Skip to content
OpenAdvisories
High RLSA-2026:1143 8 CVEs

Important: kernel security update

Published Feb 5, 2026 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting (CVE-2025-38141)

* kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)

* kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)

* kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)

* kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)

* kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service (CVE-2025-40294)

* kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301)

* kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 kernel 0:5.14.0-611.26.1.el9_7

Vulnerabilities 8

  • Critical 9.8
    CVE-2025-40258

    mptcp: fix race condition in mptcp_schedule_work()

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-68301

    net: atlantic: fix fragment overflow handling in RX path

    In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38141

    dm: fix dm_blk_report_zones

    In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was never called. Also, it is possible that md->zone_revalidate_map will change while calling this functi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38349

    eventpoll: don't decrement ep refcount while still holding the ep mutex

    In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. Th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38731

    drm/xe: Fix vm_bind_ioctl double free bug

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. ===…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40248

    vsock: Ignore signal/timeout on connect() if already established

    In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connec…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40294

    Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(25…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-68305

    Bluetooth: hci_sock: Prevent race in socket write iter and sock bind

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2376052
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2381870
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2393488
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418872
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2418876
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419891
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422836
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2422840