Skip to content
OpenAdvisories
High USN-7685-3 10 CVEs

linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips vulnerabilities

Published Aug 5, 2025 · Updated Oct 30, 2026

Ecosystem: Ubuntu

Summary

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- SMB network file system;
- Bluetooth subsystem;
- Network traffic control;
- Sun RPC protocol;
- USB sound devices;
(CVE-2023-52975, CVE-2024-56748, CVE-2023-52885, CVE-2025-37797,
CVE-2024-50073, CVE-2024-49950, CVE-2024-49883, CVE-2024-38541,
CVE-2023-52757, CVE-2024-53239)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS linux-aws-fips 4.15.0-2121.127
Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS linux-azure-fips 4.15.0-2100.106
Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS linux-fips 4.15.0-1138.149
Ubuntu · Pro FIPS-updates 18.04 LTS Pro:FIPS-updates:18.04:LTS linux-gcp-fips 4.15.0-2084.90

Vulnerabilities 10

  • High 8.8
    CVE-2024-49950

    Bluetooth: L2CAP: Fix uaf in l2cap_connect

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2cap_connect [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2023-52885

    SUNRPC: Fix UAF in svc_tcp_listen_data_ready()

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener svc_sock is freed, and before invoking svc_tcp_accept() for the established child sock, there is a window that the newsock re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2023-52975

    scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress

    In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-38541

    of: module: add buffer overflow check in of_modalias()

    In the Linux kernel, the following vulnerability has been resolved: of: module: add buffer overflow check in of_modalias() In of_modalias(), if the buffer happens to be too small even for the 1st snprintf() call, the len parameter will become negative and str…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-49883

    ext4: aovid use-after-free in ext4_ext_insert_extent()

    In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4_ext_insert_extent() As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-50073

    tty: n_gsm: Fix use-after-free in gsm_cleanup_mux

    In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by ta…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-53239

    ALSA: 6fire: Release resources at card release

    In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Release resources at card release The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-37797

    net_sched: hfsc: Fix a UAF vulnerability in class handling

    In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-us…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Low 3.3
    CVE-2024-56748

    scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()

    In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() Hook "qed_ops->common->sb_init = qed_sb_init" does not release the DMA memory sb_virt when it fails. Add dma_free_coherent()…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2023-52757

    smb: client: fix potential deadlock when releasing mids

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when releasing mids All release_mid() callers seem to hold a reference of @mid so there is no need to call kref_put(&mid->refcount, __release_mid) under @s…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2023-52757
  • report
    https://ubuntu.com/security/CVE-2023-52885
  • report
    https://ubuntu.com/security/CVE-2023-52975
  • report
    https://ubuntu.com/security/CVE-2024-38541
  • report
    https://ubuntu.com/security/CVE-2024-49883
  • report
    https://ubuntu.com/security/CVE-2024-49950
  • report
    https://ubuntu.com/security/CVE-2024-50073
  • report
    https://ubuntu.com/security/CVE-2024-53239
  • report
    https://ubuntu.com/security/CVE-2024-56748
  • report
    https://ubuntu.com/security/CVE-2025-37797