The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

* kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

* kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

* kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

* kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

* kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

* kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)

* kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243)

* kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)

* kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

Bug Fix(es) and Enhancement(s):

* [octeon_ep]: Verify VF ID [rhel-9.4.z] (JIRA:RHEL-117605)

* libceph: CEPH_CRYPTO_AES256KRB5 (--key-type aes256k) support [rhel-9.4.z] (JIRA:RHEL-168925)

* [RHEL-9] Performance impact of CVE-2025-38085 [rhel-9.4.z] (JIRA:RHEL-161144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

linux

linux-aws

linux-azure

linux-lts-xenial

linux-aws-hwe

linux-gcp

linux-hwe

linux-hwe-edge

linux-kvm

linux-oracle

linux-fips

linux-aws-5.0

linux-aws-5.3

linux-aws-5.4

linux-azure-4.15

linux-azure-5.3

linux-azure-5.4

linux-azure-edge

linux-gcp-4.15

linux-gcp-5.3

linux-gcp-5.4

linux-gke-4.15

linux-gke-5.4

linux-gkeop-5.4

linux-hwe-5.4

linux-ibm-5.4

linux-oem

linux-oracle-5.0

linux-oracle-5.3

linux-oracle-5.4

linux-raspi-5.4

linux-aws-fips

linux-azure-fips

linux-gcp-fips

linux-aws-5.11

linux-aws-5.13

linux-aws-5.15

linux-aws-5.8

linux-azure-5.11

linux-azure-5.13

linux-azure-5.15

linux-azure-5.8

linux-azure-fde

linux-bluefield

linux-gcp-5.11

linux-gcp-5.13

linux-gcp-5.15

linux-gcp-5.8

linux-gke

linux-gke-5.15

linux-gkeop

linux-gkeop-5.15

linux-hwe-5.11

linux-hwe-5.13

linux-hwe-5.15

linux-hwe-5.8

linux-ibm

linux-ibm-5.15

linux-intel-5.13

linux-intel-iotg-5.15

linux-iot

linux-lowlatency-hwe-5.15

linux-nvidia-tegra-5.15

linux-oem-5.10

linux-oem-5.13

linux-oem-5.14

linux-oem-5.6

linux-oracle-5.11

linux-oracle-5.13

linux-oracle-5.15

linux-oracle-5.8

linux-raspi

linux-raspi2

linux-riscv

linux-riscv-5.11

linux-riscv-5.15

linux-riscv-5.8

In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expected for a particular encoding version, out-of-bounds reads may ensue because the only bounds check that is there is based on that length value. This patch adds explicit bounds checks for each field that is decoded or skipped.

CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps in Linux kernel

CVE-2025-71116 is a critical vulnerability in the Linux kernel's libceph component affecting version 3.9. It involves insufficient bounds checking in the decode_pool() function when processing corrupted osdmaps, which can lead to out-of-bounds reads. The vulnerability has been addressed by adding explicit bounds checks for each decoded or skipped field.

Search: CVE-2025-71116