RHSA-2022:1988 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 43

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::baseos	bpftool	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	bpftool-debuginfo	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-abi-stablelists	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-core	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-debug	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-debug-core	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-debug-debuginfo	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-debug-devel	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-debug-modules	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-debug-modules-extra	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-debuginfo	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-debuginfo-common-aarch64	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-debuginfo-common-ppc64le	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-debuginfo-common-s390x	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-debuginfo-common-x86_64	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-devel	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-doc	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-modules	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-modules-extra	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-tools	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-tools-debuginfo	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-tools-libs	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-zfcpdump	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-zfcpdump-core	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-zfcpdump-debuginfo	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-zfcpdump-devel	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-zfcpdump-modules	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	kernel-zfcpdump-modules-extra	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	perf	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	perf-debuginfo	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	python3-perf	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos	python3-perf-debuginfo	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	bpftool-debuginfo	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	kernel-debug-debuginfo	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	kernel-debuginfo	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	kernel-debuginfo-common-aarch64	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	kernel-debuginfo-common-ppc64le	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	kernel-debuginfo-common-x86_64	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	kernel-tools-debuginfo	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	kernel-tools-libs-devel	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	perf-debuginfo	0:4.18.0-372.9.1.el8
Red Hat · RHEL 8 enterprise_linux:8::crb	python3-perf-debuginfo	0:4.18.0-372.9.1.el8

Vulnerabilities 67

Critical 9.8

CVE-2021-47544

tcp: fix page frag corruption on page fault

In the Linux kernel, the following vulnerability has been resolved: tcp: fix page frag corruption on page fault Steffen reported a TCP stream corruption for HTTP requests served by the apache web-server using a cifs mount-point and memory mapping the relevant…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

May 24, 2024
High 8.8

CVE-2021-47203

scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass the requests to the adapter. If such an attempt fails, a l…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Apr 10, 2024
High 7.8

CVE-2021-47614

RDMA/irdma: Fix a user-after-free in add_pble_prm

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix a user-after-free in add_pble_prm When irdma_hmc_sd_one fails, 'chunk' is freed while its still on the PBLE info list. Add the chunk entry to the PBLE info list only after suc…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Jun 19, 2024
High 7.8

CVE-2022-48771

drm/vmwgfx: Fix stale file descriptors on failed usercopy

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of the fence_rep object will lead to a stale entry in the file descriptor table as put_unused_fd() won't release i…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Jun 20, 2024
High 7.8

CVE-2022-50131

HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: prevent a buffer overflow in mcp_smbus_write() Smatch Warning: drivers/hid/hid-mcp2221.c:388 mcp_smbus_write() error: __memcpy() '&mcp->txbuf[5]' too small (59 vs 255) drivers/h…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Jun 18, 2025
High 7.8

CVE-2022-50536

bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data In tcp_bpf_send_verdict() redirection, the eval variable is assigned to __SK_REDIRECT after the apply_bytes data is sent,…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Oct 7, 2025
High 7.8

CVE-2023-53570

wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() nl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the number of MBSSID elements in the nested netlink attr…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Oct 4, 2025
High 7.5

CVE-2021-47178

scsi: target: core: Avoid smp_processor_id() in preemptible code

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Avoid smp_processor_id() in preemptible code The BUG message "BUG: using smp_processor_id() in preemptible [00000000] code" was observed for TCMU devices with kernel confi…

Linux Linux linux-raspi2 linux-hwe Linux Ubuntu

Mar 25, 2024
High 7.1

CVE-2021-4460

drm/amdkfd: Fix UBSAN shift-out-of-bounds warning

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up doing a shift operation where the number of bits shifted equals number of …

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Oct 1, 2025
Medium 6.5

CVE-2022-0001 Public exploit

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authori…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 11, 2022
Medium 6.5

CVE-2022-0002

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user t…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 11, 2022
Medium 6.5

CVE-2023-0459

Copy_from_user Spectre-V1 Gadget in Linux Kernel

Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend u…

Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

May 25, 2023
Medium 5.5

CVE-2021-47498

dm rq: don't queue request to blk-mq during DM suspend

In the Linux kernel, the following vulnerability has been resolved: dm rq: don't queue request to blk-mq during DM suspend DM uses blk-mq's quiesce/unquiesce to stop/start device mapper queue. But blk-mq's unquiesce may come from outside events, such as eleva…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

May 22, 2024
Medium 5.5

CVE-2022-3105

An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c la…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 14, 2022
Medium 5.5

CVE-2022-3106

An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 14, 2022
Medium 5.5

CVE-2022-3108

An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kf…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 14, 2022
Medium 5.1

CVE-2020-4788

IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the da…

IBM AIX VIOS linux-raspi2 Debian Ubuntu

Nov 20, 2020
Medium 4.4

CVE-2021-4037

Kernel: security regression for cve-2018-13405

A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a sc…

Linux Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu

Aug 24, 2022
Medium 4.0

CVE-2021-21781

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. Th…

linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu

Aug 18, 2021
Low 2.3

CVE-2021-3923

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local acco…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 27, 2023
Unscored —

CVE-2020-0404

In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. Thi…

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Sep 17, 2020
Unscored —

CVE-2020-13974

An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_a…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jun 9, 2020
Unscored —

CVE-2020-27820

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if rem…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Nov 2, 2021
Unscored —

CVE-2021-0941

In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to …

linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu

Oct 25, 2021
Unscored —

CVE-2021-20322

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functiona…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 18, 2022
Unscored —

CVE-2021-26401

LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.

AMD AMD Processors linux-raspi2 linux-hwe Debian Ubuntu Alpine

Mar 11, 2022
Unscored —

CVE-2021-29154

BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Apr 8, 2021
Unscored —

CVE-2021-3612

An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jul 9, 2021
Unscored —

CVE-2021-3669

A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segm…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Aug 26, 2022
Unscored —

CVE-2021-37159

hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checkin…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Jul 21, 2021
Unscored —

CVE-2021-3743

An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sa…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 4, 2022
Unscored —

CVE-2021-3744

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c,…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 4, 2022
Unscored —

CVE-2021-3752

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket a…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Feb 16, 2022
Unscored —

CVE-2021-3759

A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Aug 23, 2022
Unscored —

CVE-2021-3764

A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a de…

linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu

Aug 23, 2022
Unscored —

CVE-2021-3772

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through inv…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 2, 2022
Unscored —

CVE-2021-3773 Public exploit

A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for furth…

linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

Feb 16, 2022
Unscored —

CVE-2021-4002

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memo…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 3, 2022
Unscored —

CVE-2021-40490

A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux ke…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Sep 3, 2021
Unscored —

CVE-2021-4083

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers i…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 18, 2022
Unscored —

CVE-2021-4093

A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A K…

linux-hwe linux-azure linux-gcp linux Debian Ubuntu

Feb 18, 2022
Unscored —

CVE-2021-4157

An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way user…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 25, 2022
Unscored —

CVE-2021-41864

prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to tr…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Oct 1, 2021
Unscored —

CVE-2021-4197

An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 23, 2022
Unscored —

CVE-2021-4203

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 25, 2022
Unscored —

CVE-2021-42739

The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/fire…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Oct 20, 2021
Unscored —

CVE-2021-43056

An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the ho…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Oct 28, 2021
Unscored —

CVE-2021-43389

An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_ca…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Nov 4, 2021
Unscored —

CVE-2021-43976

In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Nov 17, 2021
Unscored —

CVE-2021-44733 Public exploit

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs …

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 22, 2021
Unscored —

CVE-2021-45485 Public exploit

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 25, 2021
Unscored —

CVE-2021-45486

In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Dec 25, 2021
Unscored —

CVE-2021-47076

RDMA/rxe: Return CQE error if invalid lkey was supplied

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Return CQE error if invalid lkey was supplied RXE is missing update of WQE status in LOCAL_WRITE failures. This caused the following kernel panic if someone sent an atomic operation…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Mar 1, 2024
Unscored —

CVE-2021-47301

igb: Fix use-after-free error during reset

In the Linux kernel, the following vulnerability has been resolved: igb: Fix use-after-free error during reset Cleans the next descriptor to watch (next_to_watch) when cleaning the TX ring. Failure to do so can cause invalid memory accesses. If igb_poll() run…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

May 21, 2024
Unscored —

CVE-2021-47435

dm: fix mempool NULL pointer race when completing IO

In the Linux kernel, the following vulnerability has been resolved: dm: fix mempool NULL pointer race when completing IO dm_io_dec_pending() calls end_io_acct() first and will then dec md in-flight pending count. But if a task is swapping DM table at same tim…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

May 22, 2024
Unscored —

CVE-2021-47501

i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc When trying to dump VFs VSI RX/TX descriptors using debugfs there was a crash due to NULL pointer dereference in i40e_dbg_dump_desc. A…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

May 24, 2024
Unscored —

CVE-2021-47556

ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()

In the Linux kernel, the following vulnerability has been resolved: ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce() ethtool_set_coalesce() now uses both the .get_coalesce() and .set_coalesce() callbacks. But the check for their availability…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

May 24, 2024
Unscored —

CVE-2021-47590

mptcp: fix deadlock in __mptcp_push_pending()

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix deadlock in __mptcp_push_pending() __mptcp_push_pending() may call mptcp_flush_join_list() with subflow socket lock held. If such call hits mptcp_sockopt_sync_all() then subsequent…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Jun 19, 2024
Unscored —

CVE-2022-0286

A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of ser…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Jan 31, 2022
Unscored —

CVE-2022-0322

A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Mar 25, 2022
Unscored —

CVE-2022-0850

A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Aug 29, 2022
Unscored —

CVE-2022-1011 Public exploit

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw all…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux

Mar 18, 2022
Unscored —

CVE-2022-48904

iommu/amd: Fix I/O page table memory leak

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix I/O page table memory leak The current logic updates the I/O page table mode for the domain before calling the logic to free memory used for the page table. This results in IOM…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Aug 22, 2024
Unscored —

CVE-2022-49227

igc: avoid kernel warning when changing RX ring parameters

In the Linux kernel, the following vulnerability has been resolved: igc: avoid kernel warning when changing RX ring parameters Calling ethtool changing the RX ring parameters like this: $ ethtool -G eth0 rx 1024 on igc triggers kernel warnings like this: [ 22…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Feb 26, 2025
Unscored —

CVE-2022-50475

RDMA/core: Make sure "ib_port" is valid when access sysfs node

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Make sure "ib_port" is valid when access sysfs node The "ib_port" structure must be set before adding the sysfs kobject, and reset after removing it, otherwise it may crash when ac…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Oct 4, 2025
Unscored —

CVE-2022-50510

perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()

In the Linux kernel, the following vulnerability has been resolved: perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm_smmu_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() when platform_driver_register() failed. Remove t…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Oct 7, 2025
Unscored —

CVE-2023-53649

perf trace: Really free the evsel->priv area

In the Linux kernel, the following vulnerability has been resolved: perf trace: Really free the evsel->priv area In 3cb4d5e00e037c70 ("perf trace: Free syscall tp fields in evsel->priv") it only was freeing if strcmp(evsel->tp_format->system, "syscalls") retu…

Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Oct 7, 2025

References

article
https://access.redhat.com/security/updates/classification/#important
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1888433
report
https://bugzilla.redhat.com/show_bug.cgi?id=1901726
report
https://bugzilla.redhat.com/show_bug.cgi?id=1919791
report
https://bugzilla.redhat.com/show_bug.cgi?id=1946684
report
https://bugzilla.redhat.com/show_bug.cgi?id=1951739
report
https://bugzilla.redhat.com/show_bug.cgi?id=1957375
report
https://bugzilla.redhat.com/show_bug.cgi?id=1974079
report
https://bugzilla.redhat.com/show_bug.cgi?id=1978123
report
https://bugzilla.redhat.com/show_bug.cgi?id=1981950
report
https://bugzilla.redhat.com/show_bug.cgi?id=1983894
report
https://bugzilla.redhat.com/show_bug.cgi?id=1985353
report
https://bugzilla.redhat.com/show_bug.cgi?id=1986473
report
https://bugzilla.redhat.com/show_bug.cgi?id=1994390
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997338
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997467
report
https://bugzilla.redhat.com/show_bug.cgi?id=1997961
report
https://bugzilla.redhat.com/show_bug.cgi?id=1999544
report
https://bugzilla.redhat.com/show_bug.cgi?id=1999675
report
https://bugzilla.redhat.com/show_bug.cgi?id=2000627
report
https://bugzilla.redhat.com/show_bug.cgi?id=2000694
report
https://bugzilla.redhat.com/show_bug.cgi?id=2004949
report
https://bugzilla.redhat.com/show_bug.cgi?id=2009312
report
https://bugzilla.redhat.com/show_bug.cgi?id=2009521
report
https://bugzilla.redhat.com/show_bug.cgi?id=2010463
report
https://bugzilla.redhat.com/show_bug.cgi?id=2011104
report
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
report
https://bugzilla.redhat.com/show_bug.cgi?id=2014230
report
https://bugzilla.redhat.com/show_bug.cgi?id=2015525
report
https://bugzilla.redhat.com/show_bug.cgi?id=2015755
report
https://bugzilla.redhat.com/show_bug.cgi?id=2016169
report
https://bugzilla.redhat.com/show_bug.cgi?id=2017073
report
https://bugzilla.redhat.com/show_bug.cgi?id=2017796
report
https://bugzilla.redhat.com/show_bug.cgi?id=2018205
report
https://bugzilla.redhat.com/show_bug.cgi?id=2022814
report
https://bugzilla.redhat.com/show_bug.cgi?id=2025003
report
https://bugzilla.redhat.com/show_bug.cgi?id=2025726
report
https://bugzilla.redhat.com/show_bug.cgi?id=2027239

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 43

Vulnerabilities 67

tcp: fix page frag corruption on page fault

scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()

RDMA/irdma: Fix a user-after-free in add_pble_prm

drm/vmwgfx: Fix stale file descriptors on failed usercopy

HID: mcp2221: prevent a buffer overflow in mcp_smbus_write()

bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data

wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()

scsi: target: core: Avoid smp_processor_id() in preemptible code

drm/amdkfd: Fix UBSAN shift-out-of-bounds warning

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authori…

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user t…

Copy_from_user Spectre-V1 Gadget in Linux Kernel

dm rq: don't queue request to blk-mq during DM suspend

An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c la…

An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.…

An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kf…

IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the da…

Kernel: security regression for cve-2018-13405

An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. Th…

A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local acco…

In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. Thi…

An issue was discovered in the Linux kernel 4.4 through 5.7.1. drivers/tty/vt/keyboard.c has an integer overflow if k_a…

A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if rem…

In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free. This could lead to …

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functiona…

LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.

BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them…

An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc…

A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segm…

hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checkin…

An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sa…

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c,…

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket a…

A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a …

A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a de…

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through inv…

A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for furth…

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memo…

A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux ke…

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers i…

A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A K…

An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way user…

prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to tr…

An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found …

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race …

The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/fire…

An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the ho…

An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_ca…

In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (…

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs …

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of…

In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash…

RDMA/rxe: Return CQE error if invalid lkey was supplied

igb: Fix use-after-free error during reset

dm: fix mempool NULL pointer race when completing IO

i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc

ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()

mptcp: fix deadlock in __mptcp_push_pending()

A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of ser…

A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the…

A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw all…

iommu/amd: Fix I/O page table memory leak

igc: avoid kernel warning when changing RX ring parameters

RDMA/core: Make sure "ib_port" is valid when access sysfs node

perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()

perf trace: Really free the evsel->priv area

References