RHSA-2025:21118 - Security Advisory

Topic

An update for kernel is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498)
• kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697)
• kernel: vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)
• kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)
• kernel: mm: swap: fix potential buffer overflow in setup_clusters() (CVE-2025-39727)
• kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)
• kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751)
• kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)
• kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)
• kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849)
• kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841)
• kernel: kernfs: Fix UAF in polling when open file is released (CVE-2025-39881)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for x86_64 10 x86_64
• Red Hat Enterprise Linux for IBM z Systems 10 s390x
• Red Hat Enterprise Linux for Power, little endian 10 ppc64le
• Red Hat Enterprise Linux for ARM 64 10 aarch64
• Red Hat CodeReady Linux Builder for x86_64 10 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 10 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x

Fixes

• BZ - 2384422 - CVE-2025-38498 kernel: do_change_type(): refuse to operate on unmounted/not ours mounts
• BZ - 2393481 - CVE-2025-39697 kernel: NFS: Fix a race when updating an existing write
• BZ - 2393507 - CVE-2025-39718 kernel: vsock/virtio: Validate length in packet header before skb_put()
• BZ - 2393533 - CVE-2025-39702 kernel: ipv6: sr: Fix MAC comparison to be constant-time
• BZ - 2393733 - CVE-2025-39727 kernel: mm: swap: fix potential buffer overflow in setup_clusters()
• BZ - 2394615 - CVE-2025-39757 kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors
• BZ - 2394624 - CVE-2025-39751 kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
• BZ - 2394627 - CVE-2025-40300 kernel: x86/vmscape: Add conditional IBPB mitigation
• BZ - 2395805 - CVE-2025-39817 kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
• BZ - 2396928 - CVE-2025-39849 kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
• BZ - 2396944 - CVE-2025-39841 kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path
• BZ - 2397558 - CVE-2025-39881 kernel: kernfs: Fix UAF in polling when open file is released

CVEs

• CVE-2025-38498
• CVE-2025-39697
• CVE-2025-39702
• CVE-2025-39718
• CVE-2025-39727
• CVE-2025-39751
• CVE-2025-39757
• CVE-2025-39817
• CVE-2025-39841
• CVE-2025-39849
• CVE-2025-39881
• CVE-2025-40300

References

• https://access.redhat.com/security/updates/classification/#moderate