CVE-2025-22055
NoneCVSS
—
EPSS
0.3%
Published
Apr 16, 2025
CISA due date
—
Cloudanix analysis
A flaw in how the Linux kernel handles certain network options could let an attacker cause crashes or peek at internal memory, but it is not widely exploited and is fixed by routine updates.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Integer overflow in 5-bit geneve_opt length field allows a crafted 128-byte option to be interpreted as zero length, bypassing Netlink policy checks and causing heap out-of-bounds read during option parsing in the kernel networking stack.
Why it matters to the business
Attackers with ability to send Netlink messages can trigger kernel crashes or read adjacent kernel memory, leading to denial of service or limited information disclosure on affected Linux systems; low immediate urgency given stable low exploit probability and no known ransomware use.
How an attack unfolds
An attacker crafts a Netlink message containing a geneve option of exactly 128 bytes, sends it via rtnetlink to tc_new_tfilter or similar handlers, and causes the parser to misinterpret the length as zero; this leads to nla_put performing an out-of-bounds read that can be observed in KASAN reports or used to leak data, following patterns seen in other recent kernel privilege-escalation chains.
How to fix it
Upgrade the Linux kernel to a commit containing the length enforcement fix (a2cb85f989e2074e2f392e00188c438cab3de088) or apply the corresponding Red Hat binutils package updates to version 2.30-125.el8_10 or later; enforce the 128-byte upper bound in all Netlink policies for geneve_opt.
How to confirm the fix worked
Verify the running kernel contains the referenced commit or package version; attempt to send a 128-byte geneve option via Netlink and confirm absence of KASAN slab-out-of-bounds reports; review policy definitions for explicit length <= 127 checks.
Typical attack path
- Obtain local or network-adjacent access sufficient to send Netlink messages
- Construct a geneve_opt structure with a precisely sized 128-byte option
- Invoke tc_new_tfilter or tcf_exts_dump path through rtnetlink
- Trigger nla_put on the malformed option resulting in slab-out-of-bounds read
- Observe crash or harvest leaked kernel memory for further exploitation
How to detect it
Search kernel logs for KASAN reports mentioning nla_put, tunnel_key_dump, or slab-out-of-bounds reads originating from rtnetlink or tcf_action_dump paths; inspect Netlink message captures for geneve options exactly 128 bytes in length; correlate with process names such as poc or unexpected tc filter operations.
- BUG: KASAN: slab-out-of-bounds in nla_put
- Read of size 124 at addr
- tunnel_key_dump+0x945
- tcf_action_dump_1+0x1c1
- poc-oob-read
- geneve_opt length integer overflow
What your security team should do
- Apply kernel or binutils updates within normal patching windows given low EPSS and no KEV listing
- Monitor for unusual Netlink traffic to tc filter or action dump paths
- Harden systems that expose rtnetlink to untrusted processes
- Include the fix in next scheduled kernel maintenance cycle
The record
In the Linux kernel, the following vulnerability has been resolved: net: fix geneve_opt length integer overflow struct geneve_opt uses 5 bit length for each single option, which means every vary size option should be smaller than 128 bytes. However, all current related Netlink policies cannot promise this length condition and the attacker can exploit a exact 128-byte size option to *fake* a zero length option and confuse the parsing logic, further achieve heap out-of-bounds read. One example crash log is like below: [ 3.905425] ================================================================== [ 3.905925] BUG: KASAN: slab-out-of-bounds in nla_put+0xa9/0xe0 [ 3.906255] Read of size 124 at addr ffff888005f291cc by task poc/177 [ 3.906646] [ 3.906775] CPU: 0 PID: 177 Comm: poc-oob-read Not tainted 6.1.132 #1 [ 3.907131] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 3.907784] Call Trace: [ 3.907925] <TASK> [ 3.908048] dump_stack_lvl+0x44/0x5c [ 3.908258] print_report+0x184/0x4be [ 3.909151] kasan_report+0xc5/0x100 [ 3.909539] kasan_check_range+0xf3/0x1a0 [ 3.909794] memcpy+0x1f/0x60 [ 3.909968] nla_put+0xa9/0xe0 [ 3.910147] tunnel_key_dump+0x945/0xba0 [ 3.911536] tcf_action_dump_1+0x1c1/0x340 [ 3.912436] tcf_action_dump+0x101/0x180 [ 3.912689] tcf_exts_dump+0x164/0x1e0 [ 3.912905] fw_dump+0x18b/0x2d0 [ 3.913483] tcf_fill_node+0x2ee/0x460 [ 3.914778] tfilter_notify+0xf4/0x180 [ 3.915208] tc_new_tfilter+0xd51/0x10d0 [ 3.918615] rtnetlink_rcv_msg+0x4a2/0x560 [ 3.919118] netlink_rcv_skb+0xcd/0x200 [ 3.919787] netlink_unicast+0x395/0x530 [ 3.921032] netlink_sendmsg+0x3d0/0x6d0 [ 3.921987] __sock_sendmsg+0x99/0xa0 [ 3.922220] __sys_sendto+0x1b7/0x240 [ 3.922682] __x64_sys_sendto+0x72/0x90 [ 3.922906] do_syscall_64+0x5e/0x90 [ 3.923814] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 3.924122] RIP: 0033:0x7e83eab84407 [ 3.924331] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 faf [ 3.925330] RSP: 002b:00007ffff505e370 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 3.925752] RAX: ffffffffffffffda RBX: 00007e83eaafa740 RCX: 00007e83eab84407 [ 3.926173] RDX: 00000000000001a8 RSI: 00007ffff505e3c0 RDI: 0000000000000003 [ 3.926587] RBP: 00007ffff505f460 R08: 00007e83eace1000 R09: 000000000000000c [ 3.926977] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffff505f3c0 [ 3.927367] R13: 00007ffff505f5c8 R14: 00007e83ead1b000 R15: 00005d4fbbe6dcb8 Fix these issues by enforing correct length condition in related policies.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:9 | kernel | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-devel | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-devel-matched | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-modules | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-modules-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-modules-extra | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-devel | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-devel-matched | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-modules | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-modules-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-64k-modules-extra | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-abi-stablelists | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-cross-headers | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-debug | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-debug-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-debug-devel | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-debug-devel-matched | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-debug-modules | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-debug-modules-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-debug-modules-extra | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-debug-uki-virt | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-devel | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-devel-matched | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-doc | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-headers | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-modules | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-modules-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-modules-extra | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-debug | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-debug-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-debug-devel | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-debug-modules | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-debug-modules-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-debug-modules-extra | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-devel | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-modules | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-modules-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-modules-extra | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug-devel | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug-kvm | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug-modules | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug-modules-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug-modules-extra | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-devel | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-kvm | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-modules | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-modules-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-rt-modules-extra | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-tools | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-tools-libs | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-tools-libs-devel | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-uki-virt | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-uki-virt-addons | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump-devel | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump-devel-matched | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump-modules | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump-modules-core | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump-modules-extra | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | libperf | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | perf | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | python3-perf | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | rtla | 0 | 5.14.0-570.21.1.el9_6 |
| AlmaLinux:9 | rv | 0 | 5.14.0-570.21.1.el9_6 |
| Debian:11 | linux | 0 | No fix |
| Debian:11 | linux-6.1 | 0 | 6.1.137-1~deb11u1 |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.25-1 |
| Linux | Kernel | 4.19.0 | 5.10.236 |
| Mageia:9 | kernel | 0 | 6.6.88-3.mga9 |
| Mageia:9 | kernel-linus | 0 | 6.6.88-1.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.0.24-70.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-78.mga9 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kernel-default | 0 | 4.12.14-122.258.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_68 | 0 | 1-8.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_11 | 0 | 1-150600.1.3.2 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_11 | 0 | 1-150600.13.3.1 |
| SUSE:Linux Enterprise Micro 5.1 | kernel-rt | 0 | 5.3.18-150300.208.1 |
| SUSE:Linux Enterprise Micro 5.1 | kernel-source-rt | 0 | 5.3.18-150300.208.1 |
| SUSE:Linux Enterprise Micro 5.2 | kernel-rt | 0 | 5.3.18-150300.208.1 |
| SUSE:Linux Enterprise Micro 5.2 | kernel-source-rt | 0 | 5.3.18-150300.208.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-rt | 0 | 5.14.21-150400.15.118.1 |
| SUSE:Linux Enterprise Micro 5.3 | kernel-source-rt | 0 | 5.14.21-150400.15.118.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-rt | 0 | 5.14.21-150400.15.118.1 |
| SUSE:Linux Enterprise Micro 5.4 | kernel-source-rt | 0 | 5.14.21-150400.15.118.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.50.1.150600.12.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.21.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.37.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.37.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.37.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-azure | 0 | 6.4.0-150700.20.3.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-source-azure | 0 | 6.4.0-150700.20.3.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-syms-azure | 0 | 6.4.0-150700.20.3.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-default | 0 | 4.12.14-122.258.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-source | 0 | 4.12.14-122.258.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-syms | 0 | 4.12.14-122.258.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-default | 0 | 4.12.14-122.258.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-source | 0 | 4.12.14-122.258.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-syms | 0 | 4.12.14-122.258.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.39.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.39.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.39.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.37.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.50.1.150600.12.22.1 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.37.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.50.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.37.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.39.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.50.1 |
Related vulnerabilities
- CVE-2025-68285 In the Linux kernel, the following vulnerability has been resolved: libceph: fix… Also affects kernel
- CVE-2025-68287 In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race… Also affects kernel
- CVE-2025-40277 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate… Also affects kernel
- CVE-2025-40240 In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL… Also affects kernel
- CVE-2025-40185 In the Linux kernel, the following vulnerability has been resolved: ice: ice_adapter… Also affects kernel
- CVE-2025-40176 In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending… Also affects kernel
- CVE-2025-40058 In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow… Also affects kernel
- CVE-2025-39981 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix… Also affects kernel