A security update for the SUSE Linux Enterprise 16.0 kernel addresses multiple security vulnerabilities across various kernel subsystems including timers, btrfs, SCSI, io_uring, netfilter, md, smb, x86, powerpc, cgroup, nvme, and others. These fixes resolve issues such as use-after-free, race conditions, NULL pointer dereferences, buffer overflows, and logic errors. The update mitigates a broad range of potential security risks in the kernel.

Security update for the Linux Kernel

This security update for the SUSE Linux Enterprise 16.0 kernel addresses multiple security vulnerabilities across various kernel subsystems. The fixes include race conditions, use-after-free errors, NULL pointer dereferences, buffer overflows, and other memory safety issues. These vulnerabilities affect components such as timers, btrfs, SCSI drivers, netfilter, cgroup, md/raid, SMB client, and others. The update mitigates these issues to improve kernel stability and security.

A security update for the SUSE Linux Enterprise 16.0 kernel addresses multiple security vulnerabilities, including race conditions, use-after-free bugs, NULL pointer dereferences, and other memory safety issues across various kernel subsystems such as timers, btrfs, SCSI, netfilter, and others. These fixes mitigate potential stability and security risks in the kernel.

A security update for the SUSE Linux Enterprise 16.0 kernel addresses multiple vulnerabilities across various kernel subsystems including timers, filesystems, networking, device drivers, and more. These fixes resolve issues such as use-after-free, race conditions, NULL pointer dereferences, and other memory safety bugs. The update mitigates a broad range of potential security risks in the kernel.

A security update for the SUSE Linux Enterprise 16.0 kernel addresses multiple security vulnerabilities affecting various kernel subsystems including timers, btrfs, SCSI drivers, netfilter, cgroup, and others. These fixes resolve issues such as use-after-free, race conditions, NULL pointer dereferences, and memory leaks. The update mitigates a broad range of potential security risks by correcting these defects.

A denial of service vulnerability (CVE-2025-68214) exists in the Linux kernel used by Red Hat Enterprise Linux 9. It is caused by a NULL function pointer race condition during timer shutdown. Red Hat has released a kernel update addressing this issue along with other bug fixes and enhancements. The update requires a system reboot to take effect. The security impact is rated as low by Red Hat Product Security.

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

This Red Hat security advisory addresses vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 10. It includes fixes for two security issues: a denial of service caused by a NULL function pointer race in timer shutdown (CVE-2025-68214) and an issue in procfs related to fetching build ID while holding a VMA lock (CVE-2026-23199). The update also contains various bug fixes and enhancements. The advisory rates the security impact as moderate and recommends applying the update and rebooting the system to ensure the fixes take effect.

linux-hwe-edge

linux-aws-5.0

linux-aws-5.3

linux-aws-5.4

linux-azure

linux-azure-5.3

linux-azure-5.4

linux-azure-edge

linux-gcp

linux-gcp-5.3

linux-gcp-5.4

linux-gke-4.15

linux-gke-5.4

linux-gkeop-5.4

linux-hwe

linux-hwe-5.4

linux-ibm-5.4

linux-oem

linux-oracle-5.0

linux-oracle-5.3

linux-oracle-5.4

linux-raspi-5.4

linux

linux-aws

linux-aws-5.11

linux-aws-5.13

linux-aws-5.15

linux-aws-5.8

linux-azure-5.11

linux-azure-5.13

linux-azure-5.15

linux-azure-5.8

linux-azure-fde

linux-azure-fde-5.15

linux-bluefield

linux-gcp-5.11

linux-gcp-5.13

linux-gcp-5.15

linux-gcp-5.8

linux-gke

linux-gke-5.15

linux-gkeop

linux-gkeop-5.15

linux-hwe-5.11

linux-hwe-5.13

linux-hwe-5.15

linux-hwe-5.8

linux-ibm

linux-ibm-5.15

linux-intel-5.13

linux-intel-iotg-5.15

linux-iot

linux-kvm

linux-lowlatency-hwe-5.15

linux-nvidia-tegra-5.15

linux-oem-5.10

linux-oem-5.13

linux-oem-5.14

linux-oem-5.6

linux-oracle

linux-oracle-5.11

linux-oracle-5.13

linux-oracle-5.15

linux-oracle-5.8

linux-raspi

linux-raspi2

linux-riscv

linux-riscv-5.11

linux-riscv-5.15

linux-riscv-5.8

linux-xilinx-zynqmp

linux-aws-fips

linux-azure-fips

linux-fips

linux-gcp-fips

linux-allwinner-5.19

linux-aws-5.19

linux-aws-6.2

linux-aws-6.5

linux-aws-6.8

linux-azure-5.19

linux-azure-6.2

linux-azure-6.5

linux-azure-6.8

linux-azure-fde-5.19

linux-azure-fde-6.2

linux-azure-fde-6.8

linux-gcp-5.19

linux-gcp-6.2

linux-gcp-6.5

linux-gcp-6.8

In the Linux kernel, the following vulnerability has been resolved: timers: Fix NULL function pointer race in timer_shutdown_sync() There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timers(). The issue occurs when timer_shutdown_sync() clears the timer function to NULL while the timer is still running on another CPU. The race scenario looks like this: CPU0					CPU1 					<SOFTIRQ> 					lock_timer_base() 					expire_timers() 					base->running_timer = timer; 					unlock_timer_base() 					[call_timer_fn enter] 					mod_timer() 					... timer_shutdown_sync() lock_timer_base() // For now, will not detach the timer but only clear its function to NULL if (base->running_timer != timer) 	ret = detach_if_pending(timer, base, true); if (shutdown) 	timer->function = NULL; unlock_timer_base() 					[call_timer_fn exit] 					lock_timer_base() 					base->running_timer = NULL; 					unlock_timer_base() 					... 					// Now timer is pending while its function set to NULL. 					// next timer trigger 					<SOFTIRQ> 					expire_timers() 					WARN_ON_ONCE(!fn) // hit 					... lock_timer_base() // Now timer will detach if (base->running_timer != timer) 	ret = detach_if_pending(timer, base, true); if (shutdown) 	timer->function = NULL; unlock_timer_base() The problem is that timer_shutdown_sync() clears the timer function regardless of whether the timer is currently running. This can leave a pending timer with a NULL function pointer, which triggers the WARN_ON_ONCE(!fn) check in expire_timers(). Fix this by only clearing the timer function when actually detaching the timer. If the timer is running, leave the function pointer intact, which is safe because the timer will be properly detached when it finishes running.

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() in Linux kernel

Search: CVE-2025-68214