Red Hat Security Advisory

RHSA-2025:22392

kernel security update

Released 2025-12-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder EUS (v.9.6) kernel-tools-libs-devel-5.14.0-570.69.1.el9_6, libperf-5.14.0-570.69.1.el9_6
Red Hat Enterprise Linux AppStream EUS (v.9.6) kernel-64k-debug-devel-5.14.0-570.69.1.el9_6, kernel-64k-debug-devel-matched-5.14.0-570.69.1.el9_6, kernel-64k-devel-5.14.0-570.69.1.el9_6 +12
Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel-5.14.0-570.69.1.el9_6, kernel-64k-5.14.0-570.69.1.el9_6, kernel-64k-core-5.14.0-570.69.1.el9_6 +28
Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt-5.14.0-570.69.1.el9_6, kernel-rt-64k-5.14.0-570.69.1.el9_6, kernel-rt-64k-core-5.14.0-570.69.1.el9_6 +21
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt-5.14.0-570.69.1.el9_6, kernel-rt-core-5.14.0-570.69.1.el9_6, kernel-rt-debug-5.14.0-570.69.1.el9_6 +11

Fixes 7 records

TI-2025-26059 CVE-2025-38724 · GHSA-x8r2-g34h-2v3j

nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

MEDIUM 43

In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the retu…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00406 Published 2025-09-04 Partial fix · 5.4.297, 5.10.241 +7 CWE-416

TI-2025-26538 CVE-2025-39864 · GHSA-mrpv-wrf5-7wr6

wifi: cfg80211: fix use-after-free in cmp_bss()

MEDIUM 40

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks prop…

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00235 Published 2025-09-19 Partial fix · 5.4.299, 5.10.243 +6 CWE-416

TI-2025-26856 CVE-2025-40186 · GHSA-qx52-pj36-489j

tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().

LOW 38

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00585 Published 2025-11-12 Partial fix · 5.4.301, 5.10.246 +7

TI-2025-26590 CVE-2025-39918 · GHSA-64qw-p444-mx2m

wifi: mt76: fix linked list corruption

LOW 37

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix linked list corruption Never leave scheduled wcid entries on the temporary on-stack list

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00207 Published 2025-10-01 Partial fix · 6.12.46, 6.16.6 +1

TI-2025-26627 CVE-2025-39955 · GHSA-63w2-9qrq-4h94

tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().

LOW 35

In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00165 Published 2025-10-09 Partial fix · 5.4.300, 5.10.245 +6

TI-2025-26554 CVE-2025-39881 · GHSA-9jvj-xhwx-w88x

kernfs: Fix UAF in polling when open file is released

LOW 33

In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in polling when open file is released A use-after-free (UAF) vulnerability was identified in the PSI (Pressure Stall Information) monito…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00154 Published 2025-09-23 Fixed in 6.1.153, 6.6.107 +3 CWE-416

TI-2025-26556 CVE-2025-39883 · GHSA-r5ff-446r-jr83

mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory

LOW 30

In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory When I did memory failure tests, below panic occurs: page dumped because:…

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00157 Published 2025-09-23 Partial fix · 5.4.300, 5.10.245 +6 CWE-125