Red Hat Security Advisory: kernel security update

Fixed packages 81

Vulnerabilities 8

• Critical 9.4
  CVE-2025-39933

  smb: client: let recv_done verify data_offset, data_length and remaining_data_length

  In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 7.8
  CVE-2025-38022

  RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

  In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 18, 2025
• High 7.8
  CVE-2025-40271 Public exploit

  fs/proc: fix uaf in proc_readdir_de()

  In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 6, 2025
• High 7.8
  CVE-2026-23074

  net/sched: Enforce that teql can only be used as root qdisc

  In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not impo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 4, 2026
• Unscored —
  CVE-2023-53821

  ip6_vti: fix slab-use-after-free in decode_session6

  In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix slab-use-after-free in decode_session6 When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-aft…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2025-38415

  Squashfs: check return result of sb_min_blocksize

  In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squas…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 25, 2025
• Unscored —
  CVE-2025-38459

  atm: clip: Fix infinite recursive call of clip_push().

  In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2025
• Unscored —
  CVE-2025-39760

  usb: core: config: Prevent OOB read in SS endpoint companion parsing

  In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383404
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383487
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2394601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2401432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419837
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436791
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3268.json
• report
  https://access.redhat.com/security/cve/CVE-2023-53821
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53821
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53821
• article
  https://lore.kernel.org/linux-cve-announce/2025120950-CVE-2023-53821-9542@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38022
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38022
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38022
• article
  https://lore.kernel.org/linux-cve-announce/2025061846-CVE-2025-38022-41b3@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38415
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38415
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38415
• article
  https://lore.kernel.org/linux-cve-announce/2025072513-CVE-2025-38415-c634@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-38459
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-38459
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-38459
• article
  https://lore.kernel.org/linux-cve-announce/2025072507-CVE-2025-38459-e941@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-39760
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39760
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39760
• article
  https://lore.kernel.org/linux-cve-announce/2025091145-CVE-2025-39760-2d5f@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-39933
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-39933
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-39933
• article
  https://lore.kernel.org/linux-cve-announce/2025100417-CVE-2025-39933-e224@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2025-40271
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-40271
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-40271
• article
  https://lore.kernel.org/linux-cve-announce/2025120716-CVE-2025-40271-7612@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2026-23074