Red Hat Security Advisory: kernel security update

Fixed packages 160

Vulnerabilities 11

• Critical 9.8
  CVE-2025-40258

  mptcp: fix race condition in mptcp_schedule_work()

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 4, 2025
• High 8.8
  CVE-2025-40318

  Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• High 8.0
  CVE-2025-40141

  Bluetooth: ISO: Fix possible UAF on iso_conn_free

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Nov 12, 2025
• High 7.8
  CVE-2025-37761

  drm/xe: Fix an out-of-bounds shift when invalidating TLB

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix an out-of-bounds shift when invalidating TLB When the size of the range invalidated is larger than rounddown_pow_of_two(ULONG_MAX), The function macro roundup_pow_of_two(length) w…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2025
• High 7.8
  CVE-2025-37789

  net: openvswitch: fix nested key length validation in the set() action

  In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2025
• High 7.8
  CVE-2025-37869

  drm/xe: Use local fence in error path of xe_migrate_clear

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use local fence in error path of xe_migrate_clear The intent of the error path in xe_migrate_clear is to wait on locally generated fence and then return. The code is waiting on m->fen…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 9, 2025
• High 7.8
  CVE-2025-40251

  devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

  In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driv…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 4, 2025
• High 7.8
  CVE-2025-40277

  drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

  In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 6, 2025
• High 7.1
  CVE-2023-53034

  ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

  In the Linux kernel, the following vulnerability has been resolved: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• Unscored —
  CVE-2025-37819

  irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()

  In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() With ACPI in place, gicv2m_get_fwnode() is registered with the pci subsystem as pci_msi_get_fwnode_cb(), which may get invoked a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2025
• Unscored —
  CVE-2025-38289

  scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk

  In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk Smatch detected a potential use-after-free of an ndlp oject in dev_loss_tmo_callbk during driver unload or fatal error h…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 10, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360239
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363315
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363318
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2365032
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2365246
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2379196
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414522
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418876
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418892
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419920
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419954
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1194.json
• report
  https://access.redhat.com/security/cve/CVE-2023-53034
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53034
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53034
• article
  https://lore.kernel.org/linux-cve-announce/2025041650-CVE-2023-53034-8c3b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-37761
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-37761
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-37761
• article
  https://lore.kernel.org/linux-cve-announce/2025050110-CVE-2025-37761-f71c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-37789
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-37789
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-37789
• article
  https://lore.kernel.org/linux-cve-announce/2025050119-CVE-2025-37789-3f0b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-37819
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-37819
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-37819
• article
  https://lore.kernel.org/linux-cve-announce/2025050820-CVE-2025-37819-a3b9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-37869
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-37869
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-37869
• article
  https://kernelcve.org/list/?q=CVE-2025-37869
• article
  https://lore.kernel.org/linux-cve-announce/2025050958-CVE-2025-37869-09b8@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38289
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38289
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38289
• article
  https://lore.kernel.org/linux-cve-announce/2025071011-CVE-2025-38289-0d93@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40141