Red Hat Security Advisory: kernel security update

Fixed packages 160

Vulnerabilities 8

• Critical 9.8
  CVE-2025-38211

  RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

  In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 4, 2025
• High 7.8
  CVE-2025-37823

  net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too

  In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2025
• High 7.8
  CVE-2025-38350

  net/sched: Always pass notifications when child class becomes empty

  In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 19, 2025
• High 7.8
  CVE-2025-38464

  tipc: Fix use-after-free in tipc_conn_close().

  In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-ptr-deref in tipc_conn_close() during netns dismantle. [0] tipc_topsrv_stop() iterates tipc_net(net)->topsrv->conn_idr an…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2025
• High 7.8
  CVE-2025-38500

  xfrm: interface: fix use-after-free after changing collect_md xfrm interface

  In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail whe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 12, 2025
• High 7.0
  CVE-2025-38461

  vsock: Fix transport_* TOCTOU

  In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_* TOCTOU Transport assignment may race with module unload. Protect new_transport from becoming a stale pointer. This also takes care of an insecure call in vsock_use_loca…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2025
• Unscored —
  CVE-2025-38200

  i40e: fix MMIO write access to an invalid page in i40e_clear_hw

  In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page. Preven…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 4, 2025
• Unscored —
  CVE-2025-38684

  net/sched: ets: use old 'nbands' while purging unused classes

  In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 4, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2365024
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2376392
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2376406
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2382054
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383509
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2387866
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15011.json
• report
  https://access.redhat.com/security/cve/CVE-2025-37823
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-37823
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-37823
• article
  https://lore.kernel.org/linux-cve-announce/2025050821-CVE-2025-37823-d739@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38200
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38200
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38200
• article
  https://lore.kernel.org/linux-cve-announce/2025070418-CVE-2025-38200-47d9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38211
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38211
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38211
• article
  https://lore.kernel.org/linux-cve-announce/2025070422-CVE-2025-38211-215a@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38350
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38350
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38350
• article
  https://lore.kernel.org/linux-cve-announce/2025071933-CVE-2025-38350-262a@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38461
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38461
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38461
• article
  https://lore.kernel.org/linux-cve-announce/2025072507-CVE-2025-38461-33b1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38464
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38464
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38464
• article
  https://lore.kernel.org/linux-cve-announce/2025072508-CVE-2025-38464-44a1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38500
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38500
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38500
• article
  https://lore.kernel.org/linux-cve-announce/2025081245-CVE-2025-38500-7e22@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38684
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393190