Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- SMB network file system;
- Bluetooth subsystem;
- Network traffic control;
(CVE-2025-38350, CVE-2023-52975, CVE-2024-50073, CVE-2024-57996,
CVE-2024-49950, CVE-2024-38541, CVE-2025-37752, CVE-2023-52757,
CVE-2025-38083, CVE-2025-37797)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-oracle-5.4 | 5.4.0-1148.158~18.04.1 |
Vulnerabilities 10
-
High 8.8
Bluetooth: L2CAP: Fix uaf in l2cap_connect
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2cap_connect [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr …
-
High 7.8
scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr…
-
High 7.8
of: module: add buffer overflow check in of_modalias()
In the Linux kernel, the following vulnerability has been resolved: of: module: add buffer overflow check in of_modalias() In of_modalias(), if the buffer happens to be too small even for the 1st snprintf() call, the len parameter will become negative and str…
-
High 7.8
tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by ta…
-
High 7.8
net_sched: sch_sfq: don't allow 1 packet limit
In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: don't allow 1 packet limit The current implementation does not work correctly with a limit of 1. iproute2 actually checks for this and this patch adds the check in kernel …
-
High 7.8
net_sched: sch_sfq: move the limit validation
In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: move the limit validation It is not sufficient to directly validate the limit on the data that the user passes as it can be updated based on how the other parameters are c…
-
High 7.8
net_sched: hfsc: Fix a UAF vulnerability in class handling
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class handling This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-us…
-
High 7.8
net_sched: prio: fix a race in prio_tune()
In the Linux kernel, the following vulnerability has been resolved: net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock roo…
-
High 7.8
net/sched: Always pass notifications when child class becomes empty
In the Linux kernel, the following vulnerability has been resolved: net/sched: Always pass notifications when child class becomes empty Certain classful qdiscs may invoke their classes' dequeue handler on an enqueue operation. This may unexpectedly empty the …
-
Unscored —
smb: client: fix potential deadlock when releasing mids
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential deadlock when releasing mids All release_mid() callers seem to hold a reference of @mid so there is no need to call kref_put(&mid->refcount, __release_mid) under @s…
References
-
report
https://ubuntu.com/security/CVE-2023-52757
-
report
https://ubuntu.com/security/CVE-2023-52975
-
report
https://ubuntu.com/security/CVE-2024-38541
-
report
https://ubuntu.com/security/CVE-2024-49950
-
report
https://ubuntu.com/security/CVE-2024-50073
-
report
https://ubuntu.com/security/CVE-2024-57996
-
report
https://ubuntu.com/security/CVE-2025-37752
-
report
https://ubuntu.com/security/CVE-2025-37797
-
report
https://ubuntu.com/security/CVE-2025-38083
-
report
https://ubuntu.com/security/CVE-2025-38350