Red Hat Security Advisory: kernel security update

Fixed packages 71

Vulnerabilities 14

• High 8.8
  CVE-2025-37849

  KVM: arm64: Tear down vGIC on failed vCPU creation

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 9, 2025
• High 8.8
  CVE-2025-39971

  i40e: fix idx validation in config queues msg

  In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_vc_config_queues_msg().

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 15, 2025
• High 8.2
  CVE-2023-53705

  ipv6: Fix out-of-bounds access in ipv6_find_tlv()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bounds access in ipv6_find_tlv() optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access. Found by InfoTeCS on be…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 22, 2025
• High 8.0
  CVE-2025-40141

  Bluetooth: ISO: Fix possible UAF on iso_conn_free

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Nov 12, 2025
• High 7.8
  CVE-2023-53552

  drm/i915: mark requests for GuC virtual engines to avoid use-after-free

  In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References to i915_requests may be trapped by userspace inside a sync_file or dmabuf (dma-resv) and held indefinitely a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 7.8
  CVE-2025-23142

  sctp: detect and prevent references to a freed transport in sendmsg

  In the Linux kernel, the following vulnerability has been resolved: sctp: detect and prevent references to a freed transport in sendmsg sctp_sendmsg() re-uses associations and transports when possible by doing a lookup based on the socket endpoint and the mes…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2025
• High 7.8
  CVE-2025-37789

  net: openvswitch: fix nested key length validation in the set() action

  In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2025
• High 7.8
  CVE-2025-40277

  drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

  In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 6, 2025
• High 7.1
  CVE-2023-53034

  ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

  In the Linux kernel, the following vulnerability has been resolved: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• Medium 5.5
  CVE-2023-53240

  xsk: check IFF_UP earlier in Tx path

  In the Linux kernel, the following vulnerability has been resolved: xsk: check IFF_UP earlier in Tx path Xsk Tx can be triggered via either sendmsg() or poll() syscalls. These two paths share a call to common function xsk_xmit() which has two sanity checks wi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 15, 2025
• Unscored —
  CVE-2023-53581

  net/mlx5e: Check for NOT_READY flag state after locking

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Check for NOT_READY flag state after locking Currently the check for NOT_READY flag is performed before obtaining the necessary lock. This opens a possibility for race condition wh…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2025-21724

  iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()

  In the Linux kernel, the following vulnerability has been resolved: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where shifting the constant "1" (of ty…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• Unscored —
  CVE-2025-39898 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2025-40154

  ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping

  In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This m…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Nov 12, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348649
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360239
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363300
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363315
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2365271
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395413
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2400598
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2401514
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2401545
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2404108
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2405713
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414494
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414522
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419954
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1441.json
• report
  https://access.redhat.com/security/cve/CVE-2023-53034
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53034
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53034
• article
  https://lore.kernel.org/linux-cve-announce/2025041650-CVE-2023-53034-8c3b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53240
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53240
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53240
• article
  https://lore.kernel.org/linux-cve-announce/2025091516-CVE-2023-53240-c379@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53552
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53552
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53552
• article
  https://lore.kernel.org/linux-cve-announce/2025100447-CVE-2023-53552-5ba9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53581
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53581
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53581
• article
  https://lore.kernel.org/linux-cve-announce/2025100424-CVE-2023-53581-80fa@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53705
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53705
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53705
• article
  https://lore.kernel.org/linux-cve-announce/2025102212-CVE-2023-53705-38d9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-21724
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-21724
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-21724