Red Hat Security Advisory: kernel security update

Fixed packages 71

Vulnerabilities 12

• Critical 9.8
  CVE-2023-53192

  vxlan: Fix nexthop hash size

  In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix nexthop hash size The nexthop code expects a 31 bit hash, such as what is returned by fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash returned by skb_get_has…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Critical 9.4
  CVE-2025-39933

  smb: client: let recv_done verify data_offset, data_length and remaining_data_length

  In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 8.8
  CVE-2023-53762

  Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. To preve…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• High 7.8
  CVE-2022-50673

  ext4: fix use-after-free in ext4_orphan_cleanup

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2025-37861

  scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue

  In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue When the task management thread processes reply queues while the reset thread resets them, the task management thread …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 9, 2025
• High 7.8
  CVE-2025-37882

  usb: xhci: Fix isochronous Ring Underrun/Overrun event handling

  In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix isochronous Ring Underrun/Overrun event handling The TRB pointer of these events points at enqueue at the time of error occurrence on xHCI 1.1+ HCs or it's NULL on older ones. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 9, 2025
• High 7.8
  CVE-2025-40269

  ALSA: usb-audio: Fix potential overflow of PCM transfer buffer

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamical…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 6, 2025
• High 7.8
  CVE-2025-40271 Public exploit

  fs/proc: fix uaf in proc_readdir_de()

  In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 6, 2025
• High 7.5
  CVE-2025-68349

  NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

  In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 24, 2025
• Unscored —
  CVE-2023-53821

  ip6_vti: fix slab-use-after-free in decode_session6

  In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix slab-use-after-free in decode_session6 When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-aft…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2025-38415

  Squashfs: check return result of sb_min_blocksize

  In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squas…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 25, 2025
• Unscored —
  CVE-2025-39760

  usb: core: config: Prevent OOB read in SS endpoint companion parsing

  In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2365250
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2365256
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383404
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2394601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395232
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2401432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419837
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419838
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419919
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420347
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2424880
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3267.json
• report
  https://access.redhat.com/security/cve/CVE-2022-50673
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50673
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50673
• article
  https://lore.kernel.org/linux-cve-announce/2025120947-CVE-2022-50673-f920@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53192
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53192
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53192
• article
  https://lore.kernel.org/linux-cve-announce/2025091558-CVE-2023-53192-5ca6@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53762
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53762
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53762
• article
  https://lore.kernel.org/linux-cve-announce/2025120845-CVE-2023-53762-01bc@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53821
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53821
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53821
• article
  https://lore.kernel.org/linux-cve-announce/2025120950-CVE-2023-53821-9542@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-37861
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-37861
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-37861
• article
  https://lore.kernel.org/linux-cve-announce/2025050922-CVE-2025-37861-ab7f@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-37882
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-37882
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-37882
• article
  https://lore.kernel.org/linux-cve-announce/2025050944-CVE-2025-37882-db64@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38415