Skip to content
OpenAdvisories
Critical USN-7797-1 10 CVEs

linux, linux-kvm vulnerabilities

Published Oct 2, 2025 · Updated Nov 3, 2026

Ecosystem: Ubuntu

Summary

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Virtio block driver;
- Media drivers;
- Network drivers;
- Framebuffer layer;
- BTRFS file system;
- Ext4 file system;
- Network file system (NFS) server daemon;
- Packet sockets;
- VMware vSockets driver;
(CVE-2025-38618, CVE-2024-35849, CVE-2025-37785, CVE-2024-49924,
CVE-2025-38617, CVE-2024-27078, CVE-2021-47149, CVE-2021-47319,
CVE-2025-21796, CVE-2021-47589)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux 4.4.0-273.307
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS linux-kvm 4.4.0-1149.160

Vulnerabilities 10

  • Critical 9.8
    CVE-2025-21796

    nfsd: clear acl_access/acl_default after releasing them

    In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a point…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-49924

    fbdev: pxafb: Fix possible use after free in pxafb_task()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafb_task() In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover,…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-37785

    ext4: fix OOB read when checking dotdot dir

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix OOB read when checking dotdot dir Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, whe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38617

    net/packet: fix a race in packet_set_ring() and packet_notifier()

    In the Linux kernel, the following vulnerability has been resolved: net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38618

    vsock: Do not allow binding to VMADDR_PORT_ANY

    In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The so…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2021-47149

    net: fujitsu: fix potential null-ptr-deref

    In the Linux kernel, the following vulnerability has been resolved: net: fujitsu: fix potential null-ptr-deref In fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer deref. To fix this, check the return value of ioremap and return -1 to the call…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47319

    virtio-blk: Fix memory leak among suspend/resume procedure

    In the Linux kernel, the following vulnerability has been resolved: virtio-blk: Fix memory leak among suspend/resume procedure The vblk->vqs should be freed before we call init_vqs() in virtblk_restore().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47589

    igbvf: fix double free in `igbvf_probe`

    In the Linux kernel, the following vulnerability has been resolved: igbvf: fix double free in `igbvf_probe` In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-27078

    media: v4l2-tpg: fix some memleaks in tpg_alloc

    In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: fix some memleaks in tpg_alloc In tpg_alloc, resources should be deallocated in each and every error-handling paths, since they are allocated in for statements. Otherwise the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-35849

    btrfs: fix information leak in btrfs_ioctl_logical_to_ino()

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfs_ioctl_logical_to_ino() Syzbot reported the following information leak for in btrfs_ioctl_logical_to_ino(): BUG: KMSAN: kernel-infoleak in instrument_copy_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2021-47149
  • report
    https://ubuntu.com/security/CVE-2021-47319
  • report
    https://ubuntu.com/security/CVE-2021-47589
  • report
    https://ubuntu.com/security/CVE-2024-27078
  • report
    https://ubuntu.com/security/CVE-2024-35849
  • report
    https://ubuntu.com/security/CVE-2024-49924
  • report
    https://ubuntu.com/security/CVE-2025-21796
  • report
    https://ubuntu.com/security/CVE-2025-37785
  • report
    https://ubuntu.com/security/CVE-2025-38617
  • report
    https://ubuntu.com/security/CVE-2025-38618