Red Hat Security Advisory: kernel security update

Fixed packages 160

Vulnerabilities 10

• High 7.8
  CVE-2024-54456

  NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()

  In the Linux kernel, the following vulnerability has been resolved: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() name is char[64] where the size of clnt->cl_program->name remains unknown. Invoking strcat() directly will also lead to potent…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 27, 2025
• High 7.8
  CVE-2025-21786

  workqueue: Put the pwq after detaching the rescuer from the pool

  In the Linux kernel, the following vulnerability has been resolved: workqueue: Put the pwq after detaching the rescuer from the pool The commit 68f83057b913("workqueue: Reap workers via kthread_stop() and remove detach_completion") adds code to reap the norma…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• High 7.8
  CVE-2025-21791

  vrf: use RCU protection in l3mdev_l3_out()

  In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdev_l3_out() l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• High 7.8
  CVE-2025-38022

  RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

  In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 18, 2025
• High 7.8
  CVE-2025-38051

  smb: client: Fix use-after-free in cifs_fill_dirent

  In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the fo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 18, 2025
• High 7.8
  CVE-2025-38568

  net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

  In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MA…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 19, 2025
• High 7.5
  CVE-2025-68349

  NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

  In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 24, 2025
• High 7.3
  CVE-2025-21647

  sched: sch_cake: add bounds checks to host bulk flow fairness counts

  In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 19, 2025
• High 7.1
  CVE-2025-40322

  fbdev: bitblit: bound-check glyph index in bit_putcs*

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• Unscored —
  CVE-2025-40294

  Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(25…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2338828
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348541
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348587
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2389507
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419891
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419902
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2424880
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2352.json
• report
  https://access.redhat.com/security/cve/CVE-2024-54456
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-54456
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-54456
• article
  https://lore.kernel.org/linux-cve-announce/2025022602-CVE-2024-54456-e8a9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-21647
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-21647
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-21647
• article
  https://lore.kernel.org/linux-cve-announce/2025011946-CVE-2025-21647-51d8@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-21786
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-21786
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-21786
• article
  https://lore.kernel.org/linux-cve-announce/2025022608-CVE-2025-21786-f31d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-21791
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-21791
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-21791
• article
  https://lore.kernel.org/linux-cve-announce/2025022609-CVE-2025-21791-6074@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38022
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38022
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38022
• article
  https://lore.kernel.org/linux-cve-announce/2025061846-CVE-2025-38022-41b3@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38051
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38051
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38051
• article
  https://lore.kernel.org/linux-cve-announce/2025061831-CVE-2025-38051-77da@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38568
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38568
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38568