Red Hat Security Advisory: kernel security update

Fixed packages 91

Vulnerabilities 16

• Critical 9.8
  CVE-2025-40258

  mptcp: fix race condition in mptcp_schedule_work()

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 4, 2025
• Critical 9.8
  CVE-2025-68301

  net: atlantic: fix fragment overflow handling in RX path

  In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 16, 2025
• Critical 9.4
  CVE-2025-39933

  smb: client: let recv_done verify data_offset, data_length and remaining_data_length

  In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 8.8
  CVE-2025-40318

  Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• High 8.1
  CVE-2025-40133

  mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().

  In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Nov 12, 2025
• High 7.8
  CVE-2025-38172

  erofs: avoid using multiple devices with different type

  In the Linux kernel, the following vulnerability has been resolved: erofs: avoid using multiple devices with different type For multiple devices, both primary and extra devices should be the same type. `erofs_init_device` has already guaranteed that if the pr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 3, 2025
• High 7.8
  CVE-2025-38453

  io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU

  In the Linux kernel, the following vulnerability has been resolved: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU syzbot reports that defer/local task_work adding via msg_ring can hit a request that has been freed: CPU: 1 UID: 0 PID: 19356 Co…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 25, 2025
• High 7.8
  CVE-2025-38568

  net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

  In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MA…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 19, 2025
• High 7.8
  CVE-2025-40047

  io_uring/waitid: always prune wait queue entry in io_waitid_wait()

  In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelatio…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 28, 2025
• High 7.8
  CVE-2025-40248

  vsock: Ignore signal/timeout on connect() if already established

  In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connec…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 4, 2025
• High 7.8
  CVE-2025-40251

  devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

  In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driv…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 4, 2025
• High 7.8
  CVE-2025-40304

  fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

  In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• High 7.6
  CVE-2025-40301

  Bluetooth: hci_event: validate skb length for unknown CC opcode

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• High 7.5
  CVE-2025-40240

  sctp: avoid NULL dereference when chunk data buffer is missing

  In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->he…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 4, 2025
• High 7.1
  CVE-2023-53034

  ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

  In the Linux kernel, the following vulnerability has been resolved: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• High 7.1
  CVE-2025-40322

  fbdev: bitblit: bound-check glyph index in bit_putcs*

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360239
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2376072
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383516
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2389507
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2401432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2406758
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414465
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418832
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418876
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418892
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419870
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419896
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419902
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419920
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2422836
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1727.json
• report
  https://access.redhat.com/security/cve/CVE-2023-53034
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53034
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53034
• article
  https://lore.kernel.org/linux-cve-announce/2025041650-CVE-2023-53034-8c3b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38172
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38172
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38172
• article
  https://lore.kernel.org/linux-cve-announce/2025070343-CVE-2025-38172-13be@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38453
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38453
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38453
• article
  https://lore.kernel.org/linux-cve-announce/2025072505-CVE-2025-38453-69b1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38568
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38568
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38568
• article
  https://lore.kernel.org/linux-cve-announce/2025081909-CVE-2025-38568-7cd9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-39933
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39933
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39933
• article
  https://lore.kernel.org/linux-cve-announce/2025100417-CVE-2025-39933-e224@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40047