Red Hat Security Advisory: kernel security update

Fixed packages 158

Vulnerabilities 13

• Critical 9.8
  CVE-2025-38566

  sunrpc: fix handling of server side tls alerts

  In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kv…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 19, 2025
• Critical 9.8
  CVE-2025-39702

  ipv6: sr: Fix MAC comparison to be constant-time

  In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 5, 2025
• Critical 9.8
  CVE-2025-39841

  scsi: lpfc: Fix buffer free/clear order in deferred receive path

  In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buff…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 19, 2025
• High 8.8
  CVE-2025-39849

  wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checkin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 19, 2025
• High 8.4
  CVE-2025-39718

  vsock/virtio: Validate length in packet header before skb_put()

  In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unf…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 5, 2025
• High 8.2
  CVE-2025-38571

  sunrpc: fix client side handling of tls alerts

  In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kv…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 19, 2025
• High 7.8
  CVE-2022-50087

  firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails

  In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the pro…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• High 7.8
  CVE-2022-50367

  fs: fix UAF/GPF bug in nilfs_mdt_destroy

  In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_m…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• High 7.8
  CVE-2023-53331

  pstore/ram: Check start of empty przs during init

  In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Check start of empty przs during init After commit 30696378f68a ("pstore/ram: Do not treat empty buffers as valid"), initialization would assume a prz was valid after seeing that …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• High 7.8
  CVE-2023-53373

  crypto: seqiv - Handle EBUSY correctly

  In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. Howev…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• High 7.8
  CVE-2023-53494

  crypto: xts - Handle EBUSY correctly

  In the Linux kernel, the following vulnerability has been resolved: crypto: xts - Handle EBUSY correctly As it is xts only handles the special return value of EINPROGRESS, which means that in all other cases it will free data related to the request. However, …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• High 7.1
  CVE-2025-39817

  efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

  In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2025
• Unscored —
  CVE-2025-40300

  x86/vmscape: Add conditional IBPB mitigation

  In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373539
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2389480
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2389487
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393507
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393533
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2394627
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395805
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395880
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396114
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396928
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396944
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2400777
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21112.json
• report
  https://access.redhat.com/security/cve/CVE-2022-50087
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50087
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50087
• article
  https://lore.kernel.org/linux-cve-announce/2025061859-CVE-2022-50087-53b1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-50367
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50367
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50367
• article
  https://lore.kernel.org/linux-cve-announce/2025091716-CVE-2022-50367-651c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53331
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53331
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53331
• article
  https://lore.kernel.org/linux-cve-announce/2025091645-CVE-2023-53331-50a3@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53373
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53373
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53373
• article
  https://lore.kernel.org/linux-cve-announce/2025091855-CVE-2023-53373-087e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53494
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53494
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53494
• article
  https://lore.kernel.org/linux-cve-announce/2025100124-CVE-2023-53494-6542@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38566
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38566
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38566
• article
  https://lore.kernel.org/linux-cve-announce/2025081908-CVE-2025-38566-edef@gregkh/T