Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: cifs: potential buffer overflow in handling symlinks (CVE-2022-49058)
* kernel: media: uvcvideo: Remove dangling pointers (CVE-2024-58002)
* kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980)
* kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CVE-2025-21991)
* kernel: net: atm: fix use after free in lec_send() (CVE-2025-22004)
* kernel: ext4: fix off-by-one error in do_split (CVE-2025-23150)
* kernel: ext4: ignore xattrs past end (CVE-2025-37738)
* kernel: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | kernel | 0:4.18.0-553.62.1.el8_10 |
Vulnerabilities 8
-
Critical 9.1
cifs: potential buffer overflow in handling symlinks
In the Linux kernel, the following vulnerability has been resolved: cifs: potential buffer overflow in handling symlinks Smatch printed a warning: arch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error: __memcpy() 'dctx->buf' too small (16 vs u32max…
-
High 8.6
net: atm: fix use after free in lec_send()
In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.
-
High 7.8
media: uvcvideo: Remove dangling pointers
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done.…
-
High 7.8
x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their CPU masks and unconditionally accesses p…
-
High 7.8
ext4: fix off-by-one error in do_split
In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in do_split Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split. BUG: KAS…
-
High 7.8
ext4: ignore xattrs past end
In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the 'end' entry. This fixes the following KASAN reported issue: ==================…
-
Unscored —
misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
In the Linux kernel, the following vulnerability has been resolved: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() `struct vmci_event_qp` allocated by qp_notify_peer() contains padding, which may carry uninitialized data to the userspace, a…
-
Unscored —
media: uvcvideo: Fix double free in error path
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. Thi…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348254
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348513
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348599
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2356917
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2357142
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2363268
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2363305
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2363378