The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)
* kernel: kernfs: Fix UAF in polling when open file is released (CVE-2025-39881)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)
* kernel: vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)
* kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)
* kernel: mm: swap: fix potential buffer overflow in setup_clusters() (CVE-2025-39727)
* kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751)
* kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (CVE-2025-38351)
* kernel: sunrpc: fix client side handling of tls alerts (CVE-2025-38571)
* kernel: eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)
* kernel: ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572)
* kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)
* kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)
* kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling (CVE-2025-39761)
* kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)
* kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823)
* kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200)
* kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449)
* kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)
* kernel: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500)
* kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length (CVE-2025-37810)
* kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200)
* kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461)
* kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449)
* kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)
* kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security vulnerability in the Linux kernel related to the anon_inode_make_secure_inode() function and secretmem LSM bypass has been resolved. The issue involved improper security context creation for anonymous inodes used by KVM guest_memfd and a security regression where the S_PRIVATE flag was not cleared, allowing LSM/SELinux checks to be bypassed. This vulnerability affects Red Hat Enterprise Linux 10 and related products. A patch is available and must be applied with a system reboot.
A race condition vulnerability in the Linux kernel's netfilter nf_conntrack subsystem could cause a crash due to removal of an uninitialized connection tracking entry. The issue arises from a timing window where a partially initialized conntrack entry is accessed concurrently, leading to use of invalid pointers and a kernel crash. This flaw has been fixed by adjusting the order of setting the confirmed bit and inserting the entry into the hash table, along with memory barriers to prevent reordering.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net (CVE-2024-50121)
* kernel: udp: Fix memory accounting leak. (CVE-2025-22058)
* kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length (CVE-2025-37810)
* kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211)
* kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A moderate severity vulnerability in the Linux kernel related to IPv6 multicast handling has been resolved. The issue involves the timing of releasing a reference to pmc->idev in the mld_del_delrec() function, which could lead to use of a freed reference in ip6_mc_clear_src(). This flaw affects various Red Hat Enterprise Linux 9 kernel packages and SUSE kernel versions. A security update is available and should be applied with a system reboot.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097)
* kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)
* kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352)
* kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A buffer size overflow vulnerability in the Linux kernel's udmabuf component has been fixed by casting the size_limit_mb to a 64-bit unsigned integer during pglimit calculation. This issue affects certain versions of the Linux kernel used in Red Hat Enterprise Linux 9 and SUSE products. The vulnerability has been assigned CVE-2025-37803 and is rated with high severity. A security update is available and should be applied, requiring a system reboot for the fix to take effect.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380)
* kernel: tls: always refresh the queue when reading sock (CVE-2025-38471)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2024-28956 is an information disclosure vulnerability affecting some Intel processors, involving exposure of sensitive information through shared microarchitectural structures during transient execution. It requires local authenticated access and has a medium severity rating with a CVSS score of 5.7. Red Hat has released security updates for the Linux kernel and microcode_ctl packages in Red Hat Enterprise Linux 9 to address this issue. Users must apply these updates and reboot their systems to mitigate the vulnerability.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CVE-2025-21867)
* kernel: net: fix udp gso skb_segment after pull from frag_list (CVE-2025-38124)
* kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250)
* kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380)
* kernel: tls: always refresh the queue when reading sock (CVE-2025-38471)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878)
* kernel: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CVE-2024-41035)
* kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020)
* kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026)
* kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797)
* kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.