Skip to content
OpenAdvisories
High RLSA-2026:0453 9 CVEs

Important: kernel security update

Published Jan 17, 2026 · Updated Jan 17, 2026

Ecosystem: Rocky Linux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)

* kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840)

* kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)

* kernel: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver (CVE-2025-39905)

* kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966)

* kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176)

* kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240)

* kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277)

* kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CVE-2025-68287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 kernel 0:6.12.0-124.27.1.el10_1

Vulnerabilities 9

  • Critical 9.8
    CVE-2025-40176

    tls: wait for pending async decryptions if tls_strp_msg_hold fails

    In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-39806

    HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()

    In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-39966

    iommufd: Fix race during abort for file descriptors

    In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_operations release() synchronously, it puts the file on a work queue and it will be released eventually. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40277

    drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

    In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2025-40240

    sctp: avoid NULL dereference when chunk data buffer is missing

    In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->he…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2025-39840

    audit: fix out-of-bounds read in audit_compare_dname_path()

    In the Linux kernel, the following vulnerability has been resolved: audit: fix out-of-bounds read in audit_compare_dname_path() When a watch on dir=/ is combined with an fsnotify event for a single-character name directly under / (e.g., creating /a), an out-o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.0
    CVE-2025-39905

    net: phylink: add lock for serializing concurrent pl->phydev writes with resolver

    In the Linux kernel, the following vulnerability has been resolved: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Currently phylink_resolve() protects itself against concurrent phylink_bringup_phy() or phylink_disconnect_ph…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-39843

    mm: slub: avoid wake up kswapd in set_track_prepare

    In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-68287

    usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

    In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dw…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396941
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418832
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422788
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419954
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2400611
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414524
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2396936
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2395807
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2404107