Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396)
* kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)
* kernel: cifs: Fix the smbd_response slab to allow usercopy (CVE-2025-38523)
* kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)
* kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)
* kernel: s390/sclp: Fix SCCB present check (CVE-2025-39694)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | kernel | 0:6.12.0-55.37.1.el10_0 |
Vulnerabilities 6
-
Critical 9.8
tls: fix handling of zero-length records on the rx_list
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record ha…
KEV Sep 18, 2026 -
Critical 9.8
smb: client: fix use-after-free in cifs_oplock_break
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break()…
-
High 7.8
fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. …
-
High 7.8
io_uring/futex: ensure io_futex_wait() cleans up properly on failure
In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with RE…
-
High 7.5
cifs: Fix the smbd_response slab to allow usercopy
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the smbd_response slab to allow usercopy The handling of received data in the smbdirect client code involves using copy_to_iter() to copy data from the smbd_reponse struct's packet …
-
High 7.3
s390/sclp: Fix SCCB present check
In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed afte…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2383441
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2388928
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2388948
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2393511
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2393519
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2393534