Red Hat Security Advisory

RHSA-2025:21463

kernel security update

Released 2025-11-17 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-124.11.1.el10_1, kernel-64k-debug-devel-matched-6.12.0-124.11.1.el10_1, kernel-64k-devel-6.12.0-124.11.1.el10_1 +12
Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-124.11.1.el10_1, kernel-64k-6.12.0-124.11.1.el10_1, kernel-64k-core-6.12.0-124.11.1.el10_1 +29
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-124.11.1.el10_1, libperf-6.12.0-124.11.1.el10_1
Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-124.11.1.el10_1, kernel-rt-64k-6.12.0-124.11.1.el10_1, kernel-rt-64k-core-6.12.0-124.11.1.el10_1 +21
Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-124.11.1.el10_1, kernel-rt-core-6.12.0-124.11.1.el10_1, kernel-rt-debug-6.12.0-124.11.1.el10_1 +9

Fixes 4 records

TI-2025-26618 CVE-2025-39946 · GHSA-cgf5-f6fj-4v5q

tls: make sure to abort the stream if headers are bogus

MEDIUM 61

In the Linux kernel, the following vulnerability has been resolved: tls: make sure to abort the stream if headers are bogus Normally we wait for the socket to buffer up the whole record before we service it.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10258 Published 2025-10-04 Partial fix · 6.1.154, 6.6.108 +3

TI-2025-26538 CVE-2025-39864 · GHSA-mrpv-wrf5-7wr6

wifi: cfg80211: fix use-after-free in cmp_bss()

MEDIUM 40

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks prop…

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00235 Published 2025-09-19 Partial fix · 5.4.299, 5.10.243 +6 CWE-416

TI-2025-25949 CVE-2025-38614 · GHSA-grcg-mgx8-mfvf

eventpoll: Fix semi-unbounded recursion

LOW 35

In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00185 Published 2025-08-19 Partial fix · 2.6.33, 2.6.34 +10 CWE-674

TI-2025-26575 CVE-2025-39903 · GHSA-gm32-xqh2-ff6r

of_numa: fix uninitialized memory nodes causing kernel panic

LOW 24

In the Linux kernel, the following vulnerability has been resolved: of_numa: fix uninitialized memory nodes causing kernel panic When there are memory-only nodes (nodes without CPUs), these nodes are not properly initial…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00146 Published 2025-10-01 Fixed in 6.12.46, 6.16.6 +1 CWE-476