Threats Tagged 'cve-2025-38352'

Red Hat issued a security advisory for multiple kpatch live patch modules targeting kernel version 4.18.0-372.118.1.el8_6. The update addresses two vulnerabilities: a slab-use-after-free read in the tipc_aead_encrypt_done function (CVE-2025-38052) and a race condition between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352). These issues affect Red Hat Enterprise Linux 8.6 and related variants. The advisory rates the impact as Important and requires a system reboot to apply the update.

Red Hat issued a security advisory for kernel live patch modules targeting kernel-4.18.0-477.67.1.el8_8 in Red Hat Enterprise Linux 8.8. The update addresses two vulnerabilities: a slab-use-after-free read in the net/tipc subsystem (CVE-2025-38052) and a race condition in posix-cpu-timers (CVE-2025-38352). These issues could lead to memory corruption or race condition problems in the kernel. The advisory rates the impact as Important and provides patches via kpatch modules. A system reboot is required for the update to take effect.

Red Hat has issued a security advisory for kernel live patch modules targeting kernel-5.14.0-427.31.1.el9_4 in Red Hat Enterprise Linux 9.4 Extended Update Support. The update addresses two vulnerabilities: a use-after-free issue in the TIPC network protocol (CVE-2025-38052) and a race condition in POSIX CPU timers (CVE-2025-38352). These vulnerabilities are fixed by updated kpatch modules that modify the running kernel without requiring downtime. A system reboot is required for the update to take effect.

Red Hat has issued a security advisory for kernel live patch modules targeting kernel-5.14.0-70.112.1.el9_0 in Red Hat Enterprise Linux 9.0. The update addresses two vulnerabilities: a slab-use-after-free read in the net/tipc component (CVE-2025-38052) and a race condition in posix-cpu-timers (CVE-2025-38352). These issues are fixed by updated kpatch modules that can be loaded to modify the running kernel code. A system reboot is required to apply the update effectively.

This Red Hat security advisory addresses two vulnerabilities in the Linux kernel 5.14.0-284.79.1.el9_2 via live patch modules. The first vulnerability (CVE-2025-38052) is a slab-use-after-free read issue in the net/tipc component. The second (CVE-2025-38352) is a race condition in the posix-cpu-timers subsystem. These issues are fixed by updated kpatch modules that can be applied to running kernels. The update requires a system reboot to take effect and is rated as having an Important security impact by Red Hat.

This Red Hat security advisory addresses two vulnerabilities in the Linux kernel 4.18.0-553.16.1.el8_10 via kpatch live patch modules. The first vulnerability (CVE-2025-38052) is a slab-use-after-free read issue in the net/tipc component. The second (CVE-2025-38352) is a race condition in posix-cpu-timers. These issues are fixed by updated kpatch modules that modify the running kernel without rebooting. The update requires a system reboot to take effect and is rated as important by Red Hat.

This advisory addresses two security vulnerabilities in the Red Hat Enterprise Linux 9 kernel live patch module for kernel-5.14.0-570.17.1.el9_6. The first vulnerability (CVE-2025-38052) is a slab-use-after-free read issue in the net/tipc component. The second (CVE-2025-38352) is a race condition between handle_posix_cpu_timers() and posix_cpu_timer_del() in the posix-cpu-timers component. These issues are fixed by the kpatch-patch-5_14_0-570_17_1 and kpatch-patch-5_14_0-570_39_1 updates. Systems must be rebooted after applying the update for the fixes to take effect.

Red Hat has issued a security advisory for multiple vulnerabilities in the Linux kernel packages included in Red Hat Enterprise Linux 9.4 Extended Update Support and related products. The update addresses several issues including use-after-free, double free, race conditions, buffer overflows, and speculation side-channel fixes across various kernel subsystems such as networking, Bluetooth, SCSI, and WiFi. The advisory rates the update as important and requires a system reboot after applying the patches.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097) * kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332) * kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352) * kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085) * kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159) * kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332) * kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352) * kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.