Summary
Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered
that the Linux kernel contained insufficient branch predictor isolation
between a guest and a userspace hypervisor for certain processors. This
flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this
to expose sensitive information from the host OS. (CVE-2025-40300)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- DMA engine subsystem;
- GPU drivers;
- HSI subsystem;
- Ethernet team driver;
- TTY drivers;
- Ext4 file system;
- Timer subsystem;
- DCCP (Datagram Congestion Control Protocol);
- IPv6 networking;
- NET/ROM layer;
- SCTP protocol;
- USB sound devices;
(CVE-2021-47294, CVE-2021-47330, CVE-2023-52574, CVE-2023-52650,
CVE-2024-50006, CVE-2024-50299, CVE-2024-53124, CVE-2024-53150,
CVE-2024-56767, CVE-2025-37838, CVE-2025-38352)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-aws | 4.4.0-1149.155 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-lts-xenial | 4.4.0-274.308~14.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux | 4.4.0-274.308 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws | 4.4.0-1187.202 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-kvm | 4.4.0-1150.161 |
Vulnerabilities 12
-
High 7.8
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() …
KEV Sep 4, 2025 -
High 7.1CVE-2024-53150 Exploited
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, wh…
KEV Apr 9, 2025 -
High 8.2
sctp: properly validate chunk size in sctp_sf_ootb()
In the Linux kernel, the following vulnerability has been resolved: sctp: properly validate chunk size in sctp_sf_ootb() A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add size validation when walking chunks") is also required in sctp_sf…
-
High 7.8
team: fix null-ptr-deref when team device type is changed
In the Linux kernel, the following vulnerability has been resolved: team: fix null-ptr-deref when team device type is changed Get a null-ptr-deref bug as follows with reproducer [1]. BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 001…
-
High 7.8
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition In the ssi_protocol_probe() function, &ssi->work is bound with ssip_xmit_work(), In ssip_pn_se…
-
High 7.5
net: fix data-races around sk->sk_forward_alloc
In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk->sk_forward_alloc Syzkaller reported this warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c…
-
Unscored —
netrom: Decrease sock refcount when sock timers expire
In the Linux kernel, the following vulnerability has been resolved: netrom: Decrease sock refcount when sock timers expire Commit 63346650c1a9 ("netrom: switch to sock timer API") switched to use sock timer API. It replaces mod_timer() by sk_reset_timer(), an…
-
Unscored —
tty: serial: 8250: serial_cs: Fix a memory leak in error handling path
In the Linux kernel, the following vulnerability has been resolved: tty: serial: 8250: serial_cs: Fix a memory leak in error handling path In the probe function, if the final 'serial_config()' fails, 'info' is leaking. Add a resource handling path to free thi…
-
Unscored —
drm/tegra: dsi: Add missing check for of_find_device_by_node
In the Linux kernel, the following vulnerability has been resolved: drm/tegra: dsi: Add missing check for of_find_device_by_node Add check for the return value of of_find_device_by_node() and return the error if it fails in order to avoid NULL pointer derefer…
-
Unscored —
ext4: fix i_data_sem unlock order in ext4_ind_migrate()
In the Linux kernel, the following vulnerability has been resolved: ext4: fix i_data_sem unlock order in ext4_ind_migrate() Fuzzing reports a possible deadlock in jbd2_log_wait_commit. This issue is triggered when an EXT4_IOC_MIGRATE ioctl is set to require s…
-
Unscored —
dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset The at_xdmac_memset_create_desc may return NULL, which will lead to a null pointer dereference. For example, the len inpu…
-
Unscored —
x86/vmscape: Add conditional IBPB mitigation
In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing …
References
-
report
https://ubuntu.com/security/CVE-2021-47294
-
report
https://ubuntu.com/security/CVE-2021-47330
-
report
https://ubuntu.com/security/CVE-2023-52574
-
report
https://ubuntu.com/security/CVE-2023-52650
-
report
https://ubuntu.com/security/CVE-2024-50006
-
report
https://ubuntu.com/security/CVE-2024-50299
-
report
https://ubuntu.com/security/CVE-2024-53124
-
report
https://ubuntu.com/security/CVE-2024-53150
-
report
https://ubuntu.com/security/CVE-2024-56767
-
report
https://ubuntu.com/security/CVE-2025-37838
-
report
https://ubuntu.com/security/CVE-2025-38352
-
report
https://ubuntu.com/security/CVE-2025-40300