Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- ACPI drivers;
- Hardware monitoring drivers;
- InfiniBand drivers;
- MTD block device drivers;
- Network drivers;
- DesignWare USB3 driver;
- Ceph distributed file system;
- Network file system (NFS) server daemon;
- NILFS2 file system;
- File systems infrastructure;
- Tracing infrastructure;
- Appletalk network protocol;
- IPv6 networking;
- Netfilter;
(CVE-2021-47146, CVE-2021-47269, CVE-2021-47385, CVE-2021-47634,
CVE-2022-49026, CVE-2024-49935, CVE-2024-50067, CVE-2024-50095,
CVE-2024-50179, CVE-2024-53112, CVE-2024-53217, CVE-2025-21715,
CVE-2025-21722, CVE-2025-21811, CVE-2025-21855, CVE-2025-38666,
CVE-2025-39964, CVE-2025-40018)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro FIPS-updates 16.04 LTS Pro:FIPS-updates:16.04:LTS | linux-fips | 4.4.0-1120.127 |
Vulnerabilities 18
-
High 7.8
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, c…
KEV Sep 18, 2026 -
High 8.6
ibmvnic: Don't reference skb after sending to VIOS
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Don't reference skb after sending to VIOS Previously, after successfully flushing the xmit buffer to VIOS, the tx_bytes stat was incremented by the length of the skb. It is invalid t…
-
High 7.8
ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl Hulk Robot reported a KASAN report about use-after-free: ================================================================== …
-
High 7.8
e100: Fix possible use after free in e100_xmit_prepare
In the Linux kernel, the following vulnerability has been resolved: e100: Fix possible use after free in e100_xmit_prepare In e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so e100_xmit_frame() will return NETDEV_TX_BUSY and the upper laye…
-
High 7.8
uprobe: avoid out-of-bounds memory access of fetching args
In the Linux kernel, the following vulnerability has been resolved: uprobe: avoid out-of-bounds memory access of fetching args Uprobe needs to fetch args into a percpu buffer, and then copy to ring buffer to avoid non-atomic context problem. Sometimes user-sp…
-
High 7.8
net: davicom: fix UAF in dm9000_drv_remove
In the Linux kernel, the following vulnerability has been resolved: net: davicom: fix UAF in dm9000_drv_remove dm is netdev private data and it cannot be used after free_netdev() call. Using dm after free_netdev() can cause UAF bug. Fix it by moving free_netd…
-
High 7.8
nilfs2: do not force clear folio if buffer is referenced
In the Linux kernel, the following vulnerability has been resolved: nilfs2: do not force clear folio if buffer is referenced Patch series "nilfs2: protect busy buffer heads from being force-cleared". This series fixes the buffer head state inconsistency issue…
-
High 7.8
nilfs2: protect access to buffers with no active references
In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect access to buffers with no active references nilfs_lookup_dirty_data_buffers(), which iterates through the buffers attached to dirty data folios/pages, accesses the attached bu…
-
High 7.8
ipvs: Defer ip_vs_ftp unregister during netns cleanup
In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leadin…
-
High 7.5
RDMA/mad: Improve handling of timed out WRs of mad agent
In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Improve handling of timed out WRs of mad agent Current timeout handler of mad agent acquires/releases mad_agent_priv lock for every timed out WRs. This causes heavy locking contenti…
-
High 7.5
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent NULL dereference in nfsd4_process_cb_update() @ses is initialized to NULL. If __nfsd4_find_backchannel() finds no available backchannel session, setup_callback_client() will try…
-
Medium 5.5
ceph: remove the incorrect Fw reference check when dirtying pages
In the Linux kernel, the following vulnerability has been resolved: ceph: remove the incorrect Fw reference check when dirtying pages When doing the direct-io reads it will also try to mark pages dirty, but for the read path it won't hold the Fw caps and ther…
-
Unscored —
mld: fix panic in mld_newpack()
In the Linux kernel, the following vulnerability has been resolved: mld: fix panic in mld_newpack() mld_newpack() doesn't allow to allocate high order page, only order-0 allocation is allowed. If headroom size is too large, a kernel panic could occur in skb_p…
-
Unscored —
usb: dwc3: ep0: fix NULL pointer exception
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: ep0: fix NULL pointer exception There is no validation of the index from dwc3_wIndex_to_dep() and we might be referring a non-existing ep and trigger a NULL pointer exception. In c…
-
Unscored —
hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field
In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field If driver read val value sufficient for (val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & …
-
Unscored —
ACPI: PAD: fix crash in exit_round_robin()
In the Linux kernel, the following vulnerability has been resolved: ACPI: PAD: fix crash in exit_round_robin() The kernel occasionally crashes in cpumask_clear_cpu(), which is called within exit_round_robin(), because when executing clear_bit(nr, addr) with n…
-
Unscored —
ocfs2: uncache inode which has failed entering the group
In the Linux kernel, the following vulnerability has been resolved: ocfs2: uncache inode which has failed entering the group Syzbot has reported the following BUG: kernel BUG at fs/ocfs2/uptodate.c:509! ... Call Trace: <TASK> ? __die_body+0x5f/0xb0 ? die+0x9e…
-
Unscored —
net: appletalk: Fix use-after-free in AARP proxy probe
In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix use-after-free in AARP proxy probe The AARP proxy‐probe routine (aarp_proxy_probe_network) sends a probe, releases the aarp_lock, sleeps, then re-acquires the lock. During…
References
-
report
https://ubuntu.com/security/CVE-2021-47146
-
report
https://ubuntu.com/security/CVE-2021-47269
-
report
https://ubuntu.com/security/CVE-2021-47385
-
report
https://ubuntu.com/security/CVE-2021-47634
-
report
https://ubuntu.com/security/CVE-2022-49026
-
report
https://ubuntu.com/security/CVE-2024-49935
-
report
https://ubuntu.com/security/CVE-2024-50067
-
report
https://ubuntu.com/security/CVE-2024-50095
-
report
https://ubuntu.com/security/CVE-2024-50179
-
report
https://ubuntu.com/security/CVE-2024-53112
-
report
https://ubuntu.com/security/CVE-2024-53217
-
report
https://ubuntu.com/security/CVE-2025-21715
-
report
https://ubuntu.com/security/CVE-2025-21722
-
report
https://ubuntu.com/security/CVE-2025-21811
-
report
https://ubuntu.com/security/CVE-2025-21855
-
report
https://ubuntu.com/security/CVE-2025-38666
-
report
https://ubuntu.com/security/CVE-2025-39964
-
report
https://ubuntu.com/security/CVE-2025-40018