Red Hat Security Advisory

RHSA-2025:16398

kernel security update

Released 2025-09-23 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-570.46.1.el9_6, kernel-64k-debug-devel-matched-5.14.0-570.46.1.el9_6, kernel-64k-devel-5.14.0-570.46.1.el9_6 +12
Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-570.46.1.el9_6, kernel-64k-5.14.0-570.46.1.el9_6, kernel-64k-core-5.14.0-570.46.1.el9_6 +28
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-570.46.1.el9_6, libperf-5.14.0-570.46.1.el9_6
Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-570.46.1.el9_6, kernel-rt-64k-5.14.0-570.46.1.el9_6, kernel-rt-64k-core-5.14.0-570.46.1.el9_6 +21
Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-570.46.1.el9_6, kernel-rt-core-5.14.0-570.46.1.el9_6, kernel-rt-debug-5.14.0-570.46.1.el9_6 +11

Fixes 4 records

TI-2025-25160 CVE-2025-37810 · GHSA-rpfr-3prf-w7f2

usb: dwc3: gadget: check that event count does not exceed event buffer length

LOW 34

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that event count does not exceed event buffer length The event count is read from register DWC3_GEVNTCOUNT.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00248 Published 2025-05-08 Partial fix · 5.4.293, 5.10.237 +6 CWE-787

TI-2025-25836 CVE-2025-38498 · GHSA-5q28-72v3-hrw6

do_change_type(): refuse to operate on unmounted/not ours mounts

LOW 33

In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00219 Published 2025-07-30 Partial fix · 5.4.295, 5.10.239 +6

TI-2025-26370 CVE-2025-39694 · GHSA-wxfj-mrv6-qf72

s390/sclp: Fix SCCB present check

LOW 31

In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrup…

CVSS 3.1HIGH 7.3 Local Low privileges No interaction EPSS 0.00171 Published 2025-09-05 Partial fix · 6.1.149, 6.6.103 +3 CWE-476

TI-2023-29424 CVE-2023-53125 · GHSA-p8mj-x7w2-cp95

net: usb: smsc75xx: Limit packet length to skb->len

LOW 24

In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Limit packet length to skb->len Packet length retrieved from skb data may be larger than the actual socket buffer length (up to 9026…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00191 Published 2025-05-02 Partial fix · 4.14.311, 4.19.279 +6 CWE-401