Threats Tagged 'cve-2025-21905'

This advisory addresses two moderate-severity vulnerabilities in the Linux kernel packages used by Red Hat Enterprise Linux 8.6. The first vulnerability (CVE-2025-21905) involves the iwlwifi driver printing excessive strings from firmware files. The second vulnerability (CVE-2025-37738) concerns the ext4 filesystem ignoring extended attributes (xattrs) past their expected end. Red Hat has released a security update to fix these issues, and a system reboot is required to apply the update. The update is available for multiple Red Hat Enterprise Linux 8.6 variants. No known exploits are reported in the wild.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Remove dangling pointers (CVE-2024-58002) * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980) * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905) * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958) * kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (CVE-2025-38089) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel packages for Red Hat Enterprise Linux 9. The update fixes issues including double free, use-after-free, out-of-bounds reads, variable overflow, and uninitialized memory access across various kernel components such as media (uvcvideo), wifi (iwlwifi), RDMA, ext4 filesystem, network scheduling, and memory management. The advisory rates the overall security impact as moderate. Systems must be updated and rebooted to apply the fixes.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759) * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980) * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905) * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113) * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958) * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759) * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980) * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905) * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113) * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958) * kernel: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (CVE-2025-38001) * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.