Red Hat Security Advisory: kernel security update

Fixed packages 47

Vulnerabilities 23

• Critical 9.8
  CVE-2025-39702

  ipv6: sr: Fix MAC comparison to be constant-time

  In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 5, 2025
• High 8.8
  CVE-2022-50386

  Bluetooth: L2CAP: Fix user-after-free

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• High 8.8
  CVE-2023-53226

  wifi: mwifiex: Fix OOB and integer underflow when rx packets

  In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix OOB and integer underflow when rx packets Make sure mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, mwifiex_uap_queue_bridged_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• High 8.8
  CVE-2023-53305

  Bluetooth: L2CAP: Fix use-after-free

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free Fix potential use-after-free in l2cap_le_command_rej.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• High 8.1
  CVE-2023-53213

  wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()

  In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Fix a slab-out-of-bounds read that occurs in kmemdup() called from brcmf_get_assoc_ies(). The bug could occur when assoc_info-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• High 7.8
  CVE-2022-50367

  fs: fix UAF/GPF bug in nilfs_mdt_destroy

  In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_m…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• High 7.8
  CVE-2022-50406

  iomap: iomap: fix memory corruption when recording errors during writeback

  In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• High 7.8
  CVE-2022-50408

  wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()

  In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() > ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb); may be schedule, and then complete before the line > ndev->stats.…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• High 7.8
  CVE-2023-53178

  mm: fix zswap writeback race condition

  In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was wri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 15, 2025
• High 7.8
  CVE-2023-53331

  pstore/ram: Check start of empty przs during init

  In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Check start of empty przs during init After commit 30696378f68a ("pstore/ram: Do not treat empty buffers as valid"), initialization would assume a prz was valid after seeing that …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• High 7.8
  CVE-2023-53354

  skbuff: skb_segment, Call zero copy functions before using skbuff frags

  In the Linux kernel, the following vulnerability has been resolved: skbuff: skb_segment, Call zero copy functions before using skbuff frags Commit bf5c25d60861 ("skbuff: in skb_segment, call zerocopy functions once per nskb") added the call to zero copy funct…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• High 7.8
  CVE-2023-53386

  Bluetooth: Fix potential use-after-free when clear keys

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix potential use-after-free when clear keys Similar to commit c5d2b6fa26b5 ("Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk"). We can not access k after kfree_rcu(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• High 7.8
  CVE-2023-53494

  crypto: xts - Handle EBUSY correctly

  In the Linux kernel, the following vulnerability has been resolved: crypto: xts - Handle EBUSY correctly As it is xts only handles the special return value of EINPROGRESS, which means that in all other cases it will free data related to the request. However, …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• High 7.8
  CVE-2025-38550

  ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() return.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 16, 2025
• High 7.8
  CVE-2025-38718

  sctp: linearize cloned gso packets in sctp_rcv

  In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2025
• High 7.8
  CVE-2025-39697

  NFS: Fix a race when updating an existing write

  In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 5, 2025
• High 7.1
  CVE-2023-53257

  wifi: mac80211: check S1G action frame size

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check S1G action frame size Before checking the action code, check that it even exists in the frame.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Medium 5.5
  CVE-2022-50356

  net: sched: sfb: fix null pointer access issue when sfb_init() fails

  In the Linux kernel, the following vulnerability has been resolved: net: sched: sfb: fix null pointer access issue when sfb_init() fails When the default qdisc is sfb, if the qdisc of dev_queue fails to be inited during mqprio_init(), sfb_reset() is invoked t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• Medium 4.7
  CVE-2023-53401

  mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()

  In the Linux kernel, the following vulnerability has been resolved: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference: …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 18, 2025
• Unscored —
  CVE-2022-48701

  ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less tha…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 3, 2024
• Unscored —
  CVE-2023-53185

  wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes A bad USB device is able to construct a service connection response message with target endpoint being ENDPOINT0 which is reserved f…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2023-53232

  mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data

  In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data The MT7921 driver no longer uses eeprom.data, but the relevant code has not been removed completely since commit 16d98b5483…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2025-39730

  NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()

  In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 7, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278950
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2388941
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393166
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393481
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393533
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393731
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395253
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395267
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395297
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395322
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395358
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395420
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395858
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395880
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396114
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396152
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396158
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396417
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396419
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396506
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396538
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2400777
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21091.json
• report
  https://access.redhat.com/security/cve/CVE-2022-48701
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48701
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48701
• report
  https://access.redhat.com/security/cve/CVE-2022-50356
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50356
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50356
• article
  https://lore.kernel.org/linux-cve-announce/2025091714-CVE-2022-50356-fe76@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-50367
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50367
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50367
• article
  https://lore.kernel.org/linux-cve-announce/2025091716-CVE-2022-50367-651c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-50386
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50386
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50386