CVE-2025-31115

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on t...

CVE-2025-31115 XZ has a heap-use-after-free bug in threaded .xz decoder

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on t...

CVE-2025-31115 XZ has a heap-use-after-free bug in threaded .xz decoder

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on t...

opentelemetry-collector bug fix and enhancement update

An update is available for opentelemetry-collector. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the...

glibc bug fix update

An update is available for glibc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The glibc packages provide the standard C libraries libc, POSIX thread librarie...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.23 bug fix and security update

Red Hat OpenShift Container Platform release 4.17.23 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.38 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.38 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

CVE-2025-21988 fs/netfs/read_collect: add to next->prev_donated

In the Linux kernel, the following vulnerability has been resolved: fs/netfs/readcollect: add to next-prevdonated If multiple subrequests donate data to the same "next" request depending on the subrequest completion order, each of them would overwrite the prevdonated field, causing data corruptio...

CVE-2025-21959

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: Fully initialize struct nfconncounttuple in inserttree Since commit b36e4523d4d5 "netfilter: nfconncount: fix garbage collection confirm race", cpu and jiffies32 were introduced to the struct...

CVE-2025-21920

In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leaks the address of a kernel function to...

UBUNTU-CVE-2025-21931

In the Linux kernel, the following vulnerability has been resolved: hwpoison, memoryhotplug: lock folio before unmap hwpoisoned folio Commit b15c87263a69 "hwpoison, memoryhotplug: allow hwpoisoned pages to be offlined add page poison checks in domigraterange in order to make offline hwpoisoned pa...

CVE-2025-21976 fbdev: hyperv_fb: Allow graceful removal of framebuffer

In the Linux kernel, the following vulnerability has been resolved: fbdev: hypervfb: Allow graceful removal of framebuffer When a Hyper-V framebuffer device is unbind, hypervfb driver tries to release the framebuffer forcefully. If this framebuffer is in use it produce the following WARN and henc...

CVE-2025-21944

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix bug on trap in smb2lock If lock count is greater than 1, flags could be old value. It should be checked with flags of smblock, not flags. It will cause bug-on trap from locksfreelock in error handling routine...

CVE-2025-21944

CVE-2025-21944 concerns the ksmbd component of the Linux kernel, where a bug in trap handling for smb2_lock can occur if the lock count exceeds 1. The root cause is that the code checked flags from the wrong source (flags) instead of the flags of smb_lock, which may lead to an erroneous trap in t...

CVE-2025-21942

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix extent range end unlock in cowfilerange Running generic/751 on the for-next branch often results in a hang like below. They are both stack by locking an extent. This suggests someone forget to unlock an extent...

CVE-2025-21934 rapidio: fix an API misues when rio_add_net() fails

In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when rioaddnet fails rioaddnet calls deviceregister and fails when deviceregister fails. Thus, putdevice should be used rather than kfree. Add "mport-net = NULL;" to avoid a use after free issue...

CVE-2025-21926

CVE-2025-21926 affects the Linux kernel net: gso code path, specifically __udp_gso_segment. The destructor for the skb is removed before segmenting, but the socket reference is left intact. If the original skb is later orphaned, a kernel bug can trigger (skb_orphan crash in ip_rcv_core). The issu...

CVE-2025-21920 vlan: enforce underlying device type

In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leaks the address of a kernel function to...

CVE-2025-21897

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix picktaskscx picking non-queued tasks when it's called without balance a6250aa251ea "schedext: Handle cases where picktaskscx is called without preceding balancescx" added a workaround to handle the cases where...

CVE-2025-21896 fuse: revert back to __readahead_folio() for readahead

In the Linux kernel, the following vulnerability has been resolved: fuse: revert back to readaheadfolio for readahead In commit 3eab9d7bc2f4 "fuse: convert readahead to use folios", the logic was converted to using the new folio readahead code, which drops the reference on the folio once it is...