The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905)
* kernel: ext4: ignore xattrs past end (CVE-2025-37738)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security advisory from Red Hat addresses multiple use-after-free and related vulnerabilities in the Linux kernel packages included in Red Hat Enterprise Linux 10 and related products. These vulnerabilities affect various kernel subsystems such as padata, HID intel-ish-hid, memstick, ext4, RDMA, network scheduling, TIPC, and NVMe-TCP. The advisory rates the update as important and provides fixes for these issues. Systems must be updated and rebooted to apply the patches.
Red Hat has released a security advisory addressing multiple vulnerabilities in the Linux kernel packages for Red Hat Enterprise Linux 9.2. The update fixes issues including a double free error in the media uvcvideo driver, use-after-free in the TIPC network protocol, and other kernel component flaws. The advisory rates the security impact as Important and requires a system reboot after applying the update.
A vulnerability in the Linux kernel's RDMA mlx5 driver caused an overflow of the page_size variable when registering large contiguous memory regions, leading to a kernel warning and potential instability. This issue was fixed by changing variables to unsigned long to support larger values and prevent overflow. The fix is included in a Red Hat Enterprise Linux 10 kernel update. Several other kernel vulnerabilities were also addressed in this update. The update requires a system reboot to take effect.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net: atm: fix use after free in lec_send() (CVE-2025-22004)
* kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121)
* kernel: ibmvnic: Use kernel helpers for hex dumps (CVE-2025-22104)
* kernel: ext4: fix off-by-one error in do_split (CVE-2025-23150)
* kernel: udmabuf: fix a buf size overflow issue during udmabuf creation (CVE-2025-37803)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: media: uvcvideo: Remove dangling pointers (CVE-2024-58002)
* kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (CVE-2025-38089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: exfat: fix random stack corruption after get_block (CVE-2025-22036)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update addresses an out-of-bounds vulnerability in the Linux kernel's x86 microcode for AMD processors on systems with CPU-less NUMA nodes (CVE-2025-21991). This vulnerability has been rated as moderate severity by Red Hat. The issue affects Red Hat Enterprise Linux 9 and related variants. A patch is available and should be applied, followed by a system reboot to activate the fix.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: bpf: fix OOB devmap writes when deleting elements (CVE-2024-56615)
* kernel: xsk: fix OOB map writes when deleting elements (CVE-2024-56614)
* kernel: md: fix mddev uaf while iterating all_mddevs list (CVE-2025-22126)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)
* kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)
* kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250)
* kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has issued a moderate severity security advisory for the Linux kernel packages in Red Hat Enterprise Linux 10 and related products. The update addresses three vulnerabilities: CVE-2025-21883 (a fix for deinitializing virtual functions in error paths in the ice driver), CVE-2025-21961 (a fix for truesize handling in the bnxt ethernet driver), and CVE-2025-22104 (use of kernel helpers for hex dumps in the ibmvnic driver). These fixes require a system reboot to take effect.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ndisc: use RCU protection in ndisc_alloc_skb() (CVE-2025-21764)
* kernel: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (CVE-2025-21887)
* kernel: keys: Fix UAF in key_put() (CVE-2025-21893)
* kernel: cifs: Fix integer overflow while processing closetimeo mount option (CVE-2025-21962)
* kernel: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd (CVE-2025-21969)
* kernel: cifs: Fix integer overflow while processing acdirmax mount option (CVE-2025-21963)
* kernel: wifi: cfg80211: cancel wiphy_work before freeing wiphy (CVE-2025-21979)
* kernel: smb: client: fix UAF in decryption with multichannel (CVE-2025-37750)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified and fixed in the Linux kernel packages used by Red Hat Enterprise Linux 9 and related distributions. These include fixes for integer overflows, out-of-bounds reads, invalid data access, and enforcement of device type checks. The update addresses six CVEs affecting core kernel components such as networking, VLAN, ext4 filesystem, and WiFi drivers. The vendor has released patches and recommends applying the update and rebooting the system to mitigate these issues.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CVE-2025-21919)
* kernel: cifs: Fix integer overflow while processing acregmax mount option (CVE-2025-21964)
* kernel: ext4: fix OOB read when checking dotdot dir (CVE-2025-37785)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CVE-2024-43842)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update addresses an integer overflow vulnerability in the Linux kernel's CIFS module related to processing the acregmax mount option (CVE-2025-21964). This vulnerability affects the kernel packages used in Red Hat Enterprise Linux 9 and related distributions. The issue has been rated as moderate severity by Red Hat Product Security. A patch is available and should be applied, followed by a system reboot to ensure the update takes effect.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104)
* kernel: vsock: Keep the binding until socket destruction (CVE-2025-21756)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.