Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- HID subsystem;
- InfiniBand drivers;
- Network drivers;
- PCI subsystem;
- SCSI subsystem;
- JFS file system;
- Network file system (NFS) client;
- OCFS2 file system;
(CVE-2022-49082, CVE-2025-39730, CVE-2025-39743, CVE-2025-39783,
CVE-2025-39810, CVE-2025-39824, CVE-2026-74350, CVE-2026-74394)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws-5.4 | 5.4.0-1167.178~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-raspi-5.4 | 5.4.0-1149.162~18.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-raspi | 5.4.0-1149.162 |
Vulnerabilities 8
-
Critical 9.8
ocfs2: validate fast symlink target during inode read
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the files…
-
Critical 9.8
RDMA/srpt: fix integer overflow in immediate data length check
In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check imm_buf->len is a user-controlled uint32_t received from the network. Adding it to imm_data_offset without overflow checking all…
-
High 7.8
scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove()
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove() The function mpt3sas_transport_port_remove() called in _scsih_expander_node_remove() frees the port field of the sas_expande…
-
High 7.8
bnxt_en: Fix memory corruption when FW resources change during ifdown
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into…
-
Unscored —
NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle.
-
Unscored —
jfs: truncate good inode pages when hard link is 0
In the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so …
-
Unscored —
PCI: endpoint: Fix configfs group list head handling
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, no…
-
Unscored —
HID: asus: fix UAF via HID_CLAIMED_INPUT validation
In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT…
References
-
report
https://ubuntu.com/security/CVE-2022-49082
-
report
https://ubuntu.com/security/CVE-2025-39730
-
report
https://ubuntu.com/security/CVE-2025-39743
-
report
https://ubuntu.com/security/CVE-2025-39783
-
report
https://ubuntu.com/security/CVE-2025-39810
-
report
https://ubuntu.com/security/CVE-2025-39824
-
report
https://ubuntu.com/security/CVE-2026-74350
-
report
https://ubuntu.com/security/CVE-2026-74394