cve-announce/2025022648-CVE-2022-49385-258c@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2022-49977
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-49977
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-49977
  • article
    https://lore.kernel.org/linux-cve-announce/2025061819-CVE-2022-49977-3826@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2022-49991
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-49991
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-49991
  • article
    https://lore.kernel.org/linux-cve-announce/2025061824-CVE-2022-49991-c44f@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2022-50044
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-50044
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-50044
  • article
    https://lore.kernel.org/linux-cve-announce/2025061843-CVE-2022-50044-0b6b@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53047
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-53047
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-53047
  • article
    https://lore.kernel.org/linux-cve-announce/2025050204-CVE-2023-53047-7e31@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-22026
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-22026
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-22026
  • article
    https://lore.kernel.org/linux-cve-announce/2025041654-CVE-2025-22026-f6be@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2025-37890
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-37890