Skip to content
OpenAdvisories
High 1 exploited CVE USN-7607-3 10 CVEs

linux-kvm vulnerabilities

Published Jul 8, 2025 · Updated Nov 3, 2026

Ecosystem: Ubuntu

Summary

It was discovered that a use-after-free vulnerability existed in the
Bluetooth stack in the Linux kernel. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2022-3640)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- SCSI subsystem;
- Network file system (NFS) client;
- NILFS2 file system;
- File systems infrastructure;
- Memory management;
- Bluetooth subsystem;
- Network traffic control;
- USB sound devices;
(CVE-2024-50116, CVE-2021-47576, CVE-2024-53197, CVE-2024-46787,
CVE-2025-37798, CVE-2024-49958, CVE-2021-47260, CVE-2025-37932,
CVE-2022-49909)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-kvm 4.4.0-1146.157

Vulnerabilities 10

  • High 7.8
    CVE-2024-53197 Exploited

    ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configura…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
    KEV Apr 9, 2025
  • High 7.8
    CVE-2021-47576

    scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()

    In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() In resp_mode_select() sanity check the block descriptor len to avoid UAF. BUG: KASAN: use-after-free in resp_mode_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-46787

    userfaultfd: fix checks for huge PMDs

    In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix checks for huge PMDs Patch series "userfaultfd: fix races around pmd_trans_huge() check", v2. The pmd_trans_huge() code in mfill_atomic() is wrong in three different ways dep…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-49958

    ocfs2: reserve space for inline xattr before attaching reflink tree

    In the Linux kernel, the following vulnerability has been resolved: ocfs2: reserve space for inline xattr before attaching reflink tree One of our customers reported a crash and a corrupted ocfs2 filesystem. The crash was due to the detection of corruption. U…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-37798

    codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()

    In the Linux kernel, the following vulnerability has been resolved: codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() After making all ->qlen_notify() callbacks idempotent, now it is safe to remove the check of qlen!=0 from both fq_codel_dequ…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2022-3640

    Linux Kernel Bluetooth l2cap_core.c l2cap_conn_del use after free

    A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a pat…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2024-50116

    nilfs2: fix kernel bug due to missing clearing of buffer delay flag

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of buffer delay flag Syzbot reported that after nilfs2 reads a corrupted file system image and degrades to read-only, the BUG_ON check for the b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2021-47260

    NFS: Fix a potential NULL dereference in nfs_get_client()

    In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential NULL dereference in nfs_get_client() None of the callers are expecting NULL returns from nfs_get_client() so this code will lead to an Oops. It's better to return an erro…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-49909 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2025-37932

    sch_htb: make htb_qlen_notify() idempotent

    In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent htb_qlen_notify() always deactivates the HTB class and in fact could trigger a warning if it is already deactivated. Therefore, it is not idempotent…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2021-47260
  • report
    https://ubuntu.com/security/CVE-2021-47576
  • report
    https://ubuntu.com/security/CVE-2022-3640
  • report
    https://ubuntu.com/security/CVE-2022-49909
  • report
    https://ubuntu.com/security/CVE-2024-46787
  • report
    https://ubuntu.com/security/CVE-2024-49958
  • report
    https://ubuntu.com/security/CVE-2024-50116
  • report
    https://ubuntu.com/security/CVE-2024-53197
  • report
    https://ubuntu.com/security/CVE-2025-37798
  • report
    https://ubuntu.com/security/CVE-2025-37932