CVE-2022-48954
NoneCVSS
—
EPSS
0.3%
Published
Oct 21, 2024
CISA due date
—
Cloudanix analysis
A memory handling mistake in the Linux kernel on certain IBM mainframe network drivers can let attackers crash the system or potentially run malicious code.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Other
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in qeth_l2_br2dev_worker allowing dereference of a freed br2dev_event_work object after KASAN-detected invalid memory access in the s390 qeth driver during bridge FDB event processing.
Why it matters to the business
Risk of kernel crashes, denial of service, or potential privilege escalation on affected s390 Linux systems; low EPSS and no KEV listing reduce immediate widespread impact despite 726 days since publication and mentions in 2024 zero-day campaigns.
How an attack unfolds
Attacker sends crafted netlink messages to add FDB entries triggering br_switchdev_fdb_notify and qeth_l2_switchdev_event which queues work; the work is freed via kmem_cache_free while qeth_l2_br2dev_worker still dereferences the addr field, as shown in the KASAN trace involving atomic_notifier_call_chain and rtnl_fdb_add.
How to fix it
Apply the upstream fix resolving the use-after-free in hsci; for librenms/librenms (GIT) update to commit d959bf1b366319eda16e3cd6dfda8a22beb203be. Rebuild and reboot affected kernels; monitor for similar patterns in downstream dependents.
How to confirm the fix worked
Confirm the patch is present by inspecting qeth_l2_br2dev_worker for proper reference counting or RCU protection around br2dev_event_work; run KASAN-enabled kernels with bridge FDB test cases to verify no use-after-free reports.
Typical attack path
- Send netlink RTM_NEWNEIGH or bridge FDB add messages via rtnl_fdb_add
- Trigger atomic_notifier_call_chain leading to qeth_l2_switchdev_event
- Queue work item that later gets freed by __kmem_cache_free in qeth_l2_br2dev_worker
- Worker thread accesses freed memory at offset causing use-after-free
How to detect it
Search kernel logs for KASAN use-after-free reports mentioning qeth_l2_br2dev_worker, process_one_work, and addresses in kmalloc-96 cache; inspect netlink traffic and bridge FDB add events preceding worker thread crashes.
- qeth_l2_br2dev_worker+0x5ba/0x6b0
- BUG: KASAN: use-after-free in qeth_l2_br2dev_worker
- Workqueue: 0.0.8000_event qeth_l2_br2dev_worker
- Read of size 1 at addr .* by task kworker
What your security team should do
- Prioritize patching s390 systems running affected kernels given mentions in espionage and financially motivated actor campaigns
- Enable KASAN or similar memory debugging in test environments to catch similar UAFs
- Review bridge and qeth configurations for exposure and restrict netlink access where possible
- Monitor EPSS trend (stable at 0.0033) and update asset inventory for Linux kernel prevalence
The record
In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix use-after-free in hsci KASAN found that addr was dereferenced after br2dev_event_work was freed. ================================================================== BUG: KASAN: use-after-free in qeth_l2_br2dev_worker+0x5ba/0x6b0 Read of size 1 at addr 00000000fdcea440 by task kworker/u760:4/540 CPU: 17 PID: 540 Comm: kworker/u760:4 Tainted: G E 6.1.0-20221128.rc7.git1.5aa3bed4ce83.300.fc36.s390x+kasan #1 Hardware name: IBM 8561 T01 703 (LPAR) Workqueue: 0.0.8000_event qeth_l2_br2dev_worker Call Trace: [<000000016944d4ce>] dump_stack_lvl+0xc6/0xf8 [<000000016942cd9c>] print_address_description.constprop.0+0x34/0x2a0 [<000000016942d118>] print_report+0x110/0x1f8 [<0000000167a7bd04>] kasan_report+0xfc/0x128 [<000000016938d79a>] qeth_l2_br2dev_worker+0x5ba/0x6b0 [<00000001673edd1e>] process_one_work+0x76e/0x1128 [<00000001673ee85c>] worker_thread+0x184/0x1098 [<000000016740718a>] kthread+0x26a/0x310 [<00000001672c606a>] __ret_from_fork+0x8a/0xe8 [<00000001694711da>] ret_from_fork+0xa/0x40 Allocated by task 108338: kasan_save_stack+0x40/0x68 kasan_set_track+0x36/0x48 __kasan_kmalloc+0xa0/0xc0 qeth_l2_switchdev_event+0x25a/0x738 atomic_notifier_call_chain+0x9c/0xf8 br_switchdev_fdb_notify+0xf4/0x110 fdb_notify+0x122/0x180 fdb_add_entry.constprop.0.isra.0+0x312/0x558 br_fdb_add+0x59e/0x858 rtnl_fdb_add+0x58a/0x928 rtnetlink_rcv_msg+0x5f8/0x8d8 netlink_rcv_skb+0x1f2/0x408 netlink_unicast+0x570/0x790 netlink_sendmsg+0x752/0xbe0 sock_sendmsg+0xca/0x110 ____sys_sendmsg+0x510/0x6a8 ___sys_sendmsg+0x12a/0x180 __sys_sendmsg+0xe6/0x168 __do_sys_socketcall+0x3c8/0x468 do_syscall+0x22c/0x328 __do_syscall+0x94/0xf0 system_call+0x82/0xb0 Freed by task 540: kasan_save_stack+0x40/0x68 kasan_set_track+0x36/0x48 kasan_save_free_info+0x4c/0x68 ____kasan_slab_free+0x14e/0x1a8 __kasan_slab_free+0x24/0x30 __kmem_cache_free+0x168/0x338 qeth_l2_br2dev_worker+0x154/0x6b0 process_one_work+0x76e/0x1128 worker_thread+0x184/0x1098 kthread+0x26a/0x310 __ret_from_fork+0x8a/0xe8 ret_from_fork+0xa/0x40 Last potentially related work creation: kasan_save_stack+0x40/0x68 __kasan_record_aux_stack+0xbe/0xd0 insert_work+0x56/0x2e8 __queue_work+0x4ce/0xd10 queue_work_on+0xf4/0x100 qeth_l2_switchdev_event+0x520/0x738 atomic_notifier_call_chain+0x9c/0xf8 br_switchdev_fdb_notify+0xf4/0x110 fdb_notify+0x122/0x180 fdb_add_entry.constprop.0.isra.0+0x312/0x558 br_fdb_add+0x59e/0x858 rtnl_fdb_add+0x58a/0x928 rtnetlink_rcv_msg+0x5f8/0x8d8 netlink_rcv_skb+0x1f2/0x408 netlink_unicast+0x570/0x790 netlink_sendmsg+0x752/0xbe0 sock_sendmsg+0xca/0x110 ____sys_sendmsg+0x510/0x6a8 ___sys_sendmsg+0x12a/0x180 __sys_sendmsg+0xe6/0x168 __do_sys_socketcall+0x3c8/0x468 do_syscall+0x22c/0x328 __do_syscall+0x94/0xf0 system_call+0x82/0xb0 Second to last potentially related work creation: kasan_save_stack+0x40/0x68 __kasan_record_aux_stack+0xbe/0xd0 kvfree_call_rcu+0xb2/0x760 kernfs_unlink_open_file+0x348/0x430 kernfs_fop_release+0xc2/0x320 __fput+0x1ae/0x768 task_work_run+0x1bc/0x298 exit_to_user_mode_prepare+0x1a0/0x1a8 __do_syscall+0x94/0xf0 system_call+0x82/0xb0 The buggy address belongs to the object at 00000000fdcea400 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 64 bytes inside of 96-byte region [00000000fdcea400, 00000000fdcea460) The buggy address belongs to the physical page: page:000000005a9c26e8 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xfdcea flags: 0x3ffff00000000200(slab|node=0|zone=1|lastcpupid=0x1ffff) raw: 3ffff00000000200 0000000000000000 0000000100000122 000000008008cc00 raw: 0000000000000000 0020004100000000 ffffffff00000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: 00000000fdcea300: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc 00000000fdcea380: fb fb fb fb fb fb f ---truncated---
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:12 | linux | 0 | 6.1.4-1 |
| Debian:13 | linux | 0 | 6.1.4-1 |
| Linux | Kernel | 5.15.0 | 5.15.83 |
| SUSE:Linux Enterprise High Availability Extension 15 SP4 | kernel-default | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-64kb | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-default | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-default-base | 0 | 5.14.21-150400.24.141.1.150400.24.68.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-docs | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-obs-build | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-source | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | kernel-syms | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-64kb | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-default | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-default-base | 0 | 5.14.21-150400.24.141.1.150400.24.68.2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-docs | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-obs-build | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-source | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | kernel-syms | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Live Patching 15 SP4 | kernel-default | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_33 | 0 | 1-150400.9.5.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5-RT_Update_22 | 0 | 1-150500.11.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_21 | 0 | 1-150500.11.5.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-default | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-default-base | 0 | 5.14.21-150400.24.141.1.150400.24.68.2 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-rt | 0 | 5.14.21-150400.15.100.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-source-rt | 0 | 5.14.21-150400.15.100.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-default | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-default-base | 0 | 5.14.21-150400.24.141.1.150400.24.68.2 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-rt | 0 | 5.14.21-150400.15.100.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-source-rt | 0 | 5.14.21-150400.15.100.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default-base | 0 | 5.14.21-150500.55.88.1.150500.6.39.4 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-rt | 0 | 5.14.21-150500.13.76.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-source-rt | 0 | 5.14.21-150500.13.76.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-64kb | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-default-base | 0 | 5.14.21-150500.55.88.1.150500.6.39.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-source | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-zfcpdump | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-docs | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-obs-build | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-source | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-syms | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | kernel-azure | 0 | 5.14.21-150500.33.72.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | kernel-source-azure | 0 | 5.14.21-150500.33.72.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | kernel-syms-azure | 0 | 5.14.21-150500.33.72.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-64kb | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-default | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-default-base | 0 | 5.14.21-150400.24.141.1.150400.24.68.2 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-docs | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-obs-build | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-source | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-syms | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | kernel-zfcpdump | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-default | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-default-base | 0 | 5.14.21-150400.24.141.1.150400.24.68.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-docs | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-obs-build | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-source | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | kernel-syms | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Manager Proxy 4.3 | kernel-default | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Manager Proxy 4.3 | kernel-default-base | 0 | 5.14.21-150400.24.141.1.150400.24.68.2 |
| SUSE:Manager Proxy 4.3 | kernel-source | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Manager Proxy 4.3 | kernel-syms | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Manager Server 4.3 | kernel-default | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Manager Server 4.3 | kernel-default-base | 0 | 5.14.21-150400.24.141.1.150400.24.68.2 |
| SUSE:Manager Server 4.3 | kernel-source | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Manager Server 4.3 | kernel-syms | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Manager Server 4.3 | kernel-zfcpdump | 0 | 5.14.21-150400.24.141.1 |
| SUSE:Real Time Module 15 SP5 | kernel-rt | 0 | 5.14.21-150500.13.76.1 |
| SUSE:Real Time Module 15 SP5 | kernel-rt_debug | 0 | 5.14.21-150500.13.76.1 |
| SUSE:Real Time Module 15 SP5 | kernel-source-rt | 0 | 5.14.21-150500.13.76.1 |
| SUSE:Real Time Module 15 SP5 | kernel-syms-rt | 0 | 5.14.21-150500.13.76.1 |
| Ubuntu:14.04:LTS | linux | 0 | 3.11.0-12.19 |
| Ubuntu:14.04:LTS | linux-aws | 0 | 4.4.0-1002.2 |
| Ubuntu:14.04:LTS | linux-azure | 0 | 4.15.0-1023.24~14.04.1 |
| Ubuntu:14.04:LTS | linux-lts-xenial | 0 | 4.4.0-13.29~14.04.1 |
| Ubuntu:16.04:LTS | linux | 0 | 4.4.0-2.16 |
| Ubuntu:16.04:LTS | linux-aws | 0 | 4.4.0-1001.10 |
| Ubuntu:16.04:LTS | linux-aws-hwe | 0 | 4.15.0-1030.31~16.04.1 |
| Ubuntu:16.04:LTS | linux-azure | 0 | 4.11.0-1009.9 |
| Ubuntu:16.04:LTS | linux-gcp | 0 | 4.10.0-1004.4 |
| Ubuntu:16.04:LTS | linux-hwe | 0 | 4.8.0-39.42~16.04.1 |
| Ubuntu:16.04:LTS | linux-hwe-edge | 0 | No fix |
| Ubuntu:16.04:LTS | linux-kvm | 0 | 4.4.0-1004.9 |
| Ubuntu:16.04:LTS | linux-oracle | 0 | 4.15.0-1007.9~16.04.1 |
| Ubuntu:18.04:LTS | linux | 0 | 4.13.0-16.19 |
| Ubuntu:18.04:LTS | linux-aws | 0 | 4.15.0-1001.1 |
| Ubuntu:18.04:LTS | linux-aws-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-aws-5.4 | 0 | 5.4.0-1018.18~18.04.1 |
| Ubuntu:18.04:LTS | linux-azure | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure-4.15 | 0 | 4.15.0-1082.92 |
| Ubuntu:18.04:LTS | linux-azure-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-azure-5.4 | 0 | 5.4.0-1020.20~18.04.1 |
| Ubuntu:18.04:LTS | linux-azure-edge | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp-4.15 | 0 | 4.15.0-1071.81 |
| Ubuntu:18.04:LTS | linux-gcp-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gcp-5.4 | 0 | 5.4.0-1019.19~18.04.2 |
| Ubuntu:18.04:LTS | linux-gke-4.15 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gke-5.4 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-gkeop-5.4 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-hwe | 0 | No fix |
| Ubuntu:18.04:LTS | linux-hwe-5.4 | 0 | 5.4.0-37.41~18.04.1 |
| Ubuntu:18.04:LTS | linux-hwe-edge | 0 | 5.0.0-15.16~18.04.1 |
| Ubuntu:18.04:LTS | linux-ibm-5.4 | 0 | 5.4.0-1010.11~18.04.2 |
| Ubuntu:18.04:LTS | linux-kvm | 0 | 4.15.0-1002.2 |
| Ubuntu:18.04:LTS | linux-oem | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle | 0 | 4.15.0-1007.9 |
| Ubuntu:18.04:LTS | linux-oracle-5.0 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.3 | 0 | No fix |
| Ubuntu:18.04:LTS | linux-oracle-5.4 | 0 | 5.4.0-1019.19~18.04.1 |
| Ubuntu:18.04:LTS | linux-raspi-5.4 | 0 | 5.4.0-1013.13~18.04.1 |
| Ubuntu:20.04:LTS | linux | 0 | 5.4.0-9.12 |
| Ubuntu:20.04:LTS | linux-aws | 0 | 5.4.0-1005.5 |
| Ubuntu:20.04:LTS | linux-aws-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-aws-5.15 | 0 | 5.15.0-1031.35~20.04.1 |
| Ubuntu:20.04:LTS | linux-aws-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure | 0 | 5.4.0-1006.6 |
| Ubuntu:20.04:LTS | linux-azure-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-5.15 | 0 | 5.15.0-1034.41~20.04.1 |
| Ubuntu:20.04:LTS | linux-azure-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-fde | 0 | No fix |
| Ubuntu:20.04:LTS | linux-azure-fde-5.15 | 0 | 5.15.0-1034.41~20.04.1.2 |
| Ubuntu:20.04:LTS | linux-bluefield | 0 | 5.4.0-1007.10 |
| Ubuntu:20.04:LTS | linux-gcp | 0 | 5.4.0-1005.5 |
| Ubuntu:20.04:LTS | linux-gcp-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gcp-5.15 | 0 | 5.15.0-1030.37~20.04.1 |
| Ubuntu:20.04:LTS | linux-gcp-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gke | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gke-5.15 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-gkeop | 0 | 5.4.0-1008.9 |
| Ubuntu:20.04:LTS | linux-gkeop-5.15 | 0 | 5.15.0-1016.21~20.04.1 |
| Ubuntu:20.04:LTS | linux-hwe-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-hwe-5.15 | 0 | 5.15.0-67.74~20.04.1 |
| Ubuntu:20.04:LTS | linux-hwe-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-ibm | 0 | 5.4.0-1003.4 |
| Ubuntu:20.04:LTS | linux-ibm-5.15 | 0 | 5.15.0-1033.36~20.04.1 |
| Ubuntu:20.04:LTS | linux-intel-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-intel-iotg-5.15 | 0 | 5.15.0-1026.31~20.04.1 |
| Ubuntu:20.04:LTS | linux-iot | 0 | 5.4.0-1001.3 |
| Ubuntu:20.04:LTS | linux-kvm | 0 | 5.4.0-1004.4 |
| Ubuntu:20.04:LTS | linux-lowlatency-hwe-5.15 | 0 | 5.15.0-67.74~20.04.1 |
| Ubuntu:20.04:LTS | linux-oem-5.10 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.14 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oem-5.6 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle | 0 | 5.4.0-1005.5 |
| Ubuntu:20.04:LTS | linux-oracle-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.13 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-oracle-5.15 | 0 | 5.15.0-1030.36~20.04.1 |
| Ubuntu:20.04:LTS | linux-oracle-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-raspi | 0 | 5.4.0-1007.7 |
| Ubuntu:20.04:LTS | linux-raspi2 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.11 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-riscv-5.15 | 0 | 5.15.0-1030.34~20.04.1 |
| Ubuntu:20.04:LTS | linux-riscv-5.8 | 0 | No fix |
| Ubuntu:20.04:LTS | linux-xilinx-zynqmp | 0 | 5.4.0-1020.24 |
| Ubuntu:22.04:LTS | linux | 0 | 5.15.0-67.74 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws | 0 | 5.15.0-1031.35 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-aws-6.8 | 0 | 6.8.0-1009.9~22.04.2 |
| Ubuntu:22.04:LTS | linux-azure | 0 | 5.15.0-1034.41 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-6.8 | 0 | 6.8.0-1008.8~22.04.1 |
| Ubuntu:22.04:LTS | linux-azure-fde | 0 | 5.15.0-1034.41.1 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp | 0 | 5.15.0-1030.37 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-gcp-6.8 | 0 | 6.8.0-1010.11~22.04.1 |
| Ubuntu:22.04:LTS | linux-gke | 0 | 5.15.0-1028.33 |
| Ubuntu:22.04:LTS | linux-gkeop | 0 | 5.15.0-1016.21 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-hwe-6.8 | 0 | 6.8.0-38.38~22.04.1 |
| Ubuntu:22.04:LTS | linux-ibm | 0 | 5.15.0-1026.29 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | 0 | No fix |
| Ubuntu:22.04:LTS | linux-intel-iotg | 0 | 5.15.0-1026.31 |
| Ubuntu:22.04:LTS | linux-kvm | 0 | 5.15.0-1029.34 |
| Ubuntu:22.04:LTS | linux-lowlatency | 0 | 5.15.0-67.74 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | 0 | No fix |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | 0 | No fix |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39886 In the Linux kernel, the following vulnerability has been resolved: bpf: Tell memcg to… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39880 In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid… Also affects linux
- CVE-2025-39881 In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in… Also affects linux
- CVE-2025-39877 In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix… Also affects linux
- CVE-2025-39871 In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd… Also affects linux