Red Hat Security Advisory: kernel security update

Fixed packages 81

Vulnerabilities 13

• Critical 9.8
  CVE-2023-53751

  cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname

  In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname TCP_Server_Info::hostname may be updated once or many times during reconnect, so protect its access outside reconnect path…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• Critical 9.8
  CVE-2025-40258

  mptcp: fix race condition in mptcp_schedule_work()

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 4, 2025
• Critical 9.8
  CVE-2025-68301

  net: atlantic: fix fragment overflow handling in RX path

  In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 16, 2025
• High 8.8
  CVE-2023-53673

  Bluetooth: hci_event: call disconnect callback before deleting conn

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connections refer to the hci_conn…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 7, 2025
• High 7.8
  CVE-2022-50673

  ext4: fix use-after-free in ext4_orphan_cleanup

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2025-40304

  fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

  In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• High 7.5
  CVE-2022-50865

  tcp: fix a signed-integer-overflow bug in tcp_add_backlog()

  In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• High 7.5
  CVE-2025-68349

  NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

  In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 24, 2025
• High 7.1
  CVE-2025-39817

  efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

  In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 16, 2025
• High 7.1
  CVE-2025-40322

  fbdev: bitblit: bound-check glyph index in bit_putcs*

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• Unscored —
  CVE-2023-53581

  net/mlx5e: Check for NOT_READY flag state after locking

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Check for NOT_READY flag state after locking Currently the check for NOT_READY flag is performed before obtaining the necessary lock. This opens a possibility for race condition wh…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-53833

  drm/i915: Fix NULL ptr deref by checking new_crtc_state

  In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix NULL ptr deref by checking new_crtc_state intel_atomic_get_new_crtc_state can return NULL, unless crtc state wasn't obtained previously with intel_atomic_get_crtc_state, so we m…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2025-40154

  ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping

  In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping When an invalid value is passed via quirk option, currently bytcr_rt5640 driver only shows an error message but leaves as is. This m…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Nov 12, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395805
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2401545
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2402193
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414494
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418876
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419858
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419870
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419902
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420347
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420366
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2422836
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2424880
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2426226
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2490.json
• report
  https://access.redhat.com/security/cve/CVE-2022-50673
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50673
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50673
• article
  https://lore.kernel.org/linux-cve-announce/2025120947-CVE-2022-50673-f920@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-50865
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50865
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50865
• article
  https://lore.kernel.org/linux-cve-announce/2025123049-CVE-2022-50865-281e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53581
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53581
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53581
• article
  https://lore.kernel.org/linux-cve-announce/2025100424-CVE-2023-53581-80fa@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53673
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53673
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53673
• article
  https://lore.kernel.org/linux-cve-announce/2025100706-CVE-2023-53673-36b9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53751
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53751
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53751
• article
  https://lore.kernel.org/linux-cve-announce/2025120842-CVE-2023-53751-2ff2@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53833
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53833
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53833
• article
  https://lore.kernel.org/linux-cve-announce/2025120954-CVE-2023-53833-09d9@gregkh/T