Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5
CVSS Details
- CVSS 3.1 Base Score: 6.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 12, 2022 |
| Centos_linux | — | Upgrade kernelUpgrade kernel-rt | Sep 18, 2023 | Aug 12, 2022 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Aug 12, 2022 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelists | Nov 3, 2022 | Aug 12, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade perfUpgrade kernel-headersUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-develUpgrade kernel | Mar 9, 2023 | Aug 12, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade python-perfUpgrade kernel-headersUpgrade kernel-develUpgrade bpftoolUpgrade kernel-toolsUpgrade perfUpgrade python3-perf | Oct 11, 2022 | Aug 12, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel | Nov 15, 2022 | Aug 12, 2022 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 5, 2022 | Aug 12, 2022 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Sep 18, 2023 | Aug 12, 2022 |
| Suse | — | Upgrade cluster-md-kmp-64kbUpgrade kernel-macrosUpgrade dlm-kmp-azureUpgrade kernel-vanilla-baseUpgrade dtb-zteUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade dtb-qcomUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-preemptUpgrade kernel-default-optionalUpgrade kernel-64kb-extraUpgrade dtb-xilinxUpgrade dtb-exynosUpgrade kernel-default-extraUpgrade dtb-armUpgrade dtb-nvidiaUpgrade kernel-preempt-extraUpgrade kernel-develUpgrade kernel-defaultUpgrade cluster-md-kmp-preemptUpgrade dlm-kmp-preemptUpgrade dtb-apmUpgrade dtb-mediatekUpgrade kernel-syms-azureUpgrade kernel-obs-qaUpgrade kernel-debug-baseUpgrade kernel-rtUpgrade kernel-64kb-develUpgrade dtb-rockchipUpgrade kernel-azure-develUpgrade dtb-alUpgrade kselftests-kmp-preemptUpgrade dtb-allwinnerUpgrade kernel-devel-azureUpgrade dtb-sprdUpgrade kernel-azure-livepatch-develUpgrade gfs2-kmp-preemptUpgrade kernel-obs-buildUpgrade kernel-default-base-rebuildUpgrade kernel-vanilla-livepatch-develUpgrade kernel-docsUpgrade ocfs2-kmp-defaultUpgrade kernel-default-livepatchUpgrade dtb-lgUpgrade kernel-64kb-optionalUpgrade kernel-vanillaUpgrade kernel-preempt-develUpgrade kernel-debug-livepatch-develUpgrade kernel-kvmsmall-baseUpgrade kernel-vanilla-develUpgrade kernel-source-azureUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-default-develUpgrade kernel-debug-develUpgrade kernel-debugUpgrade gfs2-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-azure-baseUpgrade kernel-preempt-optionalUpgrade kselftests-kmp-azureUpgrade kernel-default-baseUpgrade dtb-amlogicUpgrade dtb-amdUpgrade reiserfs-kmp-64kbUpgrade kernel-symsUpgrade dtb-marvellUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-preempt-livepatch-develUpgrade dtb-socionextUpgrade dtb-freescaleUpgrade dtb-caviumUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmallUpgrade ocfs2-kmp-azureUpgrade dlm-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-64kb-livepatch-develUpgrade dlm-kmp-defaultUpgrade dtb-hisiliconUpgrade kernel-zfcpdump-manUpgrade kernel-default-manUpgrade kernel-azure-optionalUpgrade dtb-alteraUpgrade gfs2-kmp-azureUpgrade dtb-renesasUpgrade ocfs2-kmp-preemptUpgrade kernel-azure-extraUpgrade kernel-64kbUpgrade kernel-docs-htmlUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-preemptUpgrade kernel-sourceUpgrade dtb-broadcomUpgrade kernel-azure | Oct 26, 2022 | Aug 12, 2022 |
| Ubuntu | — | Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.15.0-47-generic-lpaeUpgrade linux-image-5.15.0-1017-gcpUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.15.0-1015-intel-iotgUpgrade linux-image-5.4.0-1085-awsUpgrade linux-image-4.4.0-239-lowlatencyUpgrade linux-image-oem-20.04Upgrade linux-image-4.4.0-1155-awsUpgrade linux-image-5.15.0-1015-gkeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-1014-raspiUpgrade linux-image-5.15.0-48-lowlatencyUpgrade linux-image-5.15.0-1002-gkeopUpgrade linux-image-5.15.0-1019-azureUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-1013-ibmUpgrade linux-image-5.15.0-1017-oracleUpgrade linux-image-5.4.0-1091-azureUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gke-5.4Upgrade linux-image-4.4.0-239-genericUpgrade linux-image-5.15.0-47-lowlatencyUpgrade linux-image-generic-lpae-hwe-22.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-48-lowlatency-64kUpgrade linux-image-awsUpgrade linux-image-5.4.0-1083-oracleUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-5.4.0-1070-raspiUpgrade linux-image-azureUpgrade linux-image-5.15.0-47-generic-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.4.0-1075-kvmUpgrade linux-image-4.4.0-1117-awsUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-oemUpgrade linux-image-5.4.0-126-lowlatencyUpgrade linux-image-5.15.0-48-genericUpgrade linux-image-5.15.0-48-generic-lpaeUpgrade linux-image-5.4.0-1089-gcpUpgrade linux-image-raspiUpgrade linux-image-gkeUpgrade linux-image-5.4.0-126-generic-lpaeUpgrade linux-image-kvmUpgrade linux-image-5.4.0-1053-gkeopUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oracleUpgrade linux-image-gkeopUpgrade linux-image-5.4.0-1033-ibmUpgrade linux-image-azure-fdeUpgrade linux-image-oem-osp1Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-47-genericUpgrade linux-image-azure-lts-20.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-generic-64kUpgrade linux-image-5.15.0-48-generic-64kUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-raspi2Upgrade linux-image-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-bluefieldUpgrade linux-image-gkeop-5.4Upgrade linux-image-raspi-nolpaeUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.15.0-47-lowlatency-64kUpgrade linux-image-5.15.0-1017-kvmUpgrade linux-image-5.4.0-1091-azure-fdeUpgrade linux-image-5.15.0-1014-raspi-nolpaeUpgrade linux-image-5.4.0-1083-gkeUpgrade linux-image-intel-iotgUpgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-5.15.0-1019-awsUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-ibmUpgrade linux-image-5.4.0-1046-bluefieldUpgrade linux-image-5.4.0-126-genericUpgrade linux-image-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.4.0-1118-kvmUpgrade linux-image-genericUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-lpae | Sep 2, 2022 | Aug 12, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 12, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub