Red Hat Security AdvisoryRHSA-2025:21760
kernel security update
Released 2025-11-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder EUS (v.9.4) kernel-tools-libs-devel-5.14.0-427.100.1.el9_4, libperf-5.14.0-427.100.1.el9_4
- Red Hat Enterprise Linux AppStream EUS (v.9.4) kernel-64k-debug-devel-5.14.0-427.100.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.100.1.el9_4, kernel-64k-devel-5.14.0-427.100.1.el9_4 +11
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool-7.3.0-427.100.1.el9_4, kernel-5.14.0-427.100.1.el9_4, kernel-64k-5.14.0-427.100.1.el9_4 +29
- Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt-5.14.0-427.100.1.el9_4, kernel-rt-core-5.14.0-427.100.1.el9_4, kernel-rt-debug-5.14.0-427.100.1.el9_4 +9
- Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt-5.14.0-427.100.1.el9_4, kernel-rt-core-5.14.0-427.100.1.el9_4, kernel-rt-debug-5.14.0-427.100.1.el9_4 +11
Fixes 9 records
Priority MEDIUM 49
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00449 · Published 2025-09-05 · Partial fix · 5.10.249, 5.15.190 +5 CWE-203
Priority LOW 39
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memor…
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00222 · Published 2025-09-19 · Partial fix · 6.1.151, 6.3 +4 CWE-787
Priority LOW 35
In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00171 · Published 2025-09-04 · Partial fix · 5.4.297, 5.10.241 +7 CWE-908
Priority LOW 33
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothi…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00159 · Published 2025-09-05 · Partial fix · 5.10.242, 5.15.191 +5 CWE-362
Priority LOW 33
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding th…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.002 · Published 2025-09-04 · Partial fix · 5.4.297, 5.10.241 +7 CWE-787
Priority LOW 33
In the Linux kernel, the following vulnerability has been resolved: crypto: xts - Handle EBUSY correctly As it is xts only handles the special return value of EINPROGRESS, which means that in all other cases it will free…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00164 · Published 2025-10-01 · Partial fix · 5.10.173, 5.15.99 +3 CWE-416
Priority LOW 30
In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98…
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00167 · Published 2025-09-16 · Partial fix · 3.9, 5.4.298 +7 CWE-125
Priority LOW 30
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declare…
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00179 · Published 2025-09-11 · Partial fix · 5.4.297, 5.10.241 +7 CWE-125
Priority LOW 25
In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a user…
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00378 · Published 2025-09-11 · Partial fix · 3.17, 4.5 +7
THREATIST.IORead the docs