Red Hat Security Advisory: kernel security update

Fixed packages 158

Vulnerabilities 8

• Critical 9.8
  CVE-2025-38724

  nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

  In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SE…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2025
• High 8.8
  CVE-2025-39864

  wifi: cfg80211: fix use-after-free in cmp_bss()

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bs…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 19, 2025
• High 8.8
  CVE-2025-39918

  wifi: mt76: fix linked list corruption

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix linked list corruption Never leave scheduled wcid entries on the temporary on-stack list

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• High 8.8
  CVE-2025-40058

  iommu/vt-d: Disallow dirty tracking if incoherent page walk

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succ…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 28, 2025
• High 7.8
  CVE-2025-39981

  Bluetooth: MGMT: Fix possible UAFs

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible UAFs This attemps to fix possible UAFs caused by struct mgmt_pending being freed while still being processed like in the following trace, in order to fix mgmt_pe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 15, 2025
• Unscored —
  CVE-2025-39898 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2025-39955

  tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().

  In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported the splat below where a socket had tcp_sk(sk)->fastopen_rsk in the TCP_ESTABLISHED state. [0] syzbot reused the server…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 9, 2025
• Unscored —
  CVE-2025-40185

  ice: ice_adapter: release xa entry on adapter allocation failure

  In the Linux kernel, the following vulnerability has been resolved: ice: ice_adapter: release xa entry on adapter allocation failure When ice_adapter_new() fails, the reserved XArray entry created by xa_insert() is not released. This causes subsequent inserti…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Nov 12, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393172
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396934
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2400598
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2400628
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2402699
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2404105
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2406776
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414741
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22405.json
• report
  https://access.redhat.com/security/cve/CVE-2025-38724
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38724
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38724
• article
  https://lore.kernel.org/linux-cve-announce/2025090401-CVE-2025-38724-5309@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-39864
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39864
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39864
• article
  https://lore.kernel.org/linux-cve-announce/2025091906-CVE-2025-39864-a3a2@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-39898
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39898
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39898
• article
  https://lore.kernel.org/linux-cve-announce/2025100116-CVE-2025-39898-d844@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-39918
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39918
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39918
• article
  https://lore.kernel.org/linux-cve-announce/2025100119-CVE-2025-39918-7902@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-39955
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39955
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39955
• article
  https://lore.kernel.org/linux-cve-announce/2025100942-CVE-2025-39955-f36b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-39981
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39981
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39981
• article
  https://lore.kernel.org/linux-cve-announce/2025101559-CVE-2025-39981-fe1d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40058
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40058
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40058
• article
  https://lore.kernel.org/linux-cve-announce/2025102815-CVE-2025-40058-0eba@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40185