Skip to content
OpenAdvisories
Medium ALSA-2024:10943 9 CVEs

Moderate: kernel security update

Published Dec 11, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: selinux,smack: don't bypass permissions check in inode_setsecctx hook (CVE-2024-46695)
* kernel: net: avoid potential underflow in qdisc_pkt_len_init() with UFO (CVE-2024-49949)
* kernel: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (CVE-2024-50082)
* kernel: arm64: probes: Remove broken LDR (literal) uprobe support (CVE-2024-50099)
* kernel: xfrm: fix one more kernel-infoleak in algo dumping (CVE-2024-50110)
* kernel: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (CVE-2024-50142)
* kernel: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (CVE-2024-50192)
* kernel: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (CVE-2024-50256)
* kernel: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (CVE-2024-50264)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 25

ReleasePackageFixed in
AlmaLinux · 8 bpftool 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-abi-stablelists 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-core 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-cross-headers 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-debug 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-debug-core 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-debug-devel 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-debug-modules 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-debug-modules-extra 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-devel 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-doc 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-headers 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-modules 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-modules-extra 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-tools 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-tools-libs 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-tools-libs-devel 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-zfcpdump 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-core 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-devel 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules 4.18.0-553.32.1.el8_10
AlmaLinux · 8 kernel-zfcpdump-modules-extra 4.18.0-553.32.1.el8_10
AlmaLinux · 8 perf 4.18.0-553.32.1.el8_10
AlmaLinux · 8 python3-perf 4.18.0-553.32.1.el8_10

Vulnerabilities 9

  • Critical 9.8
    CVE-2024-46695

    selinux,smack: don't bypass permissions check in inode_setsecctx hook

    In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko reports that the root user on an NFS client is able to change the security labels on files on an NFS filesys…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-50082

    blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race

    In the Linux kernel, the following vulnerability has been resolved: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race We're seeing crashes from rq_qos_wake_function that look like this: BUG: unable to handle page fault for address: ffffafe180…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-50264

    vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans

    In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2024-50256

    netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() I got a syzbot report without a repro [1] crashing in nf_send_reset6() I think the issue is that dev->hard_header_len is zer…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.3
    CVE-2024-50099

    arm64: probes: Remove broken LDR (literal) uprobe support

    In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Remove broken LDR (literal) uprobe support The simulate_ldr_literal() and simulate_ldrsw_literal() functions are unsafe to use for uprobes. Both functions were originally writt…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2024-50110

    xfrm: fix one more kernel-infoleak in algo dumping

    In the Linux kernel, the following vulnerability has been resolved: xfrm: fix one more kernel-infoleak in algo dumping During fuzz testing, the following issue was discovered: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30 _copy_to_iter+0x598/0x2a3…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2024-50142

    xfrm: validate new SA's prefixlen using SA family when sel.family is unset

    In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm se…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 4.7
    CVE-2024-50192

    irqchip/gic-v4: Don't allow a VMOVP on a dying VPE

    In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has al…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-49949

    net: avoid potential underflow in qdisc_pkt_len_init() with UFO

    In the Linux kernel, the following vulnerability has been resolved: net: avoid potential underflow in qdisc_pkt_len_init() with UFO After commit 7c6d2ecbda83 ("net: be more gentle about silly gso requests coming from user") virtio_net_hdr_to_skb() had sanity …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-46695
  • report
    https://access.redhat.com/security/cve/CVE-2024-49949
  • report
    https://access.redhat.com/security/cve/CVE-2024-50082
  • report
    https://access.redhat.com/security/cve/CVE-2024-50099
  • report
    https://access.redhat.com/security/cve/CVE-2024-50110
  • report
    https://access.redhat.com/security/cve/CVE-2024-50142
  • report
    https://access.redhat.com/security/cve/CVE-2024-50192
  • report
    https://access.redhat.com/security/cve/CVE-2024-50256
  • report
    https://access.redhat.com/security/cve/CVE-2024-50264
  • report
    https://bugzilla.redhat.com/2312083
  • report
    https://bugzilla.redhat.com/2320505
  • report
    https://bugzilla.redhat.com/2322308
  • report
    https://bugzilla.redhat.com/2323904
  • report
    https://bugzilla.redhat.com/2323930
  • report
    https://bugzilla.redhat.com/2324315
  • report
    https://bugzilla.redhat.com/2324612
  • report
    https://bugzilla.redhat.com/2324889
  • report
    https://bugzilla.redhat.com/2327168
  • advisory
    https://errata.almalinux.org/8/ALSA-2024-10943.html