Skip to content
OpenAdvisories
Critical RHSA-2025:22752 41 CVEs

Red Hat Security Advisory: kernel security update

Published Dec 5, 2025 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 48

ReleasePackageFixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos bpftool 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos bpftool-debuginfo 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-abi-stablelists 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-core 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-core 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-debuginfo 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-devel 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-modules 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debug-modules-extra 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debuginfo 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-debuginfo-common-x86_64 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-devel 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-doc 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-modules 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-modules-extra 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-tools 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-tools-debuginfo 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos kernel-tools-libs 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos perf 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos perf-debuginfo 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos python3-perf 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos python3-perf-debuginfo 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos bpftool 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos bpftool-debuginfo 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-abi-stablelists 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-core 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-core 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-debuginfo 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-devel 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-modules 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debug-modules-extra 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debuginfo 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-debuginfo-common-x86_64 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-devel 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-doc 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-modules 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-modules-extra 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-tools 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-tools-debuginfo 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos kernel-tools-libs 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos perf 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos perf-debuginfo 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos python3-perf 0:4.18.0-305.179.1.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos python3-perf-debuginfo 0:4.18.0-305.179.1.el8_4

Vulnerabilities 41

  • Critical 9.8
    CVE-2022-50410

    NFSD: Protect against send buffer overflow in NFSv2 READ

    In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2024-58240

    tls: separate no-async decryption request handling from async

    In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-38211

    RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

    In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-38527

    smb: client: fix use-after-free in cifs_oplock_break

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break()…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2022-50386

    Bluetooth: L2CAP: Fix user-after-free

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2023-53305

    Bluetooth: L2CAP: Fix use-after-free

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free Fix potential use-after-free in l2cap_le_command_rej.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2025-39864

    wifi: cfg80211: fix use-after-free in cmp_bss()

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bs…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2023-53213

    wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Fix a slab-out-of-bounds read that occurs in kmemdup() called from brcmf_get_assoc_ies(). The bug could occur when assoc_info-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-49985

    bpf: Don't use tnum_range on array range checking for poke descriptors

    In the Linux kernel, the following vulnerability has been resolved: bpf: Don't use tnum_range on array range checking for poke descriptors Hsin-Wei reported a KASAN splat triggered by their BPF runtime fuzzer which is based on a customized syzkaller: BUG: KAS…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-50070

    mptcp: do not queue data on closed subflows

    In the Linux kernel, the following vulnerability has been resolved: mptcp: do not queue data on closed subflows Dipanjan reported a syzbot splat at close time: WARNING: CPU: 1 PID: 10818 at net/ipv4/af_inet.c:153 inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_ine…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2022-50087

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails

    In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the pro…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-50367

    fs: fix UAF/GPF bug in nilfs_mdt_destroy

    In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_m…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-50408

    wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() > ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb); may be schedule, and then complete before the line > ndev->stats.…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2023-53178

    mm: fix zswap writeback race condition

    In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was wri…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-53354

    skbuff: skb_segment, Call zero copy functions before using skbuff frags

    In the Linux kernel, the following vulnerability has been resolved: skbuff: skb_segment, Call zero copy functions before using skbuff frags Commit bf5c25d60861 ("skbuff: in skb_segment, call zerocopy functions once per nskb") added the call to zero copy funct…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2023-53373

    crypto: seqiv - Handle EBUSY correctly

    In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. Howev…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2023-53386

    Bluetooth: Fix potential use-after-free when clear keys

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix potential use-after-free when clear keys Similar to commit c5d2b6fa26b5 ("Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk"). We can not access k after kfree_rcu(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-37797

    net_sched: hfsc: Fix a UAF vulnerability in class handling

    In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-us…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-37914

    net_sched: ets: Fix double list add in class with netem as child qdisc

    In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38449

    drm/gem: Acquire references on GEM handles for framebuffers

    In the Linux kernel, the following vulnerability has been resolved: drm/gem: Acquire references on GEM handles for framebuffers A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38477

    net/sched: sch_qfq: Fix race condition on qfq_aggregate

    In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when 'agg' is modified in qfq_change_agg (called during qfq_enqueue) while other threads access it concurren…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38498

    do_change_type(): refuse to operate on unmounted/not ours mounts

    In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns pe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39697

    NFS: Fix a race when updating an existing write

    In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2025-38461

    vsock: Fix transport_* TOCTOU

    In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_* TOCTOU Transport assignment may race with module unload. Protect new_transport from becoming a stale pointer. This also takes care of an insecure call in vsock_use_loca…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2022-50356

    net: sched: sfb: fix null pointer access issue when sfb_init() fails

    In the Linux kernel, the following vulnerability has been resolved: net: sched: sfb: fix null pointer access issue when sfb_init() fails When the default qdisc is sfb, if the qdisc of dev_queue fails to be inited during mqprio_init(), sfb_reset() is invoked t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48701

    ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less tha…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-49969

    drm/amd/display: clear optc underflow before turn off odm clock

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: clear optc underflow before turn off odm clock [Why] After ODM clock off, optc underflow bit will be kept there always and clear not work. We need to clear that before clock …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-50050

    ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf()

    In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() snprintf() returns the would-be-filled size when the string overflows the given buffer size, hence using this value may resu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-50211

    md-raid10: fix KASAN warning

    In the Linux kernel, the following vulnerability has been resolved: md-raid10: fix KASAN warning There's a KASAN warning in raid10_remove_disk when running the lvm test lvconvert-raid-reshape.sh. We fix this warning by verifying that the value "number" is val…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-50228

    KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0

    In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KV…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-50229

    ALSA: bcd2000: Fix a UAF bug on the error path of probing

    In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix a UAF bug on the error path of probing When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-50403 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2023-53125

    net: usb: smsc75xx: Limit packet length to skb->len

    In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Limit packet length to skb->len Packet length retrieved from skb data may be larger than the actual socket buffer length (up to 9026 bytes). In such case the cloned skb pa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-53185

    wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes A bad USB device is able to construct a service connection response message with target endpoint being ENDPOINT0 which is reserved f…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-22026

    nfsd: don't ignore the return code of svc_proc_register()

    In the Linux kernel, the following vulnerability has been resolved: nfsd: don't ignore the return code of svc_proc_register() Currently, nfsd_proc_stat_init() ignores the return value of svc_proc_register(). If the procfile creation fails, then the kernel wil…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-22058

    udp: Fix memory accounting leak.

    In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. Matt Dowling reported a weird UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. Howev…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38200

    i40e: fix MMIO write access to an invalid page in i40e_clear_hw

    In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page. Preven…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38332

    scsi: lpfc: Use memcpy() for BIOS version

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38556

    HID: core: Harden s32ton() against conversion to 0 bits

    In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39730

    NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()

    In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39751 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278950
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2360224
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2360276
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2363672
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2363686
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2367500
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373423
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373435
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373460
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373529
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373539
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373540
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373635
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2373662
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376392
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376406
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2379246
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383513
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383519
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383922
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2384422
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2388928
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2389456
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2391431
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393481
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393731
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2394624
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395267
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395297
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395358
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395858
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396114
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396152
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396158
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396379
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396419
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396431
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396494