Skip to content
Fencer Vulns
medium 5.5

CVE-2025-22058 json

udp: Fix memory accounting leak.

published 2025-04-16 18 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-11236

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

udp: Fix memory accounting leak.

Matt Dowling reported a weird UDP memory usage issue.

Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. However, it occasionally spiked to 524,288 pages and never dropped. Moreover, the value doubled when the application was terminated. Finally, it caused intermittent packet drops.

We can reproduce the issue with the script below [0]:

1. /proc/net/sockstat reports 0 pages

# cat /proc/net/sockstat | grep UDP: UDP: inuse 1 mem 0

2. Run the script till the report reaches 524,288

# python3 test.py & sleep 5 # cat /proc/net/sockstat | grep UDP: UDP: inuse 3 mem 524288 <-- (INT_MAX + 1) >> PAGE_SHIFT

3. Kill the socket and confirm the number never drops

# pkill python3 && sleep 5 # cat /proc/net/sockstat | grep UDP: UDP: inuse 1 mem 524288

4. (necessary since v6.0) Trigger proto_memory_pcpu_drain()

# python3 test.py & sleep 1 && pkill python3

5. The number doubles

# cat /proc/net/sockstat | grep UDP: UDP: inuse 1 mem 1048577

The application set INT_MAX to SO_RCVBUF, which triggered an integer overflow in udp_rmem_release().

When a socket is close()d, udp_destruct_common() purges its receive queue and sums up skb->truesize in the queue. This total is calculated and stored in a local unsigned integer variable.

The total size is then passed to udp_rmem_release() to adjust memory accounting. However, because the function takes a signed integer argument, the total size can wrap around, causing an overflow.

Then, the released amount is calculated as follows:

1) Add size to sk->sk_forward_alloc. 2) Round down sk->sk_forward_alloc to the nearest lower multiple of PAGE_SIZE and assign it to amount. 3) Subtract amount from sk->sk_forward_alloc. 4) Pass amount >> PAGE_SHIFT to __sk_mem_reduce_allocated().

When the issue occurred, the total in udp_destruct_common() was 2147484480 (INT_MAX + 833), which was cast to -2147482816 in udp_rmem_release().

At 1) sk->sk_forward_alloc is changed from 3264 to -2147479552, and 2) sets -2147479552 to amount. 3) reverts the wraparound, so we don't see a warning in inet_sock_destruct(). However, udp_memory_allocated ends up doubling at 4).

Since commit 3cd3399dd7a8 ("net: implement per-cpu reserves for memory_allocated"), memory usage no longer doubles immediately after a socket is close()d because __sk_mem_reduce_allocated() caches the amount in udp_memory_per_cpu_fw_alloc. However, the next time a UDP socket receives a packet, the subtraction takes effect, causing UDP memory usage to double.

This issue makes further memory allocation fail once the socket's sk->sk_rmem_alloc exceeds net.ipv4.udp_rmem_min, resulting in packet drops.

To prevent this issue, let's use unsigned int for the calculation and call sk_forward_alloc_add() only once for the small delta.

Note that first_packet_length() also potentially has the same problem.

[0]: from socket import *

SO_RCVBUFFORCE = 33 INT_MAX = (2 ** 31) - 1

s = socket(AF_INET, SOCK_DGRAM) s.bind(('', 0)) s.setsockopt(SOL_SOCKET, SO_RCVBUFFORCE, INT_MAX)

c = socket(AF_INET, SOCK_DGRAM) c.connect(s.getsockname())

data = b'a' * 100

while True: c.send(data)

Patch / fix

  • Linux Linux 5.4.301, 5.10.246, 5.15.195, 6.1.134, 6.6.87, 6.12.23, 6.13.11, 6.14.2, 6.15
  • linux Debian 12 6.1.135-1
  • linux Debian 14, Debian 13 6.12.25-1

debian advisories DEBIAN-CVE-2025-22058

  • linux Ubuntu 22.04 LTS 5.15.0-170.180
  • linux Ubuntu 24.04 LTS 6.8.0-86.87
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1100.107
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1041.43
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1100.109
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1042.45
  • linux-gke Ubuntu 22.04 LTS 5.15.0-1096.102
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1038.43

ubuntu advisories UBUNTU-CVE-2025-22058

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 10.0 6.12.0-55.30.1.el10_0
  • rv RHEL 10.0 6.12.0-55.30.1.el10_0
  • perf RHEL 10.0 6.12.0-55.30.1.el10_0
  • rtla RHEL 10.0 6.12.0-55.30.1.el10_0
  • libperf RHEL 10.0 6.12.0-55.30.1.el10_0
  • kernel-rt RHEL 10.0 6.12.0-55.30.1.el10_0
  • kernel-64k RHEL 10.0 6.12.0-55.30.1.el10_0
  • kernel-core RHEL 10.0 6.12.0-55.30.1.el10_0

red hat advisories RHSA-2025:22752RHSA-2025:17124RHSA-2025:17009RHSA-2025:16669RHSA-2025:15670RHSA-2025:15669

  • kernel-rt Real Time Module 15 SP7 6.4.0-150700.7.3.1
  • kernel-syms-rt Real Time Module 15 SP7 6.4.0-150700.7.3.1
  • kernel-rt_debug Real Time Module 15 SP7 6.4.0-150700.7.3.1
  • kernel-source-rt Real Time Module 15 SP7 6.4.0-150700.7.3.1
  • kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.20.3.1
  • kernel-syms-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.20.3.1
  • kernel-source-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.20.3.1
  • kernel-rt Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.39.1

suse advisories SUSE-SU-2025:01983-1SUSE-SU-2025:01972-1SUSE-SU-2025:01967-1SUSE-SU-2025:01964-1SUSE-SU-2025:01951-1SUSE-SU-2025:01919-1

  • kernel-abi-stablelists AlmaLinux 10 6.12.0-55.30.1.el10_0
  • kernel AlmaLinux 9 5.14.0-570.37.1.el9_6
  • rv AlmaLinux 9 5.14.0-570.37.1.el9_6
  • perf AlmaLinux 9 5.14.0-570.37.1.el9_6
  • rtla AlmaLinux 9 5.14.0-570.37.1.el9_6
  • libperf AlmaLinux 9 5.14.0-570.37.1.el9_6
  • kernel-rt AlmaLinux 9 5.14.0-570.37.1.el9_6
  • kernel-64k AlmaLinux 9 5.14.0-570.37.1.el9_6

almalinux advisories ALSA-2025:15005ALSA-2025:14420ALSA-2025:14438ALSA-2025:14439

  • kernel Rocky Linux 9 5.14.0-570.37.1.el9_6
  • kernel Rocky Linux 10 6.12.0-55.30.1.el10_0

rocky linux advisories RLSA-2025:14420RLSA-2025:15005

  • kernel CBL-Mariner 2.0 5.15.200.1-1

azure linux advisories AZL-69542

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-22058 updated cvss 7.1

kernel: udp: Fix memory accounting leak.

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    affected: workaround, no fix available
  • Red Hat CodeReady Linux Builder EUS (v.9.4) libperf 5.14.0-427.91.1.el9_4, kernel-debuginfo-common-s390x 5.14.0-427.91.1.el9_4, kernel-debuginfo-common-x86_64 5.14.0-427.91.1.el9_4, kernel-debuginfo-common-aarch64 5.14.0-427.91.1.el9_4, kernel-debuginfo-common-ppc64le 5.14.0-427.91.1.el9_4
    fixed: vendor fix RHSA-2025:16669
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-570.37.1.el9_6, perf 5.14.0-570.37.1.el9_6, rtla 5.14.0-570.37.1.el9_6, python3-perf 5.14.0-570.37.1.el9_6, kernel-devel-matched 5.14.0-570.37.1.el9_6, kernel-64k-devel-matched 5.14.0-570.37.1.el9_6, +7 more
    fixed: vendor fix RHSA-2025:14420
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-55.30.1.el10_0, perf 6.12.0-55.30.1.el10_0, rtla 6.12.0-55.30.1.el10_0, python3-perf 6.12.0-55.30.1.el10_0, kernel-devel-matched 6.12.0-55.30.1.el10_0, kernel-64k-devel-matched 6.12.0-55.30.1.el10_0, +7 more
    fixed: vendor fix RHSA-2025:15005
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) perf 5.14.0-70.146.1.el9_0, kernel-devel-matched 5.14.0-70.146.1.el9_0, kernel-debug-devel-matched 5.14.0-70.146.1.el9_0, kernel-debuginfo-common-s390x 5.14.0-70.146.1.el9_0, kernel-zfcpdump-devel-matched 5.14.0-70.146.1.el9_0, kernel-debuginfo-common-x86_64 5.14.0-70.146.1.el9_0, +2 more
    fixed: vendor fix RHSA-2025:15670
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) perf 5.14.0-284.137.1.el9_2, rtla 5.14.0-284.137.1.el9_2, kernel-devel-matched 5.14.0-284.137.1.el9_2, kernel-64k-devel-matched 5.14.0-284.137.1.el9_2, kernel-debug-devel-matched 5.14.0-284.137.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.137.1.el9_2, +5 more
    fixed: vendor fix RHSA-2025:15669
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) rv 5.14.0-427.91.1.el9_4, perf 5.14.0-427.91.1.el9_4, rtla 5.14.0-427.91.1.el9_4, kernel-devel-matched 5.14.0-427.91.1.el9_4, kernel-64k-devel-matched 5.14.0-427.91.1.el9_4, kernel-debug-devel-matched 5.14.0-427.91.1.el9_4, +6 more
    fixed: vendor fix RHSA-2025:16669
show 29 more
  • Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-553.71.1.el8_10, kernel 4.18.0-553.71.1.el8_10, bpftool 4.18.0-553.71.1.el8_10, kernel-core 4.18.0-553.71.1.el8_10, kernel-tools 4.18.0-553.71.1.el8_10, python3-perf 4.18.0-553.71.1.el8_10, +15 more
    fixed: vendor fix RHSA-2025:14438
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-570.37.1.el9_6, kernel-64k 5.14.0-570.37.1.el9_6, kernel-core 5.14.0-570.37.1.el9_6, kernel-tools 5.14.0-570.37.1.el9_6, kernel-modules 5.14.0-570.37.1.el9_6, kernel-64k-core 5.14.0-570.37.1.el9_6, +27 more
    fixed: vendor fix RHSA-2025:14420
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-55.30.1.el10_0, kernel-64k 6.12.0-55.30.1.el10_0, kernel-core 6.12.0-55.30.1.el10_0, kernel-tools 6.12.0-55.30.1.el10_0, kernel-modules 6.12.0-55.30.1.el10_0, kernel-64k-core 6.12.0-55.30.1.el10_0, +27 more
    fixed: vendor fix RHSA-2025:15005
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) perf 4.18.0-193.168.1.el8_2, kernel 4.18.0-193.168.1.el8_2, bpftool 4.18.0-193.168.1.el8_2, kernel-core 4.18.0-193.168.1.el8_2, kernel-tools 4.18.0-193.168.1.el8_2, python3-perf 4.18.0-193.168.1.el8_2, +8 more
    fixed: vendor fix RHSA-2025:15656
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) perf 4.18.0-305.179.1.el8_4, kernel 4.18.0-305.179.1.el8_4, bpftool 4.18.0-305.179.1.el8_4, kernel-core 4.18.0-305.179.1.el8_4, kernel-tools 4.18.0-305.179.1.el8_4, python3-perf 4.18.0-305.179.1.el8_4, +8 more
    fixed: vendor fix RHSA-2025:22752
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) perf 4.18.0-372.162.1.el8_6, kernel 4.18.0-372.162.1.el8_6, bpftool 4.18.0-372.162.1.el8_6, kernel-core 4.18.0-372.162.1.el8_6, kernel-tools 4.18.0-372.162.1.el8_6, python3-perf 4.18.0-372.162.1.el8_6, +8 more Red Hat Enterprise Linux BaseOS E4S (v.8.6) perf 4.18.0-372.162.1.el8_6, kernel 4.18.0-372.162.1.el8_6, bpftool 4.18.0-372.162.1.el8_6, kernel-core 4.18.0-372.162.1.el8_6, kernel-tools 4.18.0-372.162.1.el8_6, python3-perf 4.18.0-372.162.1.el8_6, +15 more
    fixed: vendor fix RHSA-2025:17124
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) perf 4.18.0-477.112.1.el8_8, kernel 4.18.0-477.112.1.el8_8, bpftool 4.18.0-477.112.1.el8_8, kernel-core 4.18.0-477.112.1.el8_8, kernel-tools 4.18.0-477.112.1.el8_8, python3-perf 4.18.0-477.112.1.el8_8, +9 more
    fixed: vendor fix RHSA-2025:17009
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) kernel 5.14.0-70.146.1.el9_0, bpftool 5.14.0-70.146.1.el9_0, kernel-core 5.14.0-70.146.1.el9_0, kernel-tools 5.14.0-70.146.1.el9_0, python3-perf 5.14.0-70.146.1.el9_0, kernel-modules 5.14.0-70.146.1.el9_0, +14 more
    fixed: vendor fix RHSA-2025:15670
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool 7.0.0-284.137.1.el9_2, kernel 5.14.0-284.137.1.el9_2, kernel-64k 5.14.0-284.137.1.el9_2, kernel-core 5.14.0-284.137.1.el9_2, kernel-tools 5.14.0-284.137.1.el9_2, python3-perf 5.14.0-284.137.1.el9_2, +28 more
    fixed: vendor fix RHSA-2025:15669
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool 7.3.0-427.91.1.el9_4, kernel 5.14.0-427.91.1.el9_4, kernel-64k 5.14.0-427.91.1.el9_4, kernel-core 5.14.0-427.91.1.el9_4, kernel-tools 5.14.0-427.91.1.el9_4, python3-perf 5.14.0-427.91.1.el9_4, +28 more
    fixed: vendor fix RHSA-2025:16669
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) perf 4.18.0-305.179.1.el8_4, kernel 4.18.0-305.179.1.el8_4, bpftool 4.18.0-305.179.1.el8_4, kernel-core 4.18.0-305.179.1.el8_4, kernel-tools 4.18.0-305.179.1.el8_4, python3-perf 4.18.0-305.179.1.el8_4, +8 more
    fixed: vendor fix RHSA-2025:22752
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) perf 4.18.0-372.162.1.el8_6, kernel 4.18.0-372.162.1.el8_6, bpftool 4.18.0-372.162.1.el8_6, kernel-core 4.18.0-372.162.1.el8_6, kernel-tools 4.18.0-372.162.1.el8_6, python3-perf 4.18.0-372.162.1.el8_6, +8 more
    fixed: vendor fix RHSA-2025:17124
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) perf 4.18.0-477.112.1.el8_8, kernel 4.18.0-477.112.1.el8_8, bpftool 4.18.0-477.112.1.el8_8, kernel-core 4.18.0-477.112.1.el8_8, kernel-tools 4.18.0-477.112.1.el8_8, python3-perf 4.18.0-477.112.1.el8_8, +8 more
    fixed: vendor fix RHSA-2025:17009
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-570.37.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.37.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.37.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.37.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.37.1.el9_6
    fixed: vendor fix RHSA-2025:14420
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-55.30.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.30.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.30.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.30.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.30.1.el10_0
    fixed: vendor fix RHSA-2025:15005
  • Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-553.71.1.el8_10, kernel-debuginfo-common-aarch64 4.18.0-553.71.1.el8_10, kernel-debuginfo-common-ppc64le 4.18.0-553.71.1.el8_10
    fixed: vendor fix RHSA-2025:14438
  • Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-553.71.1.rt7.412.el8_10, kernel-rt-kvm 4.18.0-553.71.1.rt7.412.el8_10, kernel-rt-core 4.18.0-553.71.1.rt7.412.el8_10, kernel-rt-modules 4.18.0-553.71.1.rt7.412.el8_10, kernel-rt-debug-kvm 4.18.0-553.71.1.rt7.412.el8_10, kernel-rt-debug-core 4.18.0-553.71.1.rt7.412.el8_10, +4 more
    fixed: vendor fix RHSA-2025:14439
  • Red Hat Enterprise Linux NFV E4S (v.9.0) kernel-rt 5.14.0-70.146.1.rt21.218.el9_0, kernel-rt-kvm 5.14.0-70.146.1.rt21.218.el9_0, kernel-rt-core 5.14.0-70.146.1.rt21.218.el9_0, kernel-rt-modules 5.14.0-70.146.1.rt21.218.el9_0, kernel-rt-debug-kvm 5.14.0-70.146.1.rt21.218.el9_0, kernel-rt-debug-core 5.14.0-70.146.1.rt21.218.el9_0, +4 more
    fixed: vendor fix RHSA-2025:15658
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-570.37.1.el9_6, kernel-rt-64k 5.14.0-570.37.1.el9_6, kernel-rt-core 5.14.0-570.37.1.el9_6, kernel-rt-modules 5.14.0-570.37.1.el9_6, kernel-rt-64k-core 5.14.0-570.37.1.el9_6, kernel-rt-debug-core 5.14.0-570.37.1.el9_6, +14 more
    fixed: vendor fix RHSA-2025:14420
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-55.30.1.el10_0, kernel-rt-64k 6.12.0-55.30.1.el10_0, kernel-rt-core 6.12.0-55.30.1.el10_0, kernel-rt-modules 6.12.0-55.30.1.el10_0, kernel-rt-64k-core 6.12.0-55.30.1.el10_0, kernel-rt-debug-core 6.12.0-55.30.1.el10_0, +14 more
    fixed: vendor fix RHSA-2025:15005
  • Red Hat Enterprise Linux Real Time E4S (v.9.0) kernel-rt 5.14.0-70.146.1.rt21.218.el9_0, kernel-rt-core 5.14.0-70.146.1.rt21.218.el9_0, kernel-rt-modules 5.14.0-70.146.1.rt21.218.el9_0, kernel-rt-debug-core 5.14.0-70.146.1.rt21.218.el9_0, kernel-rt-debug-modules 5.14.0-70.146.1.rt21.218.el9_0, kernel-rt-modules-extra 5.14.0-70.146.1.rt21.218.el9_0, +2 more
    fixed: vendor fix RHSA-2025:15658
  • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt 5.14.0-284.137.1.rt14.422.el9_2, kernel-rt-core 5.14.0-284.137.1.rt14.422.el9_2, kernel-rt-modules 5.14.0-284.137.1.rt14.422.el9_2, kernel-rt-debug-core 5.14.0-284.137.1.rt14.422.el9_2, kernel-rt-modules-core 5.14.0-284.137.1.rt14.422.el9_2, kernel-rt-debug-modules 5.14.0-284.137.1.rt14.422.el9_2, +4 more
    fixed: vendor fix RHSA-2025:15657
  • Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt 5.14.0-427.91.1.el9_4, kernel-rt-core 5.14.0-427.91.1.el9_4, kernel-rt-modules 5.14.0-427.91.1.el9_4, kernel-rt-debug-core 5.14.0-427.91.1.el9_4, kernel-rt-modules-core 5.14.0-427.91.1.el9_4, kernel-rt-debug-modules 5.14.0-427.91.1.el9_4, +4 more
    fixed: vendor fix RHSA-2025:16669
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-570.37.1.el9_6, kernel-rt-kvm 5.14.0-570.37.1.el9_6, kernel-rt-core 5.14.0-570.37.1.el9_6, kernel-rt-modules 5.14.0-570.37.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.37.1.el9_6, kernel-rt-debug-core 5.14.0-570.37.1.el9_6, +6 more
    fixed: vendor fix RHSA-2025:14420
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-55.30.1.el10_0, kernel-rt-kvm 6.12.0-55.30.1.el10_0, kernel-rt-core 6.12.0-55.30.1.el10_0, kernel-rt-modules 6.12.0-55.30.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.30.1.el10_0, kernel-rt-debug-core 6.12.0-55.30.1.el10_0, +6 more
    fixed: vendor fix RHSA-2025:15005
  • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt 5.14.0-284.137.1.rt14.422.el9_2, kernel-rt-kvm 5.14.0-284.137.1.rt14.422.el9_2, kernel-rt-core 5.14.0-284.137.1.rt14.422.el9_2, kernel-rt-modules 5.14.0-284.137.1.rt14.422.el9_2, kernel-rt-debug-kvm 5.14.0-284.137.1.rt14.422.el9_2, kernel-rt-debug-core 5.14.0-284.137.1.rt14.422.el9_2, +6 more
    fixed: vendor fix RHSA-2025:15657
  • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt 5.14.0-427.91.1.el9_4, kernel-rt-kvm 5.14.0-427.91.1.el9_4, kernel-rt-core 5.14.0-427.91.1.el9_4, kernel-rt-modules 5.14.0-427.91.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.91.1.el9_4, kernel-rt-debug-core 5.14.0-427.91.1.el9_4, +6 more
    fixed: vendor fix RHSA-2025:16669
  • Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-553.71.1.rt7.412.el8_10, kernel-rt-core 4.18.0-553.71.1.rt7.412.el8_10, kernel-rt-modules 4.18.0-553.71.1.rt7.412.el8_10, kernel-rt-debug-core 4.18.0-553.71.1.rt7.412.el8_10, kernel-rt-debug-modules 4.18.0-553.71.1.rt7.412.el8_10, kernel-rt-modules-extra 4.18.0-553.71.1.rt7.412.el8_10, +2 more
    fixed: vendor fix RHSA-2025:14439
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) kernel-doc 5.14.0-70.146.1.el9_0 Red Hat Enterprise Linux AppStream E4S (v.9.2) kernel-doc 5.14.0-284.137.1.el9_2
    not affected: vulnerable code not present

5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.