Skip to content
OpenAdvisories
High 1 exploited CVE USN-7928-2 9 CVEs

linux-fips, linux-aws-fips, linux-azure-fips, linux-gcp-fips vulnerabilities

Published Dec 11, 2025 · Updated Nov 3, 2026

Ecosystem: Ubuntu

Summary

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Media drivers;
- Network drivers;
- AFS file system;
- F2FS file system;
- Tracing infrastructure;
- Netfilter;
(CVE-2022-49390, CVE-2024-47691, CVE-2024-50067, CVE-2024-53090,
CVE-2024-53218, CVE-2025-21855, CVE-2025-39964, CVE-2025-39993,
CVE-2025-40018)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro FIPS-updates 22.04 LTS Pro:FIPS-updates:22.04:LTS linux-aws-fips 5.15.0-1098.105+fips1
Ubuntu · Pro FIPS-updates 22.04 LTS Pro:FIPS-updates:22.04:LTS linux-azure-fips 5.15.0-1102.111+fips1
Ubuntu · Pro FIPS-updates 22.04 LTS Pro:FIPS-updates:22.04:LTS linux-fips 5.15.0-164.174+fips1
Ubuntu · Pro FIPS-updates 22.04 LTS Pro:FIPS-updates:22.04:LTS linux-gcp-fips 5.15.0-1098.107+fips1

Vulnerabilities 9

  • High 7.8
    CVE-2025-39964 Exploited Public exploit

    crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

    In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV Sep 18, 2026
  • High 8.6
    CVE-2025-21855

    ibmvnic: Don't reference skb after sending to VIOS

    In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Don't reference skb after sending to VIOS Previously, after successfully flushing the xmit buffer to VIOS, the tx_bytes stat was incremented by the length of the skb. It is invalid t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-49390

    macsec: fix UAF bug for real_dev

    In the Linux kernel, the following vulnerability has been resolved: macsec: fix UAF bug for real_dev Create a new macsec device but not get reference to real_dev. That can not ensure that real_dev is freed after macsec. That will trigger the UAF bug for real_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-50067

    uprobe: avoid out-of-bounds memory access of fetching args

    In the Linux kernel, the following vulnerability has been resolved: uprobe: avoid out-of-bounds memory access of fetching args Uprobe needs to fetch args into a percpu buffer, and then copy to ring buffer to avoid non-atomic context problem. Sometimes user-sp…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-53218

    f2fs: fix race in concurrent f2fs_stop_gc_thread

    In the Linux kernel, the following vulnerability has been resolved: f2fs: fix race in concurrent f2fs_stop_gc_thread In my test case, concurrent calls to f2fs shutdown report the following stack trace: Oops: general protection fault, probably for non-canonica…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-39993

    media: rc: fix races with imon_disconnect()

    In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40018

    ipvs: Defer ip_vs_ftp unregister during netns cleanup

    In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leadin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2024-53090

    afs: Fix lock recursion

    In the Linux kernel, the following vulnerability has been resolved: afs: Fix lock recursion afs_wake_up_async_call() can incur lock recursion. The problem is that it is called from AF_RXRPC whilst holding the ->notify_lock, but it tries to take a ref on the a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-47691

    f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()

    In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread() syzbot reports a f2fs bug as below: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2022-49390
  • report
    https://ubuntu.com/security/CVE-2024-47691
  • report
    https://ubuntu.com/security/CVE-2024-50067
  • report
    https://ubuntu.com/security/CVE-2024-53090
  • report
    https://ubuntu.com/security/CVE-2024-53218
  • report
    https://ubuntu.com/security/CVE-2025-21855
  • report
    https://ubuntu.com/security/CVE-2025-39964
  • report
    https://ubuntu.com/security/CVE-2025-39993
  • report
    https://ubuntu.com/security/CVE-2025-40018