Important: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

CVE-2025-31930

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m incl. SIM...

kernel: vsock: Keep the binding until socket destruction

A flaw was found in the Linux kernel's virtual socket protocol network driver, where an improperly timed socket unbinding could result in a use-after-free issue. This flaw allows an attacker who can create and destroy arbitrary connections on virtual connections to read or modify system memory,...

The vulnerability of the Windows Ancillary Function Driver for WinSock on Windows operating systems allows attackers to exploit their privileges.

The vulnerability of the Windows Ancillary Function Driver for WinSock operating systems is related to the possibility of using memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2025-31930

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m incl. SIM...

CVE-2025-31929

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions, IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions, IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions, IEC 1Ph 7.4kW Parent cable 7m incl. SIM 8EM1310-2EJ04-3GA2 All...

kernel: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx

In the Linux kernel, the following vulnerability has been resolved: bpf: Add skisinet and ISICSK check in tlsswhasctxtx/rx As the introduction of the support for vsock and unix sockets in sockmap, tlsswhasctxtx/rx cannot presume the socket passed in must be ISICSK. vsock and afunix sockets have...

kernel: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet

A use-after-free vulnerability was found in the Linux kernel. The Bluetooth firmware isn't checked if skb contains an ACL header, otherwise the code may attempt to access some uninitialized or invalid memory past the valid skb-data...

kernel: bpf, sockmap: Fix race between element replace and close()

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix race between element replace and close Element replace with a socket different from the one stored may race with socket's close link popping & unlinking. sockmapdelete unconditionally unrefs the wrong element: /...

kernel: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: Use skbsetlength for resetting urb before resubmit Syzbot points out that skbtrim has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly ju...

kernel: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcommsockalloc btsockalloc attaches allocated sk object to the provided sock object. If rfcommdlcalloc fails, we release the sk object, but leave the dangling pointer in th...

kernel: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: handle NULL sock pointer in l2capsockalloc A NULL sock pointer is passed into l2capsockalloc when it is called from l2capsocknewconnectioncb and the error handling paths should also be aware of it. Seemingly a...

kernel: netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsocket: remove WARNONONCE on maximum cgroup level cgroup maximum depth is INTMAX by default, there is a cgroup toggle to restrict this maximum depth to a more reasonable value not to harm performance. Remove...

kernel: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by scosocktimeout When the sco connection is established and then, the sco socket is releasing, timeoutwork will be scheduled to judge whether the sco disconnection is timeout. The sock...

kernel: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211dostop Since 'devqueuexmit' should be called with interrupts enabled, the following backtrace: ieee80211dostop ... spinlockirqsave&local-queuestopreasonlock, flags...

kernel: sock_map: Add a cond_resched() in sock_hash_free()

In the Linux kernel, the following vulnerability has been resolved: sockmap: Add a condresched in sockhashfree Several syzbot soft lockup reports all have in common sockhashfree If a map with a large number of buckets is destroyed, we need to yield the cpu when needed...

kernel: mptcp: init: protect sched with rcu_read_lock

In the Linux kernel, the following vulnerability has been resolved: mptcp: init: protect sched with rcureadlock Enabling CONFIGPROVERCULIST with its dependence CONFIGRCUEXPERT creates this splat when an MPTCP socket is created: ============================= WARNING: suspicious RCU usage 6.12.0-rc...

kernel: net: fix data-races around sk->sk_forward_alloc

In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk-skforwardalloc Syzkaller reported this warning: ------------ cut here ------------ WARNING: CPU: 0 PID: 16 at net/ipv4/afinet.c:156 inetsockdestruct+0x1c5/0x1e0 Modules linked in: CPU: 0 UID: 0 PID: ...

kernel: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: FIX possible deadlock in rfcommskstatechange rfcommskstatechange attempts to use socklock so it must never be called with it locked but rfcommsockioctl always attempt to lock it causing the following trace:...

kernel: net: inet6: do not leave a dangling sk pointer in inet6_create()

In the Linux kernel, the following vulnerability has been resolved: net: inet6: do not leave a dangling sk pointer in inet6create sockinitdata attaches the allocated sk pointer to the provided sock object. If inet6create fails later, the sk object is released, but the sock object retains the...