Skip to content
OpenAdvisories
Medium RLSA-2026:2264 8 CVEs

Moderate: kernel security update

Published Feb 15, 2026 · Updated Feb 15, 2026

Ecosystem: Rocky Linux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403)

* kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170)

* kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135)

* kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158)

* kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service (CVE-2025-40269)

* kernel: ext4: fix use-after-free in ext4_orphan_cleanup (CVE-2022-50673)

* kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349)

* kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 8 kernel 0:4.18.0-553.104.1.el8_10

Vulnerabilities 8

  • High 8.1
    CVE-2025-40135

    ipv6: use RCU in ip6_xmit()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2025-40158

    ipv6: use RCU in ip6_output()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2022-50673

    ext4: fix use-after-free in ext4_orphan_cleanup

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40170

    net: use dst_dev_rcu() in sk_setup_caps()

    In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40269

    ALSA: usb-audio: Fix potential overflow of PCM transfer buffer

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamical…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2025-68349

    NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

    In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-22998

    nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

    In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-38403

    vsock/vmci: Clear the vmci transport packet properly when initializing it

    In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialise…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2383421
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414506
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414521
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414523
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2419919
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2420347
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2424880
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2432671