Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823)
* kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200)
* kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)
* kernel: net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350)
* kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464)
* kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461)
* kernel: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | kernel | 0:5.14.0-570.39.1.el9_6 |
Vulnerabilities 7
-
Critical 9.8
RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing…
-
High 7.8
net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.
-
High 7.8
net/sched: Always pass notifications when child class becomes empty
In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the …
-
High 7.8
tipc: Fix use-after-free in tipc_conn_close().
In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-ptr-deref in tipc_conn_close() during netns dismantle. [0] tipc_topsrv_stop() iterates tipc_net(net)->topsrv->conn_idr an…
-
High 7.8
xfrm: interface: fix use-after-free after changing collect_md xfrm interface
In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail whe…
-
High 7.0
vsock: Fix transport_* TOCTOU
In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_* TOCTOU Transport assignment may race with module unload. Protect new_transport from becoming a stale pointer. This also takes care of an insecure call in vsock_use_loca…
-
Unscored —
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page. Preven…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2365024
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2376392
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2376406
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2382054
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2383509
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2383513
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2387866