Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 9

• Critical 9.8
  CVE-2025-39702

  ipv6: sr: Fix MAC comparison to be constant-time

  In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 5, 2025
• High 8.8
  CVE-2025-39849

  wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checkin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 19, 2025
• High 7.8
  CVE-2023-53494

  crypto: xts - Handle EBUSY correctly

  In the Linux kernel, the following vulnerability has been resolved: crypto: xts - Handle EBUSY correctly As it is xts only handles the special return value of EINPROGRESS, which means that in all other cases it will free data related to the request. However, …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• High 7.8
  CVE-2025-38718

  sctp: linearize cloned gso packets in sctp_rcv

  In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2025
• High 7.8
  CVE-2025-39697

  NFS: Fix a race when updating an existing write

  In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 5, 2025
• High 7.1
  CVE-2025-39817

  efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

  In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2025
• Unscored —
  CVE-2025-38729

  ALSA: usb-audio: Validate UAC3 power domain descriptors, too

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2025
• Unscored —
  CVE-2025-39757

  ALSA: usb-audio: Validate UAC3 cluster segment descriptors

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2025
• Unscored —
  CVE-2025-40300

  x86/vmscape: Add conditional IBPB mitigation

  In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393164
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393166
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393481
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393533
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2394615
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2394627
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395805
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396928
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2400777
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21760.json
• report
  https://access.redhat.com/security/cve/CVE-2023-53494
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53494
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53494
• article
  https://lore.kernel.org/linux-cve-announce/2025100124-CVE-2023-53494-6542@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38718
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38718
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38718
• article
  https://lore.kernel.org/linux-cve-announce/2025090459-CVE-2025-38718-5bb6@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38729
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38729
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38729
• article
  https://lore.kernel.org/linux-cve-announce/2025090403-CVE-2025-38729-ca88@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-39697
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39697
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39697
• article
  https://lore.kernel.org/linux-cve-announce/2025090548-CVE-2025-39697-5284@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-39702
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39702
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39702
• article
  https://lore.kernel.org/linux-cve-announce/2025090548-CVE-2025-39702-cb30@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-39757
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39757
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39757
• article
  https://lore.kernel.org/linux-cve-announce/2025091144-CVE-2025-39757-e212@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-39817
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39817
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39817
• article
  https://lore.kernel.org/linux-cve-announce/2025091615-CVE-2025-39817-90b7@gregkh/T