Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 4

• High 7.8
  CVE-2025-38022

  RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

  In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 18, 2025
• High 7.8
  CVE-2025-38568

  net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

  In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MA…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 19, 2025
• High 7.1
  CVE-2025-40322

  fbdev: bitblit: bound-check glyph index in bit_putcs*

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• Unscored —
  CVE-2025-40294

  Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(25…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2389507
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419891
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419902
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2594.json
• report
  https://access.redhat.com/security/cve/CVE-2025-38022
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38022
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38022
• article
  https://lore.kernel.org/linux-cve-announce/2025061846-CVE-2025-38022-41b3@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38568
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38568
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38568
• article
  https://lore.kernel.org/linux-cve-announce/2025081909-CVE-2025-38568-7cd9@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40294
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40294
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40294
• article
  https://lore.kernel.org/linux-cve-announce/2025120818-CVE-2025-40294-b8e3@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40322
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40322
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40322
• article
  https://lore.kernel.org/linux-cve-announce/2025120823-CVE-2025-40322-6355@gregkh/T