Skip to content
OpenAdvisories
Medium RLSA-2025:15005 7 CVEs

Moderate: kernel security update

Published Oct 3, 2025 · Updated Oct 8, 2025

Ecosystem: Rocky Linux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: udp: Fix memory accounting leak. (CVE-2025-22058)

* kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823)

* kernel: ext4: only dirty folios when data journaling regular files (CVE-2025-38220)

* kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)

* kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464)

* kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461)

* kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 kernel 0:6.12.0-55.30.1.el10_0

Vulnerabilities 7

  • Critical 9.8
    CVE-2025-38211

    RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

    In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-38472

    netfilter: nf_conntrack: fix crash due to removal of uninitialised entry

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: [exception RIP…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-37823

    net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too

    In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38464

    tipc: Fix use-after-free in tipc_conn_close().

    In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-ptr-deref in tipc_conn_close() during netns dismantle. [0] tipc_topsrv_stop() iterates tipc_net(net)->topsrv->conn_idr an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2025-38461

    vsock: Fix transport_* TOCTOU

    In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_* TOCTOU Transport assignment may race with module unload. Protect new_transport from becoming a stale pointer. This also takes care of an insecure call in vsock_use_loca…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-22058

    udp: Fix memory accounting leak.

    In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. Matt Dowling reported a weird UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. Howev…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38220

    ext4: only dirty folios when data journaling regular files

    In the Linux kernel, the following vulnerability has been resolved: ext4: only dirty folios when data journaling regular files fstest generic/388 occasionally reproduces a crash that looks as follows: BUG: kernel NULL pointer dereference, address: 00000000000…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2360276
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2365024
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376363
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376406
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383509
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383513
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383916