Skip to content
OpenAdvisories
Medium ALSA-2024:6567 27 CVEs

Moderate: kernel security update

Published Sep 11, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463)
* kernel: nfsd: fix RELEASE_LOCKOWNER (CVE-2024-26629)
* kernel: mm: cachestat: fix folio read-after-free in cache walk (CVE-2024-26630)
* kernel: mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (CVE-2024-26720)
* kernel: Bluetooth: af_bluetooth: Fix deadlock (CVE-2024-26886)
* kernel: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address (CVE-2024-26946)
* kernel: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (CVE-2024-35791)
* kernel: mm: cachestat: fix two shmem bugs (CVE-2024-35797)
* kernel: x86/coco: Require seeding RNG with RDRAND on CoCo systems (CVE-2024-35875)
* kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000)
* kernel: iommufd: Fix missing update of domains_itree after splitting iopt_area (CVE-2023-52801)
* kernel: net: fix out-of-bounds access in ops_init (CVE-2024-36883)
* kernel: regmap: maple: Fix cache corruption in regcache_maple_drop() (CVE-2024-36019)
* kernel: usb-storage: alauda: Check whether the media is initialized (CVE-2024-38619)
* kernel: net: bridge: mst: fix vlan use-after-free (CVE-2024-36979)
* kernel: scsi: qedf: Ensure the copied buf is NUL terminated (CVE-2024-38559)
* kernel: xhci: Handle TD clearing for multiple streams case (CVE-2024-40927)
* kernel: cxl/region: Fix memregion leaks in devm_cxl_add_region() (CVE-2024-40936)
* kernel: net/sched: Fix UAF when resolving a clash (CVE-2024-41040)
* kernel: ppp: reject claimed-as-LCP but actually malformed packets (CVE-2024-41044)
* kernel: mm: prevent derefencing NULL ptr in pfn_section_valid() (CVE-2024-41055)
* kernel: PCI/MSI: Fix UAF in msi_capability_init (CVE-2024-41096)
* kernel: xdp: Remove WARN() from __xdp_reg_mem_model() (CVE-2024-42082)
* kernel: x86: stop playing stack games in profile_pc() (CVE-2024-42096)
* kernel: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (CVE-2024-42102)
* kernel: mm: avoid overflows in dirty throttling logic (CVE-2024-42131)
* kernel: nvme: avoid double free special payload (CVE-2024-41073)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 62

ReleasePackageFixed in
AlmaLinux · 9 bpftool 7.3.0-427.35.1.el9_4
AlmaLinux · 9 kernel 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-debug 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-devel 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-modules 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-cross-headers 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-debug 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-debug-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-debug-devel 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-debug-modules 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-devel 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-devel-matched 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-doc 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-headers 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-modules 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-modules-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-modules-extra 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-rt 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-rt-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-rt-debug 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-rt-devel 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-rt-modules 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-tools 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-tools-libs 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-uki-virt 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-zfcpdump 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-427.35.1.el9_4
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-427.35.1.el9_4
AlmaLinux · 9 libperf 5.14.0-427.35.1.el9_4
AlmaLinux · 9 perf 5.14.0-427.35.1.el9_4
AlmaLinux · 9 python3-perf 5.14.0-427.35.1.el9_4
AlmaLinux · 9 rtla 5.14.0-427.35.1.el9_4
AlmaLinux · 9 rv 5.14.0-427.35.1.el9_4

Vulnerabilities 27

  • Critical 9.8
    CVE-2024-41040

    net/sched: Fix UAF when resolving a clash

    In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when resolving a clash KASAN reports the following UAF: BUG: KASAN: slab-use-after-free in tcf_ct_flow_table_process_conn+0x12b/0x380 [act_ct] Read of size 1 at addr ffff88…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2024-41073

    nvme: avoid double free special payload

    In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retried, and that retry may fail before a new special payload is added, a double free will result. Clear the RQF_SPECI…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2023-52801

    iommufd: Fix missing update of domains_itree after splitting iopt_area

    In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domains_itree after splitting iopt_area In iopt_area_split(), if the original iopt_area has filled a domain and is linked to domains_itree, pages_nodes have to …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2024-35875

    x86/coco: Require seeding RNG with RDRAND on CoCo systems

    In the Linux kernel, the following vulnerability has been resolved: x86/coco: Require seeding RNG with RDRAND on CoCo systems There are few uses of CoCo that don't rely on working cryptography and hence a working RNG. Unfortunately, the CoCo threat model mean…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-35791

    KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()

    In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-fre…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-36019

    regmap: maple: Fix cache corruption in regcache_maple_drop()

    In the Linux kernel, the following vulnerability has been resolved: regmap: maple: Fix cache corruption in regcache_maple_drop() When keeping the upper end of a cache block entry, the entry[] array must be indexed by the offset from the base register of the b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-36883

    net: fix out-of-bounds access in ops_init

    In the Linux kernel, the following vulnerability has been resolved: net: fix out-of-bounds access in ops_init net_alloc_generic is called by net_alloc, which is called without any locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It is …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-36979

    net: bridge: mst: fix vlan use-after-free

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix vlan use-after-free syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-41096

    PCI/MSI: Fix UAF in msi_capability_init

    In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Fix UAF in msi_capability_init KFENCE reports the following UAF: BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488 Use-after-free read at 0x0000000024629571 (in …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2024-26630

    mm: cachestat: fix folio read-after-free in cache walk

    In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix folio read-after-free in cache walk In cachestat, we access the folio from the page cache's xarray to compute its page offset, and check for its dirty and writeback flags. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2024-35797

    mm: cachestat: fix two shmem bugs

    In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1) A swapin error can have resulted in a poisoned swap entry in th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 6.5
    CVE-2024-26886

    Bluetooth: af_bluetooth: Fix deadlock

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: af_bluetooth: Fix deadlock Attemting to do sock_lock on .recvmsg may cause a deadlock as shown bellow, so instead of using sock_sock this uses sk_receive_queue.lock on bt_sock_ioct…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 4.4
    CVE-2024-38559

    scsi: qedf: Ensure the copied buf is NUL terminated

    In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Ensure the copied buf is NUL terminated Currently, we allocate a count-sized kernel buffer and copy count from userspace to that buffer. Later, we use kstrtouint on this buffer bu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52463

    efivarfs: force RO when remounting if SetVariable is not supported

    In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if SetVariable is not supported If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26629

    nfsd: fix RELEASE_LOCKOWNER

    In the Linux kernel, the following vulnerability has been resolved: nfsd: fix RELEASE_LOCKOWNER The test on so_count in nfsd4_release_lockowner() is nonsense and harmful. Revert to using check_for_locks(), changing that to not sleep. First: harmful. As is doc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26720 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2024-26946

    kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address

    In the Linux kernel, the following vulnerability has been resolved: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address Read from an unsafe address with copy_from_kernel_nofault() in arch_adjust_kprobe_addr() because this function is used …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-36000

    mm/hugetlb: fix missing hugetlb_lock for resv uncharge

    In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/ 350: lockdep_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-38619

    usb-storage: alauda: Check whether the media is initialized

    In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alaud…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-40927

    xhci: Handle TD clearing for multiple streams case

    In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-40936

    cxl/region: Fix memregion leaks in devm_cxl_add_region()

    In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix memregion leaks in devm_cxl_add_region() Move the mode verification to __create_region() before allocating the memregion to avoid the memregion leaks.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-41044

    ppp: reject claimed-as-LCP but actually malformed packets

    In the Linux kernel, the following vulnerability has been resolved: ppp: reject claimed-as-LCP but actually malformed packets Since 'ppp_async_encode()' assumes valid LCP packets (with code from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that LCP p…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-41055

    mm: prevent derefencing NULL ptr in pfn_section_valid()

    In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() Commit 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing memory_section->usage") changed pfn_section_valid() to add a READ_ONCE() call…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-42082

    xdp: Remove WARN() from __xdp_reg_mem_model()

    In the Linux kernel, the following vulnerability has been resolved: xdp: Remove WARN() from __xdp_reg_mem_model() syzkaller reports a warning in __xdp_reg_mem_model(). The warning occurs only if __mem_id_init_hash_table() returns an error. It returns the erro…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-42096

    x86: stop playing stack games in profile_pc()

    In the Linux kernel, the following vulnerability has been resolved: x86: stop playing stack games in profile_pc() The 'profile_pc()' function is used for timer-based profiling, which isn't really all that relevant any more to begin with, but it also ends up m…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-42102

    Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"

    In the Linux kernel, the following vulnerability has been resolved: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-42131

    mm: avoid overflows in dirty throttling logic

    In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplications…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-52463
  • report
    https://access.redhat.com/security/cve/CVE-2023-52801
  • report
    https://access.redhat.com/security/cve/CVE-2024-26629
  • report
    https://access.redhat.com/security/cve/CVE-2024-26630
  • report
    https://access.redhat.com/security/cve/CVE-2024-26720
  • report
    https://access.redhat.com/security/cve/CVE-2024-26886
  • report
    https://access.redhat.com/security/cve/CVE-2024-26946
  • report
    https://access.redhat.com/security/cve/CVE-2024-35791
  • report
    https://access.redhat.com/security/cve/CVE-2024-35797
  • report
    https://access.redhat.com/security/cve/CVE-2024-35875
  • report
    https://access.redhat.com/security/cve/CVE-2024-36000
  • report
    https://access.redhat.com/security/cve/CVE-2024-36019
  • report
    https://access.redhat.com/security/cve/CVE-2024-36883
  • report
    https://access.redhat.com/security/cve/CVE-2024-36979
  • report
    https://access.redhat.com/security/cve/CVE-2024-38559
  • report
    https://access.redhat.com/security/cve/CVE-2024-38619
  • report
    https://access.redhat.com/security/cve/CVE-2024-40927
  • report
    https://access.redhat.com/security/cve/CVE-2024-40936
  • report
    https://access.redhat.com/security/cve/CVE-2024-41040
  • report
    https://access.redhat.com/security/cve/CVE-2024-41044
  • report
    https://access.redhat.com/security/cve/CVE-2024-41055
  • report
    https://access.redhat.com/security/cve/CVE-2024-41073
  • report
    https://access.redhat.com/security/cve/CVE-2024-41096
  • report
    https://access.redhat.com/security/cve/CVE-2024-42082
  • report
    https://access.redhat.com/security/cve/CVE-2024-42096
  • report
    https://access.redhat.com/security/cve/CVE-2024-42102
  • report
    https://access.redhat.com/security/cve/CVE-2024-42131
  • report
    https://bugzilla.redhat.com/2265797
  • report
    https://bugzilla.redhat.com/2269434
  • report
    https://bugzilla.redhat.com/2269436
  • report
    https://bugzilla.redhat.com/2273141
  • report
    https://bugzilla.redhat.com/2275678
  • report
    https://bugzilla.redhat.com/2278206
  • report
    https://bugzilla.redhat.com/2281052
  • report
    https://bugzilla.redhat.com/2281151
  • report
    https://bugzilla.redhat.com/2281727
  • report
    https://bugzilla.redhat.com/2281968
  • report
    https://bugzilla.redhat.com/2282709
  • report
    https://bugzilla.redhat.com/2284271