Red Hat Security Advisory: kernel security update

Fixed packages 158

Vulnerabilities 8

• Critical 9.8
  CVE-2025-40258

  mptcp: fix race condition in mptcp_schedule_work()

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 4, 2025
• Critical 9.8
  CVE-2025-68301

  net: atlantic: fix fragment overflow handling in RX path

  In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 16, 2025
• High 7.8
  CVE-2025-38141

  dm: fix dm_blk_report_zones

  In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was never called. Also, it is possible that md->zone_revalidate_map will change while calling this functi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 3, 2025
• High 7.8
  CVE-2025-38349

  eventpoll: don't decrement ep refcount while still holding the ep mutex

  In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. Th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 18, 2025
• High 7.8
  CVE-2025-38731

  drm/xe: Fix vm_bind_ioctl double free bug

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. ===…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 5, 2025
• High 7.8
  CVE-2025-40248

  vsock: Ignore signal/timeout on connect() if already established

  In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connec…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 4, 2025
• Unscored —
  CVE-2025-40294

  Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(25…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• Unscored —
  CVE-2025-68305

  Bluetooth: hci_sock: Prevent race in socket write iter and sock bind

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 16, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2376052
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2381870
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393488
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418876
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419891
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2422836
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2422840
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1143.json
• report
  https://access.redhat.com/security/cve/CVE-2025-38141
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38141
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38141
• article
  https://lore.kernel.org/linux-cve-announce/2025070333-CVE-2025-38141-560e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38349
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38349
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38349
• article
  https://lore.kernel.org/linux-cve-announce/2025071819-CVE-2025-38349-ee39@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38731
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38731
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38731
• article
  https://lore.kernel.org/linux-cve-announce/2025090541-CVE-2025-38731-9537@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40248
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40248
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40248
• article
  https://lore.kernel.org/linux-cve-announce/2025120430-CVE-2025-40248-506e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40258
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40258
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40258
• article
  https://lore.kernel.org/linux-cve-announce/2025120433-CVE-2025-40258-d10d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40294
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40294
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40294
• article
  https://lore.kernel.org/linux-cve-announce/2025120818-CVE-2025-40294-b8e3@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-68301
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68301
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68301
• article
  https://lore.kernel.org/linux-cve-announce/2025121643-CVE-2025-68301-be31@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-68305