Skip to content
OpenAdvisories
Critical RHSA-2025:23445 31 CVEs

Red Hat Security Advisory: kernel security update

Published Dec 17, 2025 · Updated Oct 2, 2026

Ecosystem: Red Hat

Fixed packages 24

ReleasePackageFixed in
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos bpftool 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos bpftool-debuginfo 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-abi-whitelists 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-core 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-core 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-debuginfo 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-devel 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-modules 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debug-modules-extra 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debuginfo 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-debuginfo-common-x86_64 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-devel 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-doc 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-modules 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-modules-extra 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-tools 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-tools-debuginfo 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos kernel-tools-libs 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos perf 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos perf-debuginfo 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos python3-perf 0:4.18.0-193.178.1.el8_2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::baseos python3-perf-debuginfo 0:4.18.0-193.178.1.el8_2

Vulnerabilities 31

  • Critical 9.8
    CVE-2022-50410

    NFSD: Protect against send buffer overflow in NFSv2 READ

    In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2025-38724

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

    In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SE…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-39841

    scsi: lpfc: Fix buffer free/clear order in deferred receive path

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buff…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2022-50386

    Bluetooth: L2CAP: Fix user-after-free

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2023-53226

    wifi: mwifiex: Fix OOB and integer underflow when rx packets

    In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix OOB and integer underflow when rx packets Make sure mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, mwifiex_uap_queue_bridged_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2023-53297

    Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balan…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2023-53305

    Bluetooth: L2CAP: Fix use-after-free

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free Fix potential use-after-free in l2cap_le_command_rej.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2025-39864

    wifi: cfg80211: fix use-after-free in cmp_bss()

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bs…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2023-53213

    wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Fix a slab-out-of-bounds read that occurs in kmemdup() called from brcmf_get_assoc_ies(). The bug could occur when assoc_info-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2025-40186

    tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().

    In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-50367

    fs: fix UAF/GPF bug in nilfs_mdt_destroy

    In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_m…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-50406

    iomap: iomap: fix memory corruption when recording errors during writeback

    In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-50408

    wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() > ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb); may be schedule, and then complete before the line > ndev->stats.…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2023-53178

    mm: fix zswap writeback race condition

    In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was wri…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-53354

    skbuff: skb_segment, Call zero copy functions before using skbuff frags

    In the Linux kernel, the following vulnerability has been resolved: skbuff: skb_segment, Call zero copy functions before using skbuff frags Commit bf5c25d60861 ("skbuff: in skb_segment, call zerocopy functions once per nskb") added the call to zero copy funct…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2023-53373

    crypto: seqiv - Handle EBUSY correctly

    In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. Howev…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38718

    sctp: linearize cloned gso packets in sctp_rcv

    In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-39697

    NFS: Fix a race when updating an existing write

    In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-39825

    smb: client: fix race with concurrent opens in rename(2)

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-53680

    NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

    In the Linux kernel, the following vulnerability has been resolved: NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL OPDESC() simply indexes into nfsd4_ops[] by the op's operation number, without range checking that value. It assumes callers are car…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-39817

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

    In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2022-50356

    net: sched: sfb: fix null pointer access issue when sfb_init() fails

    In the Linux kernel, the following vulnerability has been resolved: net: sched: sfb: fix null pointer access issue when sfb_init() fails When the default qdisc is sfb, if the qdisc of dev_queue fails to be inited during mqprio_init(), sfb_reset() is invoked t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2023-53365

    ip6mr: Fix skb_under_panic in ip6mr_cache_report()

    In the Linux kernel, the following vulnerability has been resolved: ip6mr: Fix skb_under_panic in ip6mr_cache_report() skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ---…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2023-53393

    RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device Currently, when mlx5_ib_get_hw_stats() is used for device (port_num = 0), there is a special handling in order to use the correct coun…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48701

    ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less tha…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-50403 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2024-46679

    ethtool: check device is present when getting link settings

    In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38729

    ALSA: usb-audio: Validate UAC3 power domain descriptors, too

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39757

    ALSA: usb-audio: Validate UAC3 cluster segment descriptors

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39883

    mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory

    In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory When I did memory failure tests, below panic occurs: page dumped because: VM_BUG_ON_PAGE(PagePoisoned(page)) ker…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39955

    tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().

    In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported the splat below where a socket had tcp_sk(sk)->fastopen_rsk in the TCP_ESTABLISHED state. [0] syzbot reused the server…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278950
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2312067
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393164
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393166
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393172
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393481
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2394615
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395267
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395358
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395420
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395681
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395792
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395805
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395858
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396114
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396130
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396152
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396158
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396376
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396379
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396431
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396494
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396506
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396536
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396538
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396934
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396944
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2397553
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2402213
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2402699
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414724
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23445.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-48701
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-48701
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-48701
  • report
    https://access.redhat.com/security/cve/CVE-2022-50356
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-50356
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-50356