Skip to content
OpenAdvisories
Critical RHSA-2025:21667 20 CVEs

Red Hat Security Advisory: kernel security update

Published Nov 19, 2025 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 24

ReleasePackageFixed in
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos bpftool 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos bpftool-debuginfo 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-abi-whitelists 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-core 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-core 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-debuginfo 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-devel 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-modules 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-modules-extra 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debuginfo 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debuginfo-common-x86_64 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-devel 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-doc 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-modules 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-modules-extra 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-tools 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-tools-debuginfo 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-tools-libs 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos perf 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos perf-debuginfo 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos python3-perf 0:4.18.0-193.173.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos python3-perf-debuginfo 0:4.18.0-193.173.1.el8_2

Vulnerabilities 20

  • Critical 9.8
    CVE-2024-58240

    tls: separate no-async decryption request handling from async

    In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-38211

    RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

    In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-38527

    smb: client: fix use-after-free in cifs_oplock_break

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break()…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2022-50087

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails

    In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the pro…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-37797

    net_sched: hfsc: Fix a UAF vulnerability in class handling

    In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-us…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38085

    mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race

    In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38449

    drm/gem: Acquire references on GEM handles for framebuffers

    In the Linux kernel, the following vulnerability has been resolved: drm/gem: Acquire references on GEM handles for framebuffers A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38477

    net/sched: sch_qfq: Fix race condition on qfq_aggregate

    In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurren…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38498

    do_change_type(): refuse to operate on unmounted/not ours mounts

    In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns pe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-49969

    drm/amd/display: clear optc underflow before turn off odm clock

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: clear optc underflow before turn off odm clock [Why] After ODM clock off, optc underflow bit will be kept there always and clear not work. We need to clear that before clock …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-50228

    KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0

    In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KV…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-50229

    ALSA: bcd2000: Fix a UAF bug on the error path of probing

    In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix a UAF bug on the error path of probing When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53125

    net: usb: smsc75xx: Limit packet length to skb->len

    In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Limit packet length to skb->len Packet length retrieved from skb data may be larger than the actual socket buffer length (up to 9026 bytes). In such case the cloned skb pa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-22026

    nfsd: don't ignore the return code of svc_proc_register()

    In the Linux kernel, the following vulnerability has been resolved: nfsd: don't ignore the return code of svc_proc_register() Currently, nfsd_proc_stat_init() ignores the return value of svc_proc_register(). If the procfile creation fails, then the kernel wil…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38159

    wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds

    In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', whi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38200

    i40e: fix MMIO write access to an invalid page in i40e_clear_hw

    In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page. Preven…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38332

    scsi: lpfc: Use memcpy() for BIOS version

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38556

    HID: core: Harden s32ton() against conversion to 0 bits

    In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39730

    NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()

    In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39751 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2360224
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2363672
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2363686
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373460
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373529
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373539
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373635
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2375304
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376064
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376392
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376406
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2379246
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383519
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383922
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2384422
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2388928
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2389456
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2391431
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393731
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2394624
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21667.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-49969
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-49969
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-49969
  • article
    https://lore.kernel.org/linux-cve-announce/2025061816-CVE-2022-49969-fd54@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2022-50087
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-50087
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-50087
  • article
    https://lore.kernel.org/linux-cve-announce/2025061859-CVE-2022-50087-53b1@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2022-50228
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-50228
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-50228
  • article
    https://lore.kernel.org/linux-cve-announce/2025061849-CVE-2022-50228-3904@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2022-50229
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-50229
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-50229
  • article
    https://lore.kernel.org/linux-cve-announce/2025061850-CVE-2022-50229-702e@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-53125