Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Drivers core;
- HID subsystem;
- Network drivers;
- SCSI subsystem;
- SuperH / SH-Mobile drivers;
- File systems infrastructure;
- Ext4 file system;
- JFS file system;
- Network file system (NFS) client;
- Memory management;
- Network namespace;
- CAIF protocol;
- Networking core;
- HSR network protocol;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- Network traffic control;
(CVE-2025-21702, CVE-2024-53227, CVE-2024-46826, CVE-2024-49952,
CVE-2024-56600, CVE-2021-47235, CVE-2024-50265, CVE-2021-47119,
CVE-2024-53165, CVE-2021-47483, CVE-2024-50302, CVE-2024-56595,
CVE-2024-50167, CVE-2024-56658, CVE-2024-49948, CVE-2024-26921,
CVE-2021-47602, CVE-2024-26863, CVE-2021-47320, CVE-2025-21700,
CVE-2021-47122)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro FIPS-updates 16.04 LTS Pro:FIPS-updates:16.04:LTS | linux-fips | 4.4.0-1112.119 |
Vulnerabilities 21
-
Medium 5.5CVE-2024-50302 Exploited
HID: core: zero-initialize the report buffer
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be …
KEV Mar 4, 2025 -
High 7.8
regmap: Fix possible double-free in regcache_rbtree_exit()
In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcache_rbtree_exit() In regcache_rbtree_insert_to_block(), when 'present' realloc failed, the 'blk' which is supposed to assign to 'rbnode->block' will b…
-
High 7.8
inet: inet_defrag: prevent sk release while still in use
In the Linux kernel, the following vulnerability has been resolved: inet: inet_defrag: prevent sk release while still in use ip_local_out() and other functions can pass skb->sk as function argument. If the skb is a fragment and reassembly happens before such …
-
High 7.8
netfilter: nf_tables: prevent nf_skb_duplicated corruption
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prevent nf_skb_duplicated corruption syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1]. Disabling pree…
-
High 7.8
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Fix use-after-free in bfad_im_module_exit() BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trac…
-
High 7.8
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
In the Linux kernel, the following vulnerability has been resolved: jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree When the value of lp is 0 at the beginning of the for loop, it will become negative in the next assignment and we should bai…
-
High 7.8
net: inet6: do not leave a dangling sk pointer in inet6_create()
In the Linux kernel, the following vulnerability has been resolved: net: inet6: do not leave a dangling sk pointer in inet6_create() sock_init_data() attaches the allocated sk pointer to the provided sock object. If inet6_create() fails later, the sk object i…
-
High 7.8
net: defer final 'struct net' free in netns dismantle
In the Linux kernel, the following vulnerability has been resolved: net: defer final 'struct net' free in netns dismantle Ilya reported a slab-use-after-free in dst_destroy [1] Issue is in xfrm6_net_init() and xfrm4_net_init() : They copy xfrm[46]_dst_ops_tem…
-
High 7.8
net: sched: Disallow replacing of child qdisc from one parent to another
In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of child qdisc from one parent to another Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1.…
-
High 7.8
pfifo_tail_enqueue: Drop new packet when sch->limit == 0
In the Linux kernel, the following vulnerability has been resolved: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 Expected behaviour: In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet in scheduler's queue and decrease sche…
-
High 7.4
sh: intc: Fix use-after-free bug in register_intc_controller()
In the Linux kernel, the following vulnerability has been resolved: sh: intc: Fix use-after-free bug in register_intc_controller() In the error handling for this function, d is freed without ever removing it from intc_list which would lead to a use after free…
-
Medium 5.5
be2net: fix potential memory leak in be_xmit()
In the Linux kernel, the following vulnerability has been resolved: be2net: fix potential memory leak in be_xmit() The be_xmit() returns NETDEV_TX_OK without freeing skb in case of be_xmit_enqueue() fails, add dev_kfree_skb_any() to fix it.
-
Medium 5.5
ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(): [ 57.319872] (a.out,1161,7):ocfs2_xa_remo…
-
Unscored —
ext4: fix memory leak in ext4_fill_super
In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leak in ext4_fill_super Buffer head references must be released before calling kill_bdev(); otherwise the buffer head (and its page referenced by b_data) will not be freed by…
-
Unscored —
net: caif: fix memory leak in caif_device_notify
In the Linux kernel, the following vulnerability has been resolved: net: caif: fix memory leak in caif_device_notify In case of caif_enroll_dev() fail, allocated link_support won't be assigned to the corresponding structure. So simply free allocated pointer i…
-
Unscored —
net: ethernet: fix potential use-after-free in ec_bhf_remove
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: fix potential use-after-free in ec_bhf_remove static void ec_bhf_remove(struct pci_dev *dev) { ... struct ec_bhf_priv *priv = netdev_priv(net_dev); unregister_netdev(net_dev); …
-
Unscored —
nfs: fix acl memory leak of posix_acl_create()
In the Linux kernel, the following vulnerability has been resolved: nfs: fix acl memory leak of posix_acl_create() When looking into another nfs xfstests report, I found acl and default_acl in nfs3_proc_create() and nfs3_proc_mknod() error paths are possibly …
-
Unscored —
mac80211: track only QoS data frames for admission control
In the Linux kernel, the following vulnerability has been resolved: mac80211: track only QoS data frames for admission control For admission control, obviously all of that only works for QoS data frames, otherwise we cannot even access the QoS field in the he…
-
Unscored —
hsr: Fix uninit-value access in hsr_get_node()
In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in hsr_get_node() KMSAN reported the following uninit-value access issue [1]: ===================================================== BUG: KMSAN: uninit-value in hs…
-
Unscored —
ELF: fix kernel.randomize_va_space double read
In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomize_va_space double read ELF loader uses "randomize_va_space" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with un…
-
Unscored —
net: add more sanity checks to qdisc_pkt_len_init()
In the Linux kernel, the following vulnerability has been resolved: net: add more sanity checks to qdisc_pkt_len_init() One path takes care of SKB_GSO_DODGY, assuming skb->len is bigger than hdr_len. virtio_net_hdr_to_skb() does not fully dissect TCP headers,…
References
-
report
https://ubuntu.com/security/CVE-2021-47119
-
report
https://ubuntu.com/security/CVE-2021-47122
-
report
https://ubuntu.com/security/CVE-2021-47235
-
report
https://ubuntu.com/security/CVE-2021-47320
-
report
https://ubuntu.com/security/CVE-2021-47483
-
report
https://ubuntu.com/security/CVE-2021-47602
-
report
https://ubuntu.com/security/CVE-2024-26863
-
report
https://ubuntu.com/security/CVE-2024-26921
-
report
https://ubuntu.com/security/CVE-2024-46826
-
report
https://ubuntu.com/security/CVE-2024-49948
-
report
https://ubuntu.com/security/CVE-2024-49952
-
report
https://ubuntu.com/security/CVE-2024-50167
-
report
https://ubuntu.com/security/CVE-2024-50265
-
report
https://ubuntu.com/security/CVE-2024-50302
-
report
https://ubuntu.com/security/CVE-2024-53165
-
report
https://ubuntu.com/security/CVE-2024-53227
-
report
https://ubuntu.com/security/CVE-2024-56595
-
report
https://ubuntu.com/security/CVE-2024-56600
-
report
https://ubuntu.com/security/CVE-2024-56658
-
report
https://ubuntu.com/security/CVE-2025-21700
-
report
https://ubuntu.com/security/CVE-2025-21702