Red Hat Security Advisory: kernel security update

Fixed packages 81

Vulnerabilities 18

• Critical 9.8
  CVE-2022-50410

  NFSD: Protect against send buffer overflow in NFSv2 READ

  In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffer…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• High 8.8
  CVE-2022-50386

  Bluetooth: L2CAP: Fix user-after-free

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• High 8.8
  CVE-2023-53297

  Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balan…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• High 7.8
  CVE-2022-50341

  cifs: fix oops during encryption

  In the Linux kernel, the following vulnerability has been resolved: cifs: fix oops during encryption When running xfstests against Azure the following oops occurred on an arm64 system Unable to handle kernel write to read-only memory at virtual address ffff00…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• High 7.8
  CVE-2023-53354

  skbuff: skb_segment, Call zero copy functions before using skbuff frags

  In the Linux kernel, the following vulnerability has been resolved: skbuff: skb_segment, Call zero copy functions before using skbuff frags Commit bf5c25d60861 ("skbuff: in skb_segment, call zerocopy functions once per nskb") added the call to zero copy funct…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• High 7.8
  CVE-2025-38718

  sctp: linearize cloned gso packets in sctp_rcv

  In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2025
• High 7.8
  CVE-2025-39697

  NFS: Fix a race when updating an existing write

  In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 5, 2025
• High 7.1
  CVE-2023-53257

  wifi: mac80211: check S1G action frame size

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check S1G action frame size Before checking the action code, check that it even exists in the frame.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Medium 5.5
  CVE-2022-50356

  net: sched: sfb: fix null pointer access issue when sfb_init() fails

  In the Linux kernel, the following vulnerability has been resolved: net: sched: sfb: fix null pointer access issue when sfb_init() fails When the default qdisc is sfb, if the qdisc of dev_queue fails to be inited during mqprio_init(), sfb_reset() is invoked t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• Medium 5.5
  CVE-2023-53365

  ip6mr: Fix skb_under_panic in ip6mr_cache_report()

  In the Linux kernel, the following vulnerability has been resolved: ip6mr: Fix skb_under_panic in ip6mr_cache_report() skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ---…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• Medium 5.5
  CVE-2023-53393

  RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device Currently, when mlx5_ib_get_hw_stats() is used for device (port_num = 0), there is a special handling in order to use the correct coun…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• Unscored —
  CVE-2022-50403 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Sep 18, 2025
• Unscored —
  CVE-2023-53232

  mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data

  In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data The MT7921 driver no longer uses eeprom.data, but the relevant code has not been removed completely since commit 16d98b5483…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2024-46679

  ethtool: check device is present when getting link settings

  In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 13, 2024
• Unscored —
  CVE-2025-38729

  ALSA: usb-audio: Validate UAC3 power domain descriptors, too

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2025
• Unscored —
  CVE-2025-39757

  ALSA: usb-audio: Validate UAC3 cluster segment descriptors

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2025
• Unscored —
  CVE-2025-39883

  mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory

  In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory When I did memory failure tests, below panic occurs: page dumped because: VM_BUG_ON_PAGE(PagePoisoned(page)) ker…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 23, 2025
• Unscored —
  CVE-2025-40300

  x86/vmscape: Add conditional IBPB mitigation

  In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2312067
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393164
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393166
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393481
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2394615
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2394627
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395253
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395322
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395681
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395879
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396130
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396152
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396158
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396376
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396494
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396536
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2397553
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22006.json
• report
  https://access.redhat.com/security/cve/CVE-2022-50341
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50341
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50341
• article
  https://lore.kernel.org/linux-cve-announce/2025091638-CVE-2022-50341-12c1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-50356
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50356
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50356
• article
  https://lore.kernel.org/linux-cve-announce/2025091714-CVE-2022-50356-fe76@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-50386
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50386
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50386
• article
  https://lore.kernel.org/linux-cve-announce/2025091852-CVE-2022-50386-07d7@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-50403
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50403
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50403
• article
  https://lore.kernel.org/linux-cve-announce/2025091852-CVE-2022-50403-0471@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-50410
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50410
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50410