Red Hat Security Advisory: kernel security update

Fixed packages 48

Vulnerabilities 18

• Critical 9.4
  CVE-2025-39933

  smb: client: let recv_done verify data_offset, data_length and remaining_data_length

  In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 8.8
  CVE-2023-53673

  Bluetooth: hci_event: call disconnect callback before deleting conn

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connections refer to the hci_conn…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 7, 2025
• High 8.8
  CVE-2023-53827

  Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put"), just use l2cap_chan_hold_u…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2022-50673

  ext4: fix use-after-free in ext4_orphan_cleanup

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2023-53539

  RDMA/rxe: Fix incomplete state save in rxe_requester

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix incomplete state save in rxe_requester If a send packet is dropped by the IP layer in rxe_requester() the call to rxe_xmit_packet() can fail with err == -EAGAIN. To recover, the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 4, 2025
• High 7.8
  CVE-2025-38022

  RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

  In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_addr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 18, 2025
• High 7.8
  CVE-2025-40271 Public exploit

  fs/proc: fix uaf in proc_readdir_de()

  In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 6, 2025
• High 7.8
  CVE-2025-40304

  fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

  In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• High 7.8
  CVE-2026-23074

  net/sched: Enforce that teql can only be used as root qdisc

  In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not impo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 4, 2026
• High 7.5
  CVE-2022-50865

  tcp: fix a signed-integer-overflow bug in tcp_add_backlog()

  In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• High 7.5
  CVE-2025-68349

  NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

  In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 24, 2025
• High 7.1
  CVE-2025-40322

  fbdev: bitblit: bound-check glyph index in bit_putcs*

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• Unscored —
  CVE-2023-53581

  net/mlx5e: Check for NOT_READY flag state after locking

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Check for NOT_READY flag state after locking Currently the check for NOT_READY flag is performed before obtaining the necessary lock. This opens a possibility for race condition wh…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-53821

  ip6_vti: fix slab-use-after-free in decode_session6

  In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix slab-use-after-free in decode_session6 When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-aft…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2023-53833

  drm/i915: Fix NULL ptr deref by checking new_crtc_state

  In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix NULL ptr deref by checking new_crtc_state intel_atomic_get_new_crtc_state can return NULL, unless crtc state wasn't obtained previously with intel_atomic_get_crtc_state, so we m…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2025-38415

  Squashfs: check return result of sb_min_blocksize

  In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squas…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 25, 2025
• Unscored —
  CVE-2025-38459

  atm: clip: Fix infinite recursive call of clip_push().

  In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [0] This happens if we call ioctl(ATMARP_MKIP) more than once. During the first call, clip_mkip() sets …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 25, 2025
• Unscored —
  CVE-2025-39760

  usb: core: config: Prevent OOB read in SS endpoint companion parsing

  In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383404
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2383487
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2394601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2401432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2401510
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2401545
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2402193
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419837
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419870
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419902
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420347
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420366
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420376
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2424880
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2426226
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436791
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3360.json
• report
  https://access.redhat.com/security/cve/CVE-2022-50673
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50673
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50673
• article
  https://lore.kernel.org/linux-cve-announce/2025120947-CVE-2022-50673-f920@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-50865
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50865
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50865
• article
  https://lore.kernel.org/linux-cve-announce/2025123049-CVE-2022-50865-281e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53539
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53539
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53539
• article
  https://lore.kernel.org/linux-cve-announce/2025100443-CVE-2023-53539-4411@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53581
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53581
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53581
• article
  https://lore.kernel.org/linux-cve-announce/2025100424-CVE-2023-53581-80fa@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-53673
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-53673
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-53673