Red Hat Security Advisory: kernel security update

Fixed packages 158

Vulnerabilities 145

• Critical 9.8
  CVE-2023-54237

  net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()

  In the Linux kernel, the following vulnerability has been resolved: net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() There is a certain chance to trigger the following panic: PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: "kworker/1:4…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Critical 9.8
  CVE-2024-56645

  can: j1939: j1939_session_new(): fix skb reference counting

  In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_session_new(): fix skb reference counting Since j1939_session_skb_queue() does an extra skb_get() for each new skb, do the same for the initial one in j1939_session_new() to…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 27, 2024
• Critical 9.8
  CVE-2025-21796

  nfsd: clear acl_access/acl_default after releasing them

  In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a point…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• Critical 9.8
  CVE-2025-21829

  RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" The Call Trace is as below: " <TASK> ? show_regs.cold+0x1a/0x1f ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? __warn+0x84/0xd0 ? __…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 6, 2025
• Critical 9.8
  CVE-2025-38075

  scsi: target: iscsi: Fix timeout on deleted connection

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix timeout on deleted connection NOPIN response timer may expire on a deleted connection and crash with such logs: Did not receive response to NOPIN on CID: 0, failing c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 18, 2025
• Critical 9.8
  CVE-2025-38527

  smb: client: fix use-after-free in cifs_oplock_break

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break()…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 16, 2025
• High 8.8
  CVE-2022-48830

  can: isotp: fix potential CAN frame reception race in isotp_rcv()

  In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix potential CAN frame reception race in isotp_rcv() When receiving a CAN frame the current code logic does not consider concurrently receiving processes which do not show up in …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 16, 2024
• High 8.8
  CVE-2023-54318

  net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add

  In the Linux kernel, the following vulnerability has been resolved: net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add While doing smcr_port_add, there maybe linkgroup add into or delete from smc_lgr_list.list at the same tim…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• High 8.8
  CVE-2024-53135

  KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN

  In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN Hide KVM's pt_mode module param behind CONFIG_BROKEN, i.e. disable support for virtualizing Intel PT via guest/ho…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 4, 2024
• High 8.8
  CVE-2024-57995

  wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() In ath12k_mac_assign_vif_to_vdev(), if arvif is created on a different radio, it gets deleted from that radio thro…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 8.8
  CVE-2025-21828

  wifi: mac80211: don't flush non-uploaded STAs

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't flush non-uploaded STAs If STA state is pre-moved to AUTHORIZED (such as in IBSS scenarios) and insertion fails, the station is freed. In this case, the driver never kne…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 6, 2025
• High 8.8
  CVE-2025-22086

  RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow When cur_qp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we al…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• High 8.8
  CVE-2025-37849

  KVM: arm64: Tear down vGIC on failed vCPU creation

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 9, 2025
• High 8.6
  CVE-2025-21855

  ibmvnic: Don't reference skb after sending to VIOS

  In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Don't reference skb after sending to VIOS Previously, after successfully flushing the xmit buffer to VIOS, the tx_bytes stat was incremented by the length of the skb. It is invalid t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 12, 2025
• High 8.1
  CVE-2025-21765

  ipv6: use RCU protection in ip6_default_advmss()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU protection in ip6_default_advmss() ip6_default_advmss() needs rcu protection to make sure the net structure it reads does not disappear.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 7.8
  CVE-2022-49672

  net: tun: unlink NAPI from device on destruction

  In the Linux kernel, the following vulnerability has been resolved: net: tun: unlink NAPI from device on destruction Syzbot found a race between tun file and device destruction. NAPIs live in struct tun_file which can get destroyed before the netdev so we hav…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• High 7.8
  CVE-2023-53426

  xsk: Fix xsk_diag use-after-free error during socket cleanup

  In the Linux kernel, the following vulnerability has been resolved: xsk: Fix xsk_diag use-after-free error during socket cleanup Fix a use-after-free error that is possible if the xsk_diag interface is used after the socket has been unbound from the device. T…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• High 7.8
  CVE-2023-53781

  smc: Fix use-after-free in tcp_write_timer_handler().

  In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in tcp_write_timer_handler(). With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2024-36286

  netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() syzbot reported that nf_reinject() could be called without rcu_read_lock() : WARNING: suspicious RCU usage 6.9.0-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 21, 2024
• High 7.8
  CVE-2024-47679

  vfs: fix race between evice_inodes() and find_inode()&iput()

  In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between evice_inodes() and find_inode()&iput() Hi, all Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs. Let's assume there's a inode (i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 21, 2024
• High 7.8
  CVE-2024-47727

  x86/tdx: Fix "in-kernel MMIO" check

  In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix "in-kernel MMIO" check TDX only supports kernel-initiated MMIO operations. The handle_mmio() function checks if the #VE exception occurred in the kernel and rejects the operation…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 21, 2024
• High 7.8
  CVE-2024-49570

  drm/xe/tracing: Fix a potential TP_printk UAF

  In the Linux kernel, the following vulnerability has been resolved: drm/xe/tracing: Fix a potential TP_printk UAF The commit afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format") exposes potential UAFs in the xe_bo_move t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 7.8
  CVE-2024-50294

  rxrpc: Fix missing locking causing hanging calls

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing locking causing hanging calls If a call gets aborted (e.g. because kafs saw a signal) between it being queued for connection and the I/O thread picking up the call, the abo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Nov 19, 2024
• High 7.8
  CVE-2024-53170

  block: fix uaf for flush rq while iterating tags

  In the Linux kernel, the following vulnerability has been resolved: block: fix uaf for flush rq while iterating tags blk_mq_clear_flush_rq_mapping() is not called during scsi probe, by checking blk_queue_init_done(). However, QUEUE_FLAG_INIT_DONE is cleared i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 27, 2024
• High 7.8
  CVE-2024-54456

  NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()

  In the Linux kernel, the following vulnerability has been resolved: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() name is char[64] where the size of clnt->cl_program->name remains unknown. Invoking strcat() directly will also lead to potent…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 7.8
  CVE-2024-56603

  net: af_can: do not leave a dangling sk pointer in can_create()

  In the Linux kernel, the following vulnerability has been resolved: net: af_can: do not leave a dangling sk pointer in can_create() On error can_create() frees the allocated sk object, but sock_init_data() has already attached it to the provided sock object. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 27, 2024
• High 7.8
  CVE-2024-56662

  acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl

  In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 27, 2024
• High 7.8
  CVE-2024-56672

  blk-cgroup: Fix UAF in blkcg_unpin_online()

  In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix UAF in blkcg_unpin_online() blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blk…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 27, 2024
• High 7.8
  CVE-2024-56675

  bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors Uprobes always use bpf_prog_run_array_uprobe() under tasks-trace-RCU protection. But it is possible to attach a non-sleepable BPF …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 27, 2024
• High 7.8
  CVE-2024-56709

  io_uring: check if iowq is killed before queuing

  In the Linux kernel, the following vulnerability has been resolved: io_uring: check if iowq is killed before queuing task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 29, 2024
• High 7.8
  CVE-2024-57982

  xfrm: state: fix out-of-bounds read during lookup

  In the Linux kernel, the following vulnerability has been resolved: xfrm: state: fix out-of-bounds read during lookup lookup and resize can run in parallel. The xfrm_state_hash_generation seqlock ensures a retry, but the hash functions can observe a hmask val…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• High 7.8
  CVE-2024-57990

  wifi: mt76: mt7925: fix off by one in mt7925_load_clc()

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() This comparison should be >= instead of > to prevent an out of bounds read and write.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 7.8
  CVE-2024-58075

  crypto: tegra - do not transfer req when tegra init fails

  In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - do not transfer req when tegra init fails The tegra_cmac_init or tegra_sha_init function may return an error when memory is exhausted. It should not transfer the request when …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 6, 2025
• High 7.8
  CVE-2024-58083

  KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()

  In the Linux kernel, the following vulnerability has been resolved: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() Explicitly verify the target vCPU is fully online _prior_ to clamping the index in kvm_get_vcpu(). If the index is "bad", the no…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 6, 2025
• High 7.8
  CVE-2025-21631

  block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()

  In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UAF for v6.6: BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 19, 2025
• High 7.8
  CVE-2025-21671

  zram: fix potential UAF of zram table

  In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early, it frees allocated zram->table without setting it NULL. Which will potentially cause zram_meta_free to access the table …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 31, 2025
• High 7.8
  CVE-2025-21693

  mm: zswap: properly synchronize freeing resources during CPU hotunplug

  In the Linux kernel, the following vulnerability has been resolved: mm: zswap: properly synchronize freeing resources during CPU hotunplug In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the current CPU at the beginning of the operation i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 10, 2025
• High 7.8
  CVE-2025-21702

  pfifo_tail_enqueue: Drop new packet when sch->limit == 0

  In the Linux kernel, the following vulnerability has been resolved: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 Expected behaviour: In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet in scheduler's queue and decrease sche…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 18, 2025
• High 7.8
  CVE-2025-21714

  RDMA/mlx5: Fix implicit ODP use after free

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix implicit ODP use after free Prevent double queueing of implicit ODP mr destroy work by using __xa_cmpxchg() to make sure this is the only time we are destroying this specific m…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• High 7.8
  CVE-2025-21726

  padata: avoid UAF for reorder_work

  In the Linux kernel, the following vulnerability has been resolved: padata: avoid UAF for reorder_work Although the previous patch can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as bel…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 7.8
  CVE-2025-21727

  padata: fix UAF in padata_reorder

  In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u11…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 7.8
  CVE-2025-21729

  wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion

  In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion The rtwdev->scanning flag isn't protected by mutex originally, so cancel_hw_scan can pass the condition, but suddenly hw_sc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 7.8
  CVE-2025-21738

  ata: libata-sff: Ensure that we cannot write outside the allocated buffer

  In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PA…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• High 7.8
  CVE-2025-21739

  scsi: ufs: core: Fix use-after free in init error and remove paths

  In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix use-after free in init error and remove paths devm_blk_crypto_profile_init() registers a cleanup handler to run when the associated (platform-) device is being released. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• High 7.8
  CVE-2025-21786

  workqueue: Put the pwq after detaching the rescuer from the pool

  In the Linux kernel, the following vulnerability has been resolved: workqueue: Put the pwq after detaching the rescuer from the pool The commit 68f83057b913("workqueue: Reap workers via kthread_stop() and remove detach_completion") adds code to reap the norma…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• High 7.8
  CVE-2025-21791

  vrf: use RCU protection in l3mdev_l3_out()

  In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdev_l3_out() l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• High 7.8
  CVE-2025-21826

  netfilter: nf_tables: reject mismatching sum of field_len with set key length

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length The field length description provides the length of each separated key field in the concatenation, each field get…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 6, 2025
• High 7.8
  CVE-2025-21851

  bpf: Fix softlockup in arena_map_free on 64k page kernel

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix softlockup in arena_map_free on 64k page kernel On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y, arena_htab tests cause a segmentation fault and soft lockup. The same failure is no…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 12, 2025
• High 7.8
  CVE-2025-21863

  io_uring: prevent opcode speculation

  In the Linux kernel, the following vulnerability has been resolved: io_uring: prevent opcode speculation sqe->opcode is used for different tables, make sure we santitise it against speculations.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 12, 2025
• High 7.8
  CVE-2025-21864

  tcp: drop secpath at the same time as we currently drop dst

  In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst Xiumei reported hitting the WARN in xfrm6_tunnel_net_exit while running tests that boil down to: - create a pair of netns - run a b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 12, 2025
• High 7.8
  CVE-2025-22056

  netfilter: nft_tunnel: fix geneve_opt type confusion addition

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by o…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 16, 2025
• High 7.8
  CVE-2025-22089

  RDMA/core: Don't expose hw_counters outside of init net namespace

  In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Don't expose hw_counters outside of init net namespace Commit 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes") accidentally almost exposed hw counters to …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• High 7.8
  CVE-2025-22097

  drm/vkms: Fix use after free and double free on init error

  In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it mi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 16, 2025
• High 7.8
  CVE-2025-38000

  sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()

  In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 6, 2025
• High 7.8
  CVE-2025-38116

  wifi: ath12k: fix uaf in ath12k_core_init()

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix uaf in ath12k_core_init() When the execution of ath12k_core_hw_group_assign() or ath12k_core_hw_group_create() fails, the registered notifier chain is not unregistered prope…

  Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  Jul 3, 2025
• High 7.8
  CVE-2025-38127

  ice: fix Tx scheduler error handling in XDP callback

  In the Linux kernel, the following vulnerability has been resolved: ice: fix Tx scheduler error handling in XDP callback When the XDP program is loaded, the XDP callback adds new Tx queues. This means that the callback must update the Tx scheduler with the ne…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 3, 2025
• High 7.8
  CVE-2025-38234

  sched/rt: Fix race in push_rt_task

  In the Linux kernel, the following vulnerability has been resolved: sched/rt: Fix race in push_rt_task Overview ======== When a CPU chooses to call push_rt_task and picks a task to push to another CPU's runqueue then it will call find_lock_lowest_rq method wh…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 4, 2025
• High 7.8
  CVE-2025-38396

  fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass

  In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2025
• High 7.5
  CVE-2022-49670

  linux/dim: Fix divide by 0 in RDMA DIM

  In the Linux kernel, the following vulnerability has been resolved: linux/dim: Fix divide by 0 in RDMA DIM Fix a divide 0 error in rdma_dim_stats_compare() when prev->cpe_ratio == 0. CallTrace: Hardware name: H3C R4900 G3/RS33M2C9S, BIOS 2.00.37P21 03/12/2020…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• High 7.5
  CVE-2024-49864

  rxrpc: Fix a race between socket set up and I/O thread creation

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpc_open_socket(), it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 21, 2024
• High 7.5
  CVE-2024-53090

  afs: Fix lock recursion

  In the Linux kernel, the following vulnerability has been resolved: afs: Fix lock recursion afs_wake_up_async_call() can incur lock recursion. The problem is that it is called from AF_RXRPC whilst holding the ->notify_lock, but it tries to take a ref on the a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 21, 2024
• High 7.5
  CVE-2025-21795

  NFSD: fix hang in nfsd4_shutdown_callback

  In the Linux kernel, the following vulnerability has been resolved: NFSD: fix hang in nfsd4_shutdown_callback If nfs4_client is in courtesy state then there is no point to send the callback. This causes nfsd4_shutdown_callback to hang since cl_cb_inflight is …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 7.5
  CVE-2025-21844

  smb: client: Add check for next_buffer in receive_encrypted_standard()

  In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for next_buffer in receive_encrypted_standard() Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent nul…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 12, 2025
• High 7.3
  CVE-2024-57998

  OPP: add index check to assert to avoid buffer overflow in _read_freq()

  In the Linux kernel, the following vulnerability has been resolved: OPP: add index check to assert to avoid buffer overflow in _read_freq() Pass the freq index to the assert function to make sure we do not read a freq out of the opp->rates[] table when called…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 7.3
  CVE-2025-21647

  sched: sch_cake: add bounds checks to host bulk flow fairness counts

  In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 19, 2025
• High 7.3
  CVE-2025-21839

  KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop Move the conditional loading of hardware DR6 with the guest's DR6 value out of the core .vcpu_run() loop to fix a bug…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 7, 2025
• High 7.1
  CVE-2022-49623

  powerpc/xive/spapr: correct bitmap allocation size

  In the Linux kernel, the following vulnerability has been resolved: powerpc/xive/spapr: correct bitmap allocation size kasan detects access beyond the end of the xibm->bitmap allocation: BUG: KASAN: slab-out-of-bounds in _find_first_zero_bit+0x40/0x140 Read o…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• High 7.1
  CVE-2022-49643

  ima: Fix a potential integer overflow in ima_appraise_measurement

  In the Linux kernel, the following vulnerability has been resolved: ima: Fix a potential integer overflow in ima_appraise_measurement When the ima-modsig is enabled, the rc passed to evm_verifyxattr() may be negative, which may cause the integer overflow prob…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• High 7.1
  CVE-2024-50195

  posix-clock: Fix missing timespec64 check in pc_clock_settime()

  In the Linux kernel, the following vulnerability has been resolved: posix-clock: Fix missing timespec64 check in pc_clock_settime() As Andrew pointed out, it will make sense that the PTP core checked timespec64 struct's tv_sec and tv_nsec range before calling…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 8, 2024
• High 7.1
  CVE-2024-57986

  HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections

  In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections A report in 2019 by the syzbot fuzzer was found to be connected to two errors in the HID core associated w…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• Medium 5.6
  CVE-2024-36350

  A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, po…

  AMD AMD EPYC™ 9005 Series Processors AMD EPYC™ Embedded 9005 Series Processors AMD Ryzen™ 9000 Series Desktop Processors Debian Ubuntu Alpine
  Jul 8, 2025
• Medium 5.6
  CVE-2024-36357

  A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potent…

  AMD AMD EPYC™ 9005 Series Processors AMD EPYC™ Embedded 9005 Series Processors AMD Ryzen™ 9000 Series Desktop Processors Debian Ubuntu Alpine
  Jul 8, 2025
• Medium 5.5
  CVE-2022-49353

  powerpc/papr_scm: don't requests stats with '0' sized stats buffer

  In the Linux kernel, the following vulnerability has been resolved: powerpc/papr_scm: don't requests stats with '0' sized stats buffer Sachin reported [1] that on a POWER-10 lpar he is seeing a kernel panic being reported with vPMEM when papr_scm probe is bei…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Medium 5.5
  CVE-2022-49437

  powerpc/xive: Fix refcount leak in xive_spapr_init

  In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: Fix refcount leak in xive_spapr_init of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Medium 5.5
  CVE-2022-49627

  ima: Fix potential memory leak in ima_init_crypto()

  In the Linux kernel, the following vulnerability has been resolved: ima: Fix potential memory leak in ima_init_crypto() On failure to allocate the SHA1 tfm, IMA fails to initialize and exits without freeing the ima_algo_array. Add the missing kfree() for ima_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Medium 5.5
  CVE-2022-49648

  tracing/histograms: Fix memory leak problem

  In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Fix memory leak problem This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. As commit 46bbe5c671e0 ("tracing: fix double free") said, the "double free" problem r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Medium 5.5
  CVE-2022-49657

  usbnet: fix memory leak in error case

  In the Linux kernel, the following vulnerability has been resolved: usbnet: fix memory leak in error case usbnet_write_cmd_async() mixed up which buffers need to be freed in which error case. v2: add Fixes tag v3: fix uninitialized buf pointer

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Medium 5.5
  CVE-2022-49845

  can: j1939: j1939_send_one(): fix missing CAN header initialization

  In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_send_one(): fix missing CAN header initialization The read access to struct canxl_frame::len inside of a j1939 created skbuff revealed a missing initialization of reserved a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2025
• Medium 5.5
  CVE-2024-56739

  rtc: check if __rtc_read_time was successful in rtc_timer_do_work()

  In the Linux kernel, the following vulnerability has been resolved: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read fr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 29, 2024
• Medium 5.5
  CVE-2024-57987

  Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() If insert an USB dongle which chip is not maintained in ic_id_table, it will hit the NULL point accessed. Add a null point check to a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• Medium 5.5
  CVE-2024-57988

  Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() devm_kstrdup() can return a NULL pointer on failure,but this returned value in btbcm_get_board_name() is not checked. Add NULL check…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• Medium 5.5
  CVE-2024-57989

  wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links In mt7925_change_vif_links() devm_kzalloc() may return NULL but this returned value is not checked.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• Medium 5.5
  CVE-2024-58012

  ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params

  In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params Each cpu DAI should associate with a widget. However, the topology might not create the right number of DAI widgets for agg…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• Medium 5.5
  CVE-2024-58062

  wifi: iwlwifi: mvm: avoid NULL pointer dereference

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: avoid NULL pointer dereference When iterating over the links of a vif, we need to make sure that the pointer is valid (in other words - that the link exists) before derefe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 6, 2025
• Medium 5.5
  CVE-2024-58068

  OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized

  In the Linux kernel, the following vulnerability has been resolved: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized If a driver calls dev_pm_opp_find_bw_ceil/floor() the retrieve bandwidth from the OPP table but the bandwidth table was no…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 6, 2025
• Medium 5.5
  CVE-2024-58088

  bpf: Fix deadlock when freeing cgroup storage

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock when freeing cgroup storage The following commit bc235cdb423a ("bpf: Prevent deadlock from recursive bpf_task_storage_[get|delete]") first introduced deadlock prevention for…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 12, 2025
• Medium 5.5
  CVE-2025-21672

  afs: Fix merge preference rule failure condition

  In the Linux kernel, the following vulnerability has been resolved: afs: Fix merge preference rule failure condition syzbot reported a lock held when returning to userspace[1]. This is because if argc is less than 0 and the function returns directly, the held…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 31, 2025
• Medium 5.5
  CVE-2025-21696

  mm: clear uffd-wp PTE/PMD state on mremap()

  In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap() When mremap()ing a memory region previously registered with userfaultfd as write-protected but without UFFD_FEATURE_EVENT_REMAP, an inconsistency i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 12, 2025
• Medium 5.5
  CVE-2025-21790

  vxlan: check vxlan_vnigroup_init() return value

  In the Linux kernel, the following vulnerability has been resolved: vxlan: check vxlan_vnigroup_init() return value vxlan_init() must check vxlan_vnigroup_init() success otherwise a crash happens later, spotted by syzbot. Oops: general protection fault, proba…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• Medium 5.5
  CVE-2025-21846

  acct: perform last write from workqueue

  In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an inte…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 12, 2025
• Medium 5.5
  CVE-2025-21847

  ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()

  In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 12, 2025
• Medium 5.5
  CVE-2025-21848

  nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()

  In the Linux kernel, the following vulnerability has been resolved: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() Add check for the return value of nfp_app_ctrl_msg_alloc() in nfp_bpf_cmsg_alloc() to prevent null pointer dereference.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 12, 2025
• Medium 5.5
  CVE-2025-21861

  mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()

  In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 12, 2025
• Medium 4.7
  CVE-2022-49443

  list: fix a data-race around ep->rdllist

  In the Linux kernel, the following vulnerability has been resolved: list: fix a data-race around ep->rdllist ep_poll() first calls ep_events_available() with no lock held and checks if ep->rdllist is empty by list_empty_careful(), which reads rdllist->prev. T…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Medium 4.4
  CVE-2024-53052

  io_uring/rw: fix missing NOWAIT check for O_DIRECT start write

  In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write When io_uring starts a write, it'll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happenin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 19, 2024
• Unscored —
  CVE-2022-49024

  can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods

  In the Linux kernel, the following vulnerability has been resolved: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods In m_can_pci_remove() and error handling path of m_can_pci_probe(), m_can_class_free_dev() should be called to free…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 21, 2024
• Unscored —
  CVE-2022-49269

  can: isotp: sanitize CAN ID checks in isotp_bind()

  In the Linux kernel, the following vulnerability has been resolved: can: isotp: sanitize CAN ID checks in isotp_bind() Syzbot created an environment that lead to a state machine status that can not be reached with a compliant CAN ID address configuration. The…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Unscored —
  CVE-2022-49357

  efi: Do not import certificates from UEFI Secure Boot for T2 Macs

  In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T2 Macs On Apple T2 Macs, when Linux attempts to read the db and dbx efi variables at early boot to load UEFI Secure Boot certificate…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Unscored —
  CVE-2022-49432

  powerpc/xics: fix refcount leak in icp_opal_init()

  In the Linux kernel, the following vulnerability has been resolved: powerpc/xics: fix refcount leak in icp_opal_init() The of_find_compatible_node() function returns a node pointer with refcount incremented, use of_node_put() on it when done.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Unscored —
  CVE-2022-50143

  intel_th: Fix a resource leak in an error handling path

  In the Linux kernel, the following vulnerability has been resolved: intel_th: Fix a resource leak in an error handling path If an error occurs after calling 'pci_alloc_irq_vectors()', 'pci_free_irq_vectors()' must be called as already done in the remove funct…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• Unscored —
  CVE-2022-50504

  powerpc/rtas: avoid scheduling in rtas_os_term()

  In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: avoid scheduling in rtas_os_term() It's unsafe to use rtas_busy_delay() to handle a busy status from the ibm,os-term RTAS function in rtas_os_term(): Kernel panic - not syncing:…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-52941

  can: isotp: split tx timer into transmission and timeout

  In the Linux kernel, the following vulnerability has been resolved: can: isotp: split tx timer into transmission and timeout The timer for the transmission of isotp PDUs formerly had two functions: 1. send two consecutive frames with a given time gap 2. monit…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Unscored —
  CVE-2023-54119

  inotify: Avoid reporting event with invalid wd

  In the Linux kernel, the following vulnerability has been resolved: inotify: Avoid reporting event with invalid wd When inotify_freeing_mark() races with inotify_handle_inode_event() it can happen that inotify_handle_inode_event() sees that i_mark->wd got alr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54152

  can: j1939: prevent deadlock by moving j1939_sk_errqueue()

  In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by moving j1939_sk_errqueue() This commit addresses a deadlock situation that can occur in certain scenarios, such as when running data TP/ETP transfer and subscr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2024-46689

  soc: qcom: cmd-db: Map shared memory as WC, not WB

  In the Linux kernel, the following vulnerability has been resolved: soc: qcom: cmd-db: Map shared memory as WC, not WB Linux does not write into cmd-db region. This region of memory is write protected by XPU. XPU may sometime falsely detect clean cache evicti…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 13, 2024
• Unscored —
  CVE-2024-46744

  Squashfs: sanity check symbolic link size

  In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbol…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 18, 2024
• Unscored —
  CVE-2024-50060

  io_uring: check if we need to reschedule during overflow flush

  In the Linux kernel, the following vulnerability has been resolved: io_uring: check if we need to reschedule during overflow flush In terms of normal application usage, this list will always be empty. And if an application does overflow a bit, it'll have a fe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 21, 2024
• Unscored —
  CVE-2024-52332

  igb: Fix potential invalid memory access in igb_init_module()

  In the Linux kernel, the following vulnerability has been resolved: igb: Fix potential invalid memory access in igb_init_module() The pci_register_driver() can fail and when this happened, the dca_notifier needs to be unregistered, otherwise the dca_notifier …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 11, 2025
• Unscored —
  CVE-2024-53119

  virtio/vsock: Fix accept_queue memory leak

  In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Fix accept_queue memory leak As the final stages of socket destruction may be delayed, it is possible that virtio_transport_recv_listen() will be called after the accept_queue h…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 2, 2024
• Unscored —
  CVE-2024-53229

  RDMA/rxe: Fix the qp flush warnings in req

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the qp flush warnings in req When the qp is in error state, the status of WQEs in the queue should be set to error. Or else the following will appear. [ 920.617269] WARNING: CPU…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 27, 2024
• Unscored —
  CVE-2024-53241

  x86/xen: don't do PV iret hypercall through hypercall page

  In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2024
• Unscored —
  CVE-2024-53680

  ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()

  In the Linux kernel, the following vulnerability has been resolved: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() Under certain kernel configurations when building with Clang/LLVM, the compiler does not generate a return or jump as t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 11, 2025
• Unscored —
  CVE-2024-56690

  crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY

  In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY Since commit 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for PADATA_RESET"), the pcrypt encryption and dec…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 28, 2024
• Unscored —
  CVE-2024-56786 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Jan 8, 2025
• Unscored —
  CVE-2024-57981

  usb: xhci: Fix NULL pointer dereference on certain command aborts

  In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix NULL pointer dereference on certain command aborts If a command is queued to the final usable TRB of a ring segment, the enqueue pointer is advanced to the subsequent link TRB …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• Unscored —
  CVE-2024-57993

  HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check

  In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check syzbot has found a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• Unscored —
  CVE-2024-58014

  wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()

  In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() In 'wlc_phy_iqcal_gainparams_nphy()', add gain range check to WARN() instead of possible out-of-bounds 'tbl_iqcal_gainp…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• Unscored —
  CVE-2024-58015

  wifi: ath12k: Fix for out-of bound access error

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix for out-of bound access error Selfgen stats are placed in a buffer using print_array_to_buf_index() function. Array length parameter passed to the function is too big, resul…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• Unscored —
  CVE-2024-58057

  idpf: convert workqueues to unbound

  In the Linux kernel, the following vulnerability has been resolved: idpf: convert workqueues to unbound When a workqueue is created with `WQ_UNBOUND`, its work items are served by special worker-pools, whose host workers are not bound to any specific CPU. In …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 6, 2025
• Unscored —
  CVE-2024-58072

  wifi: rtlwifi: remove unused check_buddy_priv

  In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: remove unused check_buddy_priv Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global list of private data structures. Later on, commit 26634c4b1868 ("rtlwifi …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 6, 2025
• Unscored —
  CVE-2024-58077

  ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback

  In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 6, 2025
• Unscored —
  CVE-2025-21648

  netfilter: conntrack: clamp maximum hashtable size to INT_MAX

  In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 19, 2025
• Unscored —
  CVE-2025-21691

  cachestat: fix page cache statistics permission checking

  In the Linux kernel, the following vulnerability has been resolved: cachestat: fix page cache statistics permission checking When the 'cachestat()' system call was added in commit cf264e1329fb ("cachestat: implement cachestat syscall"), it was meant to be a m…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 10, 2025
• Unscored —
  CVE-2025-21728

  bpf: Send signals asynchronously if !preemptible

  In the Linux kernel, the following vulnerability has been resolved: bpf: Send signals asynchronously if !preemptible BPF programs can execute in all kinds of contexts and when a program running in a non-preemptible context uses the bpf_send_signal() kfunc, it…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• Unscored —
  CVE-2025-21745

  blk-cgroup: Fix class @block_class's subsystem refcount leakage

  In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix class @block_class's subsystem refcount leakage blkcg_fill_root_iostats() iterates over @block_class's devices by class_dev_iter_(init|next)(), but does not end iterating with…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• Unscored —
  CVE-2025-21746

  Input: synaptics - fix crash when enabling pass-through port

  In the Linux kernel, the following vulnerability has been resolved: Input: synaptics - fix crash when enabling pass-through port When enabling a pass-through port an interrupt might come before psmouse driver binds to the pass-through port. However synaptics …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• Unscored —
  CVE-2025-21787

  team: better TEAM_OPTION_TYPE_STRING validation

  In the Linux kernel, the following vulnerability has been resolved: team: better TEAM_OPTION_TYPE_STRING validation syzbot reported following splat [1] Make sure user-provided data contains one nul byte. [1] BUG: KMSAN: uninit-value in string_nocheck lib/vspr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• Unscored —
  CVE-2025-21806

  net: let net.core.dev_weight always be non-zero

  In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encountered during stability test: (NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ returned 1, exce…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• Unscored —
  CVE-2025-21837 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Mar 7, 2025
• Unscored —
  CVE-2025-21853

  bpf: avoid holding freeze_mutex during mmap operation

  In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freeze_mutex during mmap operation We use map->freeze_mutex to prevent races between map_freeze() and memory mapping BPF map contents with writable permissions. The way we …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 12, 2025
• Unscored —
  CVE-2025-21902

  acpi: typec: ucsi: Introduce a ->poll_cci method

  In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 1, 2025
• Unscored —
  CVE-2025-22092

  PCI: Fix NULL dereference in SR-IOV VF creation error path

  In the Linux kernel, the following vulnerability has been resolved: PCI: Fix NULL dereference in SR-IOV VF creation error path Clean up when virtfn setup fails to prevent NULL pointer dereference during device removal. The kernel oops below occurred due to in…

  Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  Apr 16, 2025
• Unscored —
  CVE-2025-22111

  net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

  In the Linux kernel, the following vulnerability has been resolved: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to br_ioctl_call(), which causes unnecessary RTNL dance and the splat be…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 16, 2025
• Unscored —
  CVE-2025-22116

  idpf: check error for register_netdev() on init

  In the Linux kernel, the following vulnerability has been resolved: idpf: check error for register_netdev() on init Current init logic ignores the error code from register_netdev(), which will cause WARN_ON() on attempt to unregister it, if there was one, and…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• Unscored —
  CVE-2025-22119

  wifi: cfg80211: init wiphy_work before allocating rfkill fails

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: init wiphy_work before allocating rfkill fails syzbort reported a uninitialize wiphy_work_lock in cfg80211_dev_free. [1] After rfkill allocation fails, the wiphy release proce…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• Unscored —
  CVE-2025-23129

  wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path If a shared IRQ is used by the driver due to platform limitation, then the IRQ affinity hint is set right…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• Unscored —
  CVE-2025-37825

  nvmet: fix out-of-bounds access in nvmet_enable_port

  In the Linux kernel, the following vulnerability has been resolved: nvmet: fix out-of-bounds access in nvmet_enable_port When trying to enable a port that has no transport configured yet, nvmet_enable_port() uses NVMF_TRTYPE_MAX (255) to query the transports …

  Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  May 8, 2025
• Unscored —
  CVE-2025-37994

  usb: typec: ucsi: displayport: Fix NULL pointer access

  In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix NULL pointer access This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before pr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 29, 2025
• Unscored —
  CVE-2025-38013

  wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• Unscored —
  CVE-2025-38288

  scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels

  In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels Correct kernel call trace when calling smp_processor_id() when called in preemptible kernels by using raw_smp_process…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 10, 2025
• Unscored —
  CVE-2025-38322

  perf/x86/intel: Fix crash in icl_update_topdown_event()

  In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400:…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 10, 2025
• Unscored —
  CVE-2025-38332

  scsi: lpfc: Use memcpy() for BIOS version

  In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 10, 2025
• Unscored —
  CVE-2025-38438

  ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.

  In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. sof_pdata->tplg_filename can have address allocated by kstrdup() and can be overwritten. Memory leak was detected with kmemleak: un…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 25, 2025
• Unscored —
  CVE-2026-23146

  Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 14, 2026
• Unscored —
  CVE-2026-23205

  smb/client: fix memory leak in smb2_open_file()

  In the Linux kernel, the following vulnerability has been resolved: smb/client: fix memory leak in smb2_open_file() Reproducer: 1. server: directories are exported read-only 2. client: mount -t cifs //${server_ip}/export /mnt 3. client: dd if=/dev/zero of=/mn…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 14, 2026

References

• article
  https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.7_release_notes/index
• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2298169
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2312077
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2313092
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2320172
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2320259
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2320455
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2320616
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2320722
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2324549
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2327203
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2327374
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2327887
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2329918
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2330341
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2331326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334357
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334396
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334415
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334439
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334537
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334547
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334548
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334560
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334676
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334795
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334829
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2336541
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2337121
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2337124
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2338814
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2338828
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2338832
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2343172
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2343175
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2344684
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2344687
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2345240