Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5
CVSS Details
- CVSS 3.1 Base Score: 6.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 12, 2022 |
| Centos_linux | — | Upgrade kernel-rtUpgrade kernel | Sep 18, 2023 | Aug 12, 2022 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Aug 12, 2022 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel | Nov 3, 2022 | Aug 12, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade python-perfUpgrade kernel-develUpgrade kernel-headersUpgrade perf | Mar 9, 2023 | Aug 12, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade kernel-develUpgrade python3-perfUpgrade perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-headersUpgrade python-perf | Oct 11, 2022 | Aug 12, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perf | Nov 15, 2022 | Aug 12, 2022 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 5, 2022 | Aug 12, 2022 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Sep 18, 2023 | Aug 12, 2022 |
| Suse | — | Upgrade dlm-kmp-azureUpgrade kernel-devel-azureUpgrade dtb-zteUpgrade kernel-obs-qaUpgrade kernel-vanilla-baseUpgrade dlm-kmp-preemptUpgrade dtb-mediatekUpgrade dtb-xilinxUpgrade kernel-debug-baseUpgrade kernel-obs-buildUpgrade kernel-preempt-extraUpgrade kernel-rtUpgrade kernel-defaultUpgrade dtb-apmUpgrade kernel-preemptUpgrade kernel-macrosUpgrade cluster-md-kmp-preemptUpgrade kselftests-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-develUpgrade kselftests-kmp-preemptUpgrade kernel-default-extraUpgrade dtb-rockchipUpgrade kernel-64kb-develUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade dtb-armUpgrade kernel-vanilla-livepatch-develUpgrade kernel-syms-azureUpgrade dtb-exynosUpgrade dtb-qcomUpgrade dtb-sprdUpgrade kernel-azure-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-default-optionalUpgrade dtb-alUpgrade kernel-azure-develUpgrade dtb-allwinnerUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-preemptUpgrade kernel-docsUpgrade ocfs2-kmp-azureUpgrade kernel-vanilla-develUpgrade kernel-docs-htmlUpgrade dlm-kmp-defaultUpgrade kernel-azure-optionalUpgrade cluster-md-kmp-azureUpgrade kernel-default-livepatchUpgrade kernel-debug-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-kvmsmall-baseUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-alteraUpgrade kernel-source-vanillaUpgrade kernel-zfcpdumpUpgrade kernel-64kb-livepatch-develUpgrade kernel-kvmsmallUpgrade dtb-hisiliconUpgrade dlm-kmp-64kbUpgrade kernel-azureUpgrade dtb-broadcomUpgrade kernel-default-livepatch-develUpgrade kernel-sourceUpgrade reiserfs-kmp-preemptUpgrade dtb-renesasUpgrade gfs2-kmp-azureUpgrade kernel-vanillaUpgrade kernel-default-manUpgrade kernel-preempt-develUpgrade gfs2-kmp-64kbUpgrade kernel-azure-extraUpgrade dtb-marvellUpgrade kernel-symsUpgrade kernel-debug-develUpgrade ocfs2-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-default-develUpgrade kernel-preempt-livepatch-develUpgrade dtb-freescaleUpgrade dtb-socionextUpgrade dtb-caviumUpgrade kernel-source-azureUpgrade kernel-debugUpgrade kernel-64kbUpgrade ocfs2-kmp-preemptUpgrade kernel-zfcpdump-manUpgrade kernel-azure-baseUpgrade kselftests-kmp-64kbUpgrade kernel-preempt-optionalUpgrade kernel-default-baseUpgrade dtb-amdUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-64kb-optionalUpgrade dtb-lg | Oct 26, 2022 | Aug 12, 2022 |
| Ubuntu | — | Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-48-generic-64kUpgrade linux-image-5.4.0-1091-azure-fdeUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oem-osp1Upgrade linux-image-aws-lts-20.04Upgrade linux-image-5.4.0-1046-bluefieldUpgrade linux-image-raspi-nolpaeUpgrade linux-image-generic-lpaeUpgrade linux-image-azure-lts-20.04Upgrade linux-image-raspi2Upgrade linux-image-lowlatency-64kUpgrade linux-image-5.4.0-126-genericUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-generic-lts-xenialUpgrade linux-image-gkeop-5.4Upgrade linux-image-gkeopUpgrade linux-image-generic-64kUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.15.0-1017-kvmUpgrade linux-image-gcpUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-4.4.0-1118-kvmUpgrade linux-image-genericUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1019-awsUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1014-raspi-nolpaeUpgrade linux-image-lowlatencyUpgrade linux-image-5.4.0-1083-gkeUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-oracleUpgrade linux-image-ibmUpgrade linux-image-5.15.0-47-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-bluefieldUpgrade linux-image-5.4.0-1033-ibmUpgrade linux-image-5.15.0-47-genericUpgrade linux-image-5.4.0-1075-kvmUpgrade linux-image-5.15.0-48-genericUpgrade linux-image-gke-5.4Upgrade linux-image-5.15.0-48-lowlatencyUpgrade linux-image-5.15.0-1013-ibmUpgrade linux-image-5.15.0-1002-gkeopUpgrade linux-image-5.4.0-126-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-5.4.0-1089-gcpUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-oemUpgrade linux-image-5.15.0-1015-intel-iotgUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-239-lowlatencyUpgrade linux-image-5.4.0-1070-raspiUpgrade linux-image-5.4.0-1083-oracleUpgrade linux-image-5.15.0-47-generic-lpaeUpgrade linux-image-5.4.0-1053-gkeopUpgrade linux-image-5.15.0-1015-gkeUpgrade linux-image-5.15.0-1017-gcpUpgrade linux-image-oem-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1019-azureUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-azureUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1017-oracleUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-126-generic-lpaeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.4.0-1091-azureUpgrade linux-image-5.15.0-48-generic-lpaeUpgrade linux-image-5.15.0-47-generic-64kUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.15.0-47-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-4.4.0-239-genericUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-4.4.0-1155-awsUpgrade linux-image-generic-lpae-hwe-22.04Upgrade linux-image-5.15.0-48-lowlatency-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1014-raspiUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-4.4.0-1117-awsUpgrade linux-image-5.4.0-1085-awsUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-kvmUpgrade linux-image-aws | Sep 2, 2022 | Aug 12, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 12, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub