Skip to content
OpenAdvisories
High 1 exploited CVE USN-7874-2 8 CVEs

linux-fips, linux-aws-fips, linux-gcp-fips vulnerabilities

Published Nov 19, 2025 · Updated Oct 30, 2026

Ecosystem: Ubuntu

Summary

Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered
that the Linux kernel contained insufficient branch predictor isolation
between a guest and a userspace hypervisor for certain processors. This
flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this
to expose sensitive information from the host OS. (CVE-2025-40300)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- HSI subsystem;
- I3C subsystem;
- SMB network file system;
- Padata parallel execution mechanism;
- Timer subsystem;
- Networking core;
(CVE-2023-52854, CVE-2024-35867, CVE-2024-50061, CVE-2024-56664,
CVE-2025-21727, CVE-2025-37838, CVE-2025-38352)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro FIPS-updates 20.04 LTS Pro:FIPS-updates:20.04:LTS linux-aws-fips 5.4.0-1152.162+fips1
Ubuntu · Pro FIPS-updates 20.04 LTS Pro:FIPS-updates:20.04:LTS linux-fips 5.4.0-1126.136
Ubuntu · Pro FIPS-updates 20.04 LTS Pro:FIPS-updates:20.04:LTS linux-gcp-fips 5.4.0-1155.164+fips1

Vulnerabilities 8

  • High 7.8
    CVE-2025-38352 Exploited Public exploit

    posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

    In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
    KEV Sep 4, 2025
  • High 7.8
    CVE-2024-35867

    smb: client: fix potential UAF in cifs_stats_proc_show()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_stats_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-56664

    bpf, sockmap: Fix race between element replace and close()

    In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix race between element replace and close() Element replace (with a socket different from the one stored) may race with socket's close() link popping & unlinking. __sock_map_de…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-21727

    padata: fix UAF in padata_reorder

    In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u11…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-37838

    HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition

    In the Linux kernel, the following vulnerability has been resolved: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition In the ssi_protocol_probe() function, &ssi->work is bound with ssip_xmit_work(), In ssip_pn_se…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52854

    padata: Fix refcnt handling in padata_free_shell()

    In the Linux kernel, the following vulnerability has been resolved: padata: Fix refcnt handling in padata_free_shell() In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead to system UAF (Use-After-Free) issues. Due to the lengthy analysis …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-50061

    i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition

    In the Linux kernel, the following vulnerability has been resolved: i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition In the cdns_i3c_master_probe function, &master->hj_work is bound with cdns_i3c_master_hj. A…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40300

    x86/vmscape: Add conditional IBPB mitigation

    In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2023-52854
  • report
    https://ubuntu.com/security/CVE-2024-35867
  • report
    https://ubuntu.com/security/CVE-2024-50061
  • report
    https://ubuntu.com/security/CVE-2024-56664
  • report
    https://ubuntu.com/security/CVE-2025-21727
  • report
    https://ubuntu.com/security/CVE-2025-37838
  • report
    https://ubuntu.com/security/CVE-2025-38352
  • report
    https://ubuntu.com/security/CVE-2025-40300