Red Hat Security Advisory: kernel security update

Fixed packages 158

Vulnerabilities 16

• High 8.8
  CVE-2025-40318

  Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• High 8.1
  CVE-2025-40135

  ipv6: use RCU in ip6_xmit()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 12, 2025
• High 8.1
  CVE-2025-40158

  ipv6: use RCU in ip6_output()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 12, 2025
• High 8.0
  CVE-2025-40141

  Bluetooth: ISO: Fix possible UAF on iso_conn_free

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix possible UAF on iso_conn_free This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Nov 12, 2025
• High 7.8
  CVE-2025-37789

  net: openvswitch: fix nested key length validation in the set() action

  In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2025
• High 7.8
  CVE-2025-38022

  RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

  In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 18, 2025
• High 7.8
  CVE-2025-38024

  RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_descri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• High 7.8
  CVE-2025-38730

  io_uring/net: commit partial buffers on retry

  In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and in…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 4, 2025
• High 7.8
  CVE-2025-40170

  net: use dst_dev_rcu() in sk_setup_caps()

  In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 12, 2025
• High 7.8
  CVE-2025-40269

  ALSA: usb-audio: Fix potential overflow of PCM transfer buffer

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamical…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 6, 2025
• High 7.8
  CVE-2025-40271 Public exploit

  fs/proc: fix uaf in proc_readdir_de()

  In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 6, 2025
• Unscored —
  CVE-2025-37819

  irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()

  In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() With ACPI in place, gicv2m_get_fwnode() is registered with the pci subsystem as pci_msi_get_fwnode_cb(), which may get invoked a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 8, 2025
• Unscored —
  CVE-2025-38403

  vsock/vmci: Clear the vmci transport packet properly when initializing it

  In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialise…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2025
• Unscored —
  CVE-2025-38415

  Squashfs: check return result of sb_min_blocksize

  In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squas…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 25, 2025
• Unscored —
  CVE-2025-38459

  atm: clip: Fix infinite recursive call of clip_push().

  In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2025
• Unscored —
  CVE-2025-39760

  usb: core: config: Prevent OOB read in SS endpoint companion parsing

  In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363315
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2365032
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373354
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383404
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383421
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383487
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2393191
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2394601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414506
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414521
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414522
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414523
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419837
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419919
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419920
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2212.json
• report
  https://access.redhat.com/security/cve/CVE-2025-37789
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-37789
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-37789
• article
  https://lore.kernel.org/linux-cve-announce/2025050119-CVE-2025-37789-3f0b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-37819
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-37819
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-37819
• article
  https://lore.kernel.org/linux-cve-announce/2025050820-CVE-2025-37819-a3b9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38022
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38022
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38022
• article
  https://lore.kernel.org/linux-cve-announce/2025061846-CVE-2025-38022-41b3@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38024
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38024
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38024
• article
  https://lore.kernel.org/linux-cve-announce/2025061847-CVE-2025-38024-2904@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38403
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38403
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38403
• article
  https://lore.kernel.org/linux-cve-announce/2025072504-CVE-2025-38403-0da0@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38415