Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5
CVSS Details
- CVSS 3.1 Base Score: 6.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 12, 2022 |
| Centos_linux | — | Upgrade kernelUpgrade kernel-rt | Sep 18, 2023 | Aug 12, 2022 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Aug 12, 2022 |
| Dell Powerstore Dsa2023129 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libs | Nov 3, 2022 | Aug 12, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-develUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-headersUpgrade perf | Mar 9, 2023 | Aug 12, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade perfUpgrade python3-perfUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-develUpgrade kernel-headersUpgrade python-perfUpgrade kernel-tools-libsUpgrade kernel | Oct 11, 2022 | Aug 12, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-tools | Nov 15, 2022 | Aug 12, 2022 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 5, 2022 | Aug 12, 2022 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Sep 18, 2023 | Aug 12, 2022 |
| Suse | — | Upgrade gfs2-kmp-defaultUpgrade dtb-exynosUpgrade dtb-armUpgrade kernel-syms-azureUpgrade dtb-rockchipUpgrade reiserfs-kmp-azureUpgrade dtb-sprdUpgrade kernel-default-extraUpgrade cluster-md-kmp-64kbUpgrade kernel-defaultUpgrade kernel-default-base-rebuildUpgrade kernel-64kb-develUpgrade kernel-default-optionalUpgrade kernel-64kb-extraUpgrade dtb-mediatekUpgrade kernel-preempt-extraUpgrade dtb-nvidiaUpgrade cluster-md-kmp-preemptUpgrade kernel-develUpgrade kernel-debug-baseUpgrade kernel-vanilla-livepatch-develUpgrade kselftests-kmp-preemptUpgrade kernel-azure-livepatch-develUpgrade kernel-preemptUpgrade dtb-xilinxUpgrade kernel-obs-buildUpgrade dlm-kmp-preemptUpgrade kernel-rtUpgrade kernel-devel-azureUpgrade dtb-qcomUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-azure-develUpgrade dtb-alUpgrade kernel-docsUpgrade gfs2-kmp-preemptUpgrade kernel-macrosUpgrade dtb-apmUpgrade kernel-obs-qaUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade dtb-zteUpgrade kernel-vanilla-baseUpgrade dtb-allwinnerUpgrade kernel-preempt-develUpgrade kselftests-kmp-azureUpgrade kernel-64kbUpgrade reiserfs-kmp-defaultUpgrade dtb-lgUpgrade kernel-default-baseUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-preempt-optionalUpgrade kernel-vanillaUpgrade dtb-renesasUpgrade kernel-azure-extraUpgrade gfs2-kmp-azureUpgrade dtb-alteraUpgrade dtb-socionextUpgrade dtb-caviumUpgrade kernel-preempt-livepatch-develUpgrade kernel-vanilla-develUpgrade dtb-freescaleUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-preemptUpgrade kernel-zfcpdump-manUpgrade kernel-source-azureUpgrade kernel-kvmsmall-baseUpgrade dlm-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-debug-livepatch-develUpgrade kernel-sourceUpgrade reiserfs-kmp-preemptUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-livepatch-develUpgrade kernel-azureUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade dtb-marvellUpgrade ocfs2-kmp-64kbUpgrade kernel-symsUpgrade kernel-default-develUpgrade kernel-debugUpgrade kernel-debug-develUpgrade gfs2-kmp-64kbUpgrade kernel-default-manUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kb-optionalUpgrade dtb-hisiliconUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-kvmsmallUpgrade cluster-md-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-develUpgrade kernel-default-livepatchUpgrade kernel-azure-baseUpgrade dtb-amd | Oct 26, 2022 | Aug 12, 2022 |
| Ubuntu | — | Upgrade linux-image-5.15.0-47-lowlatencyUpgrade linux-image-5.15.0-1015-intel-iotgUpgrade linux-image-5.15.0-48-lowlatency-64kUpgrade linux-image-awsUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-1089-gcpUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-oemUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-gke-5.4Upgrade linux-image-4.4.0-239-genericUpgrade linux-image-5.4.0-1085-awsUpgrade linux-image-4.4.0-1117-awsUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.4.0-1075-kvmUpgrade linux-image-5.15.0-1015-gkeUpgrade linux-image-5.15.0-1017-gcpUpgrade linux-image-5.15.0-1013-ibmUpgrade linux-image-oem-20.04Upgrade linux-image-kvmUpgrade linux-image-5.4.0-126-lowlatencyUpgrade linux-image-5.4.0-1083-oracleUpgrade linux-image-5.4.0-126-generic-lpaeUpgrade linux-image-5.15.0-1017-oracleUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.4.0-1070-raspiUpgrade linux-image-azureUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-5.15.0-47-generic-64kUpgrade linux-image-5.15.0-48-generic-lpaeUpgrade linux-image-5.4.0-1091-azureUpgrade linux-image-5.15.0-47-generic-lpaeUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-generic-lpae-hwe-22.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1002-gkeopUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-5.15.0-48-lowlatencyUpgrade linux-image-5.15.0-48-genericUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1019-azureUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.4.0-1053-gkeopUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-4.4.0-239-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-1014-raspiUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-4.4.0-1155-awsUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-genericUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-4.4.0-1118-kvmUpgrade linux-image-ibmUpgrade linux-image-aws-lts-20.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.4.0-126-genericUpgrade linux-image-5.4.0-1046-bluefieldUpgrade linux-image-5.15.0-48-generic-64kUpgrade linux-image-virtualUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-generic-64kUpgrade linux-image-bluefieldUpgrade linux-image-azure-lts-20.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-gkeop-5.4Upgrade linux-image-raspi2Upgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-generic-lts-xenialUpgrade linux-image-5.15.0-47-genericUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1014-raspi-nolpaeUpgrade linux-image-5.4.0-1083-gkeUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1017-kvmUpgrade linux-image-5.15.0-1019-awsUpgrade linux-image-oracleUpgrade linux-image-5.15.0-47-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-5.4.0-1091-azure-fdeUpgrade linux-image-azure-fdeUpgrade linux-image-generic-lpaeUpgrade linux-image-5.4.0-1033-ibmUpgrade linux-image-intel-iotgUpgrade linux-image-lowlatencyUpgrade linux-image-oem-osp1Upgrade linux-image-lowlatency-64kUpgrade linux-image-raspi-nolpae | Sep 2, 2022 | Aug 12, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 12, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub