Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 architecture;
- MMC subsystem;
- Network drivers;
- USB Device Class drivers;
- BTRFS file system;
- File systems infrastructure;
- XFRM subsystem;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- Simplified Mandatory Access Control Kernel framework;
(CVE-2021-47599, CVE-2022-48875, CVE-2022-49267, CVE-2024-47659,
CVE-2024-49927, CVE-2024-56548, CVE-2024-56593, CVE-2025-21704,
CVE-2025-40215)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-aws | 4.4.0-1152.158 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-lts-xenial | 4.4.0-278.312~14.04.1 |
Vulnerabilities 9
-
Critical 9.1
smack: tcp: ipv4, fix incorrect labeling
In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'fo…
-
High 7.8
hfsplus: don't query the device logical block size multiple times
In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't query the device logical block size multiple times Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause …
-
High 7.8
xfrm: delete x->tunnel as we delete x
In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (…
-
Medium 5.5
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' valu…
-
Unscored —
btrfs: use latest_dev in btrfs_show_devname
In the Linux kernel, the following vulnerability has been resolved: btrfs: use latest_dev in btrfs_show_devname The test case btrfs/238 reports the warning below: WARNING: CPU: 3 PID: 481 at fs/btrfs/super.c:2509 btrfs_show_devname+0x104/0x1e8 [btrfs] CPU: 2 …
-
Unscored —
wifi: mac80211: sdata can be NULL during AMPDU start
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: sdata can be NULL during AMPDU start ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a deauthentication is ongoing. Here a trace triggering the race with th…
-
Unscored —CVE-2022-49267 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
x86/ioapic: Handle allocation failures gracefully
In the Linux kernel, the following vulnerability has been resolved: x86/ioapic: Handle allocation failures gracefully Breno observed panics when using failslab under certain conditions during runtime: can not alloc irq_pin_list (-1,0,20) Kernel panic - not sy…
-
Unscored —
usb: cdc-acm: Check control transfer buffer size before access
In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard…
References
-
report
https://ubuntu.com/security/CVE-2021-47599
-
report
https://ubuntu.com/security/CVE-2022-48875
-
report
https://ubuntu.com/security/CVE-2022-49267
-
report
https://ubuntu.com/security/CVE-2024-47659
-
report
https://ubuntu.com/security/CVE-2024-49927
-
report
https://ubuntu.com/security/CVE-2024-56548
-
report
https://ubuntu.com/security/CVE-2024-56593
-
report
https://ubuntu.com/security/CVE-2025-21704
-
report
https://ubuntu.com/security/CVE-2025-40215