Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 12

• High 8.2
  CVE-2025-37749

  net: ppp: Add bound checking for skb data on ppp_sync_txmung

  In the Linux kernel, the following vulnerability has been resolved: net: ppp: Add bound checking for skb data on ppp_sync_txmung Ensure we have enough data in linear buffer from skb before accessing initial bytes. This prevents potential out-of-bounds accesse…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2025
• High 7.8
  CVE-2024-26907

  RDMA/mlx5: Fix fortify source warning while accessing Eth segment

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix fortify source warning while accessing Eth segment ------------[ cut here ]------------ memcpy: detected field-spanning write (size 56) of single field "eseg->inline_hdr.start"…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 17, 2024
• High 7.8
  CVE-2025-21756 Public exploit

  vsock: Keep the binding until socket destruction

  In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind() and those implicitly bound through autobind during connect(). …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• Medium 5.3
  CVE-2024-26901

  do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak

  In the Linux kernel, the following vulnerability has been resolved: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak syzbot identified a kernel information leak vulnerability in do_sys_name_to_handle() and issued the following report [1]. [1] "BU…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 17, 2024
• Low 3.3
  CVE-2023-52703

  net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path

  In the Linux kernel, the following vulnerability has been resolved: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path syzbot reported that act_len in kalmia_send_init_packet() is uninitialized when passing it to the first usb_bulk_msg error path.…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Unscored —
  CVE-2021-47495

  usbnet: sanity check for maxpacket

  In the Linux kernel, the following vulnerability has been resolved: usbnet: sanity check for maxpacket maxpacket of 0 makes no sense and oopses as we need to divide by it. Give up. V2: fixed typo in log and stylistic issues

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 22, 2024
• Unscored —
  CVE-2023-52622

  ext4: avoid online resizing failures due to oversized flex bg

  In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg When we online resize an ext4 filesystem with a oversized flexbg_size, mkfs.ext4 -F -G 67108864 $dev -b 4096 100M mount $dev $dir…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 26, 2024
• Unscored —
  CVE-2023-52840

  Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()

  In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Unscored —
  CVE-2024-26973

  fat: fix uninitialized field in nostale filehandles

  In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• Unscored —
  CVE-2024-27013

  tun: limit printing rate when illegal packet received by tun dev

  In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhost_worker will call tun call backs to receive packets. If too many illegal packets arrives, tun_do_read will keep dumping p…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• Unscored —
  CVE-2024-35946

  wifi: rtw89: fix null pointer access when abort scan

  In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix null pointer access when abort scan During cancel scan we might use vif that weren't scanning. Fix this by using the actual scanning vif.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 19, 2024
• Unscored —
  CVE-2024-57876

  drm/dp_mst: Fix resetting msg rx state after topology removal

  In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Fix resetting msg rx state after topology removal If the MST topology is removed during the reception of an MST down reply or MST up request sideband message, the drm_dp_mst_topol…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 11, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2271688
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275633
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275645
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278270
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278356
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281833
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282612
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282757
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282920
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2337142
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348609
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363332
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8248.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47495
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47495
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47495
• article
  https://lore.kernel.org/linux-cve-announce/2024052242-CVE-2021-47495-a5f8@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52622
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52622
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52622
• article
  https://lore.kernel.org/linux-cve-announce/20240326171931.1354035-5-lee@kernel.org/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52703
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52703
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52703
• article
  https://lore.kernel.org/linux-cve-announce/2024052157-CVE-2023-52703-abcb@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52840
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52840
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52840
• article
  https://lore.kernel.org/linux-cve-announce/2024052111-CVE-2023-52840-8a3d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26901
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26901
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26901
• article
  https://lore.kernel.org/linux-cve-announce/2024041745-CVE-2024-26901-34e7@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26907
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26907
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26907
• article
  https://lore.kernel.org/linux-cve-announce/2024041746-CVE-2024-26907-a02d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26973