The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)
* kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Linux kernel (net/mlx5): Use-after-free in ECVF vports unload leads to denial of service (CVE-2025-38109)
* kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)
* kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210)
* kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() (CVE-2026-23231)
For more details about the security issue(s), including the impa
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem (CVE-2025-38180)
* kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (CVE-2025-40096)
* kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure (CVE-2026-23144)
* kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution (CVE-2026-23171)
* kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193)
* kerne
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CVE-2025-39818)
* kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168)
* kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085)
* kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (CVE-2023-53034)
* kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)
* kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304)
* kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling (CVE-2025-40322)
* kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_inva
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net: openvswitch: fix nested key length validation in the set() action (CVE-2025-37789)
* kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819)
* kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CVE-2025-38022)
* kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code execution (CVE-2025-38024)
* kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation (CVE-2025-38415)
* kernel: vso
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568)
* kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154)
* kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting (CVE-2025-38141)
* kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349)
* kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731)
* kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248)
* kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258)
* kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service (
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: drm/xe: Make dma-fences compliant with the safe access rules (CVE-2025-38703)
* kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length (CVE-2025-39933)
* kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277)
* kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CVE-2025-68287)
* kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285)
For more details about the security issu
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806)
* kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840)
* kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883)
* kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499)
* kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966)
* kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925)
* kernel: net/mlx5: fs, fix UAF in flow counter release (CVE-2025-39979)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830)
* kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689)
* kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744)
* kernel: vfs: fix race between evice_inodes() and find_inode()&iput() (CVE-2024-47679)
* kernel: x86/tdx: Fix "in-kernel MMIO" check (CVE-2024-47727)
* kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864)
* kernel: io_uring: check if we need to reschedule d
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: vsock/virtio: Validate length in packet header before skb_put() (CVE-2025-39718)
* kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)
* kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751)
* kernel: fs/smb: Fix inconsistent refcnt update (CVE-2025-39819)
* kernel: pstore/ram: Check start of empty przs during init (CVE-2023-53331)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, ref
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556)
* kernel: eventpoll: Fix semi-unbounded recursion (CVE-2025-38614)
* kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)
* kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472)
* kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527)
* kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)
* kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682)
* kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and oth
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097)
* kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332)
* kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352)
* kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References sect