Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5
CVSS Details
- CVSS 3.1 Base Score: 6.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 12, 2022 |
| Centos_linux | — | Upgrade kernelUpgrade kernel-rt | Sep 18, 2023 | Aug 12, 2022 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Aug 12, 2022 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Nov 3, 2022 | Aug 12, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-develUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade python-perfUpgrade perfUpgrade kernel-headers | Mar 9, 2023 | Aug 12, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-develUpgrade perfUpgrade python-perfUpgrade kernel-headersUpgrade kernelUpgrade kernel-tools-libs | Oct 11, 2022 | Aug 12, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perf | Nov 15, 2022 | Aug 12, 2022 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 5, 2022 | Aug 12, 2022 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Sep 18, 2023 | Aug 12, 2022 |
| Suse | — | Upgrade kernel-obs-qaUpgrade dlm-kmp-preemptUpgrade dtb-xilinxUpgrade dtb-nvidiaUpgrade kernel-preempt-extraUpgrade kernel-defaultUpgrade cluster-md-kmp-preemptUpgrade dtb-rockchipUpgrade kernel-rtUpgrade dtb-qcomUpgrade kernel-default-optionalUpgrade kernel-debug-baseUpgrade dtb-apmUpgrade cluster-md-kmp-64kbUpgrade dtb-mediatekUpgrade kernel-develUpgrade dtb-armUpgrade kernel-obs-buildUpgrade kernel-64kb-develUpgrade kernel-default-base-rebuildUpgrade dtb-exynosUpgrade kernel-default-extraUpgrade reiserfs-kmp-azureUpgrade kernel-syms-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade dtb-sprdUpgrade kernel-64kb-extraUpgrade kernel-devel-azureUpgrade kernel-vanilla-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-preemptUpgrade kernel-vanilla-baseUpgrade kselftests-kmp-defaultUpgrade kernel-macrosUpgrade dlm-kmp-azureUpgrade dtb-zteUpgrade kernel-preemptUpgrade dtb-alUpgrade dtb-allwinnerUpgrade gfs2-kmp-preemptUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-develUpgrade kernel-docsUpgrade dtb-marvellUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmallUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-vanilla-develUpgrade kernel-zfcpdump-manUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-baseUpgrade kernel-source-azureUpgrade kernel-64kb-livepatch-develUpgrade dtb-socionextUpgrade dlm-kmp-defaultUpgrade dtb-freescaleUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-azureUpgrade dtb-broadcomUpgrade kernel-kvmsmall-livepatch-develUpgrade reiserfs-kmp-preemptUpgrade dtb-lgUpgrade kernel-sourceUpgrade kernel-kvmsmall-develUpgrade kernel-symsUpgrade kselftests-kmp-64kbUpgrade dtb-amdUpgrade ocfs2-kmp-64kbUpgrade kernel-debugUpgrade kernel-default-develUpgrade gfs2-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-preempt-livepatch-develUpgrade dtb-caviumUpgrade kernel-default-baseUpgrade dtb-renesasUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-vanillaUpgrade dtb-hisiliconUpgrade ocfs2-kmp-azureUpgrade kernel-source-vanillaUpgrade dlm-kmp-64kbUpgrade kernel-azure-baseUpgrade kernel-preempt-optionalUpgrade kernel-default-livepatchUpgrade kernel-debug-develUpgrade kernel-azure-extraUpgrade ocfs2-kmp-preemptUpgrade kernel-64kbUpgrade dtb-alteraUpgrade kernel-default-manUpgrade gfs2-kmp-azureUpgrade kernel-preempt-devel | Oct 26, 2022 | Aug 12, 2022 |
| Ubuntu | — | Upgrade linux-image-5.4.0-1046-bluefieldUpgrade linux-image-generic-lpaeUpgrade linux-image-gke-5.15Upgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-47-genericUpgrade linux-image-azure-lts-20.04Upgrade linux-image-genericUpgrade linux-image-raspi-nolpaeUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-osp1Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-4.4.0-1118-kvmUpgrade linux-image-5.15.0-1017-kvmUpgrade linux-image-gkeopUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1014-raspi-nolpaeUpgrade linux-image-5.15.0-47-lowlatency-64kUpgrade linux-image-5.4.0-1083-gkeUpgrade linux-image-5.15.0-1019-awsUpgrade linux-image-intel-iotgUpgrade linux-image-5.4.0-1033-ibmUpgrade linux-image-virtualUpgrade linux-image-raspi2Upgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-ibmUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-bluefieldUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-48-generic-64kUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1091-azure-fdeUpgrade linux-image-aws-lts-20.04Upgrade linux-image-oracleUpgrade linux-image-generic-lts-xenialUpgrade linux-image-5.4.0-126-genericUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-gkeop-5.4Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-raspiUpgrade linux-image-5.15.0-1017-oracleUpgrade linux-image-5.15.0-1014-raspiUpgrade linux-image-5.15.0-1019-azureUpgrade linux-image-5.4.0-1083-oracleUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-5.4.0-126-generic-lpaeUpgrade linux-image-5.15.0-1015-intel-iotgUpgrade linux-image-5.4.0-1075-kvmUpgrade linux-image-5.4.0-1070-raspiUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-4.4.0-1117-awsUpgrade linux-image-5.15.0-48-genericUpgrade linux-image-5.15.0-47-generic-64kUpgrade linux-image-awsUpgrade linux-image-azureUpgrade linux-image-5.4.0-1091-azureUpgrade linux-image-5.15.0-48-generic-lpaeUpgrade linux-image-4.4.0-1155-awsUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-kvmUpgrade linux-image-5.15.0-48-lowlatencyUpgrade linux-image-4.4.0-239-genericUpgrade linux-image-gke-5.4Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-4.4.0-239-lowlatencyUpgrade linux-image-5.4.0-1053-gkeopUpgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-47-generic-lpaeUpgrade linux-image-5.15.0-1015-gkeUpgrade linux-image-5.15.0-1017-gcpUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-gkeUpgrade linux-image-5.15.0-1002-gkeopUpgrade linux-image-5.4.0-1085-awsUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1013-ibmUpgrade linux-image-5.4.0-126-lowlatencyUpgrade linux-image-5.4.0-1089-gcpUpgrade linux-image-5.15.0-48-lowlatency-64kUpgrade linux-image-generic-lpae-hwe-22.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-oemUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-47-lowlatency | Sep 2, 2022 | Aug 12, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 12, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub