Red Hat Security Advisory: kernel security update

Fixed packages 158

Vulnerabilities 7

• Critical 9.8
  CVE-2025-68811

  svcrdma: use rc_pageoff for memcpy byte offset

  In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_range added rc_curpage (page index) to the page base instead of the byte offset rc_pageoff. Use rc_pageoff so copies land w…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 13, 2026
• High 7.8
  CVE-2025-40064

  smc: Fix use-after-free in __pnet_find_base_ndev().

  In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in __pnet_find_base_ndev(). syzbot reported use-after-free of net_device in __pnet_find_base_ndev(), which was called during connect(). [0] smc_pnet_find_ism_resource(…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 28, 2025
• High 7.8
  CVE-2025-40304

  fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

  In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• High 7.5
  CVE-2025-68349

  NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

  In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 24, 2025
• High 7.5
  CVE-2026-22998

  nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

  In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 25, 2026
• High 7.1
  CVE-2023-53034

  ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

  In the Linux kernel, the following vulnerability has been resolved: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025
• High 7.1
  CVE-2025-40322

  fbdev: bitblit: bound-check glyph index in bit_putcs*

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360239
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2406747
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419870
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419902
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2424880
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429116
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2432671
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2722.json
• report
  https://access.redhat.com/security/cve/CVE-2023-53034
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53034
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53034
• article
  https://lore.kernel.org/linux-cve-announce/2025041650-CVE-2023-53034-8c3b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40064
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40064
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40064
• article
  https://lore.kernel.org/linux-cve-announce/2025102817-CVE-2025-40064-0c16@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40304
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40304
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40304
• article
  https://lore.kernel.org/linux-cve-announce/2025120820-CVE-2025-40304-47b3@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40322
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40322
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40322
• article
  https://lore.kernel.org/linux-cve-announce/2025120823-CVE-2025-40322-6355@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-68349
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68349
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68349
• article
  https://lore.kernel.org/linux-cve-announce/2025122453-CVE-2025-68349-12d5@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-68811
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68811
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68811
• article
  https://lore.kernel.org/linux-cve-announce/2026011311-CVE-2025-68811-7e46@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-22998
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-22998
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-22998
• article
  https://lore.kernel.org/linux-cve-announce/2026012533-CVE-2026-22998-8392@gregkh/T