Skip to content
OpenAdvisories
High ALSA-2024:6997 21 CVEs

Important: kernel security update

Published Sep 24, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)
* kernel: net/sched: act_mirred: don't override retval if we already lost the skb (CVE-2024-26739)
* kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (CVE-2024-26947)
* kernel: scsi: qla2xxx: Fix command flush on cable pull (CVE-2024-26931)
* kernel: scsi: qla2xxx: Fix double free of the ha->vp_map pointer (CVE-2024-26930)
* kernel: scsi: qla2xxx: Fix double free of fcport (CVE-2024-26929)
* kernel: fork: defer linking file vma until vma is fully initialized (CVE-2024-27022)
* kernel: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes (CVE-2024-26991)
* kernel: bpf, sockmap: Prevent lock inversion deadlock in map delete elem (CVE-2024-35895)
* kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016)
* kernel: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (CVE-2024-36899)
* kernel: cpufreq: exit() callback is optional (CVE-2024-38615)
* kernel: ring-buffer: Fix a race between readers and resize checks (CVE-2024-38601)
* kernel: cppc_cpufreq: Fix possible null pointer dereference (CVE-2024-38573)
* kernel: gfs2: Fix potential glock use-after-free on unmount (CVE-2024-38570)
* kernel: wifi: nl80211: Avoid address calculations via out of bounds array indexing (CVE-2024-38562)
* kernel: Input: cyapa - add missing input core locking to suspend/resume functions (CVE-2023-52884)
* kernel: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CVE-2024-40984)
* kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing (CVE-2024-41071)
* kernel: wifi: mt76: replace skb_put with skb_put_zero (CVE-2024-42225)
* kernel: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CVE-2024-42246)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 62

ReleasePackageFixed in
AlmaLinux · 9 bpftool 7.3.0-427.37.1.el9_4
AlmaLinux · 9 kernel 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-debug 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-debug-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-debug-devel 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-debug-devel-matched 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-debug-modules 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-debug-modules-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-debug-modules-extra 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-devel 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-devel-matched 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-modules 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-modules-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-64k-modules-extra 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-abi-stablelists 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-cross-headers 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-debug 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-debug-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-debug-devel 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-debug-devel-matched 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-debug-modules 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-debug-modules-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-debug-modules-extra 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-debug-uki-virt 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-devel 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-devel-matched 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-doc 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-headers 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-modules 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-modules-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-modules-extra 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-rt 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-rt-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-rt-debug 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-rt-debug-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-rt-debug-devel 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-rt-debug-modules 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-rt-debug-modules-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-rt-debug-modules-extra 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-rt-devel 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-rt-modules 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-rt-modules-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-rt-modules-extra 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-tools 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-tools-libs 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-tools-libs-devel 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-uki-virt 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-zfcpdump 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-zfcpdump-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-zfcpdump-devel 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-zfcpdump-devel-matched 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-zfcpdump-modules 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-zfcpdump-modules-core 5.14.0-427.37.1.el9_4
AlmaLinux · 9 kernel-zfcpdump-modules-extra 5.14.0-427.37.1.el9_4
AlmaLinux · 9 libperf 5.14.0-427.37.1.el9_4
AlmaLinux · 9 perf 5.14.0-427.37.1.el9_4
AlmaLinux · 9 python3-perf 5.14.0-427.37.1.el9_4
AlmaLinux · 9 rtla 5.14.0-427.37.1.el9_4
AlmaLinux · 9 rv 5.14.0-427.37.1.el9_4

Vulnerabilities 21

  • Critical 9.8
    CVE-2024-38570

    gfs2: Fix potential glock use-after-free on unmount

    In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix potential glock use-after-free on unmount When a DLM lockspace is released and there ares still locks in that lockspace, DLM will unlock those locks automatically. Commit fb6791d100…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2024-26931

    scsi: qla2xxx: Fix command flush on cable pull

    In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix command flush on cable pull System crash due to command failed to flush back to SCSI layer. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.3
    CVE-2024-42225

    wifi: mt76: replace skb_put with skb_put_zero

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: replace skb_put with skb_put_zero Avoid potentially reusing uninitialized data

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-52439

    uio: Fix use-after-free in uio_open

    In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_de…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26739

    net/sched: act_mirred: don't override retval if we already lost the skb

    In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: don't override retval if we already lost the skb If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-27022

    fork: defer linking file vma until vma is fully initialized

    In the Linux kernel, the following vulnerability has been resolved: fork: defer linking file vma until vma is fully initialized Thorvald reported a WARNING [1]. And the root cause is below race: CPU 1 CPU 2 fork hugetlbfs_fallocate dup_mmap hugetlbfs_punch_ho…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-36016

    tty: n_gsm: fix possible out-of-bounds in gsm0_receive()

    In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-38562

    wifi: nl80211: Avoid address calculations via out of bounds array indexing

    In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: Avoid address calculations via out of bounds array indexing Before request->channels[] can be used, request->n_channels must be set. Additionally, address calculations for memo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-40984

    ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."

    In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2024-38573

    cppc_cpufreq: Fix possible null pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: cppc_cpufreq: Fix possible null pointer dereference cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() can be called from different places with various parameters. So cpufreq_cpu_get() …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.0
    CVE-2024-26930

    scsi: qla2xxx: Fix double free of the ha->vp_map pointer

    In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the ha->vp_map pointer Coverity scan reported potential risk of double free of the pointer ha->vp_map. ha->vp_map was freed in qla2x00_mem_alloc(), and again…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2024-26991

    KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes Fix KVM_SET_MEMORY_ATTRIBUTES to not overflow lpage_info array and trigger KASAN splat, as seen in the private_mem_conver…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 4.4
    CVE-2023-52884

    Input: cyapa - add missing input core locking to suspend/resume functions

    In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input core locking to suspend/resume functions Grab input->mutex during suspend/resume functions like it is done in other input drivers. This fixes the following wa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26929 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2024-26947

    ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses

    In the Linux kernel, the following vulnerability has been resolved: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memory map alignment") changes the sem…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-35895

    bpf, sockmap: Prevent lock inversion deadlock in map delete elem

    In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-36899

    gpiolib: cdev: Fix use after free in lineinfo_changed_notify

    In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfo_changed_notify The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-38601

    ring-buffer: Fix a race between readers and resize checks

    In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix a race between readers and resize checks The reader code in rb_get_reader_page() swaps a new reader page into the ring buffer by doing cmpxchg on old->list.prev->next to poin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-38615

    cpufreq: exit() callback is optional

    In the Linux kernel, the following vulnerability has been resolved: cpufreq: exit() callback is optional The exit() callback is optional and shouldn't be called without checking a valid pointer first. Also, we must clear freq_table pointer even if the exit() …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-41071 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2024-42246

    net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket

    In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket When using a BPF program on kernel_connect(), the call can return -EPERM. This causes xs_tcp_setup_socket() to lo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-52439
  • report
    https://access.redhat.com/security/cve/CVE-2023-52884
  • report
    https://access.redhat.com/security/cve/CVE-2024-26739
  • report
    https://access.redhat.com/security/cve/CVE-2024-26929
  • report
    https://access.redhat.com/security/cve/CVE-2024-26930
  • report
    https://access.redhat.com/security/cve/CVE-2024-26931
  • report
    https://access.redhat.com/security/cve/CVE-2024-26947
  • report
    https://access.redhat.com/security/cve/CVE-2024-26991
  • report
    https://access.redhat.com/security/cve/CVE-2024-27022
  • report
    https://access.redhat.com/security/cve/CVE-2024-35895
  • report
    https://access.redhat.com/security/cve/CVE-2024-36016
  • report
    https://access.redhat.com/security/cve/CVE-2024-36899
  • report
    https://access.redhat.com/security/cve/CVE-2024-38562
  • report
    https://access.redhat.com/security/cve/CVE-2024-38570
  • report
    https://access.redhat.com/security/cve/CVE-2024-38573
  • report
    https://access.redhat.com/security/cve/CVE-2024-38601
  • report
    https://access.redhat.com/security/cve/CVE-2024-38615
  • report
    https://access.redhat.com/security/cve/CVE-2024-40984
  • report
    https://access.redhat.com/security/cve/CVE-2024-41071
  • report
    https://access.redhat.com/security/cve/CVE-2024-42225
  • report
    https://access.redhat.com/security/cve/CVE-2024-42246
  • report
    https://bugzilla.redhat.com/2265271
  • report
    https://bugzilla.redhat.com/2273270
  • report
    https://bugzilla.redhat.com/2278167
  • report
    https://bugzilla.redhat.com/2278245
  • report
    https://bugzilla.redhat.com/2278248
  • report
    https://bugzilla.redhat.com/2278250
  • report
    https://bugzilla.redhat.com/2278252
  • report
    https://bugzilla.redhat.com/2278318
  • report
    https://bugzilla.redhat.com/2281677
  • report
    https://bugzilla.redhat.com/2283894
  • report
    https://bugzilla.redhat.com/2284549
  • report
    https://bugzilla.redhat.com/2293348
  • report
    https://bugzilla.redhat.com/2293364
  • report
    https://bugzilla.redhat.com/2293420
  • report
    https://bugzilla.redhat.com/2293423
  • report
    https://bugzilla.redhat.com/2293431
  • report
    https://bugzilla.redhat.com/2293685
  • report
    https://bugzilla.redhat.com/2297568