RHSA-2025:23463HighCVSS 7.6

Red Hat Security Advisory: kernel security update

Published
December 17, 2025
Last Modified
August 13, 2026

🔗 CVE IDs covered (14)

CVE-2025-38718 →CVE-2025-38729 →CVE-2025-39841 →CVE-2025-39955 →CVE-2022-50406 →CVE-2023-53297 →CVE-2023-53322 →CVE-2023-53365 →CVE-2023-53393 →CVE-2025-38724 →CVE-2025-39757 →CVE-2025-40186 →CVE-2023-53226 →CVE-2024-46679 →

📋 Description

CVE-2022-50406 — kernel: iomap: iomap: fix memory corruption when recording errors during writeback CVE-2023-53226 — kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets CVE-2023-53297 — kernel: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp CVE-2023-53322 — kernel: scsi: qla2xxx: Wait for io return on terminate rport CVE-2023-53365 — kernel: ip6mr: Fix skb_under_panic in ip6mr_cache_report() CVE-2023-53393 — kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device CVE-2024-46679 — kernel: ethtool: check device is present when getting link settings CVE-2025-38718 — kernel: sctp: linearize cloned gso packets in sctp_rcv CVE-2025-38724 — kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() CVE-2025-38729 — kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too CVE-2025-39757 — kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors CVE-2025-39841 — kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path CVE-2025-39955 — kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() CVE-2025-40186 — kernel: Linux kernel: Privilege escalation or Denial of Service via TCP Fast Open vulnerability

🎯 Affected products52

  • Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • bpftool-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • bpftool-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • bpftool-debuginfo-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • bpftool-debuginfo-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-0:4.18.0-305.182.1.el8_4.src as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-0:4.18.0-305.182.1.el8_4.src as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-abi-stablelists-0:4.18.0-305.182.1.el8_4.noarch as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-abi-stablelists-0:4.18.0-305.182.1.el8_4.noarch as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-core-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-core-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debug-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debug-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debug-core-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debug-core-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debug-debuginfo-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debug-debuginfo-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debug-devel-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debug-devel-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debug-modules-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debug-modules-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debug-modules-extra-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debug-modules-extra-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debuginfo-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debuginfo-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • kernel-debuginfo-common-x86_64-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • kernel-debuginfo-common-x86_64-0:4.18.0-305.182.1.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • +22 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: To mitigate this issue, prevent module mwifiex from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, prevent module sctp from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.

🔗 References (17)