Red Hat Security Advisory: kernel security and bug fix update

Fixed packages 52

Vulnerabilities 52

• Critical 10.0
  CVE-2023-2163 Public exploit

  Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation

  Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 20, 2023
• High 8.8
  CVE-2023-5178 Public exploit

  Kernel: use after free in nvmet_tcp_free_crypto in nvme

  A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, whic…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Nov 1, 2023
• High 7.8
  CVE-2023-31436

  qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax ca…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 28, 2023
• High 7.8
  CVE-2023-3611

  Out-of-bounds write in Linux kernel's net/sched: sch_qfq component

  An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated accordin…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 21, 2023
• High 7.8
  CVE-2023-3812

  Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags

  An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jul 24, 2023
• High 7.8
  CVE-2023-4622 Public exploit

  Use-after-free in Linux kernel's af_unix component

  A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-4623

  Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component

  A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2024-0562

  Kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c

  A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 15, 2024
• High 7.1
  CVE-2022-41858

  A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Jan 17, 2023
• High 7.1
  CVE-2023-3268

  An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c …

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 16, 2023
• High 7.1
  CVE-2023-3567

  Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race

  A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jul 24, 2023
• High 7.0
  CVE-2022-3522 Rejected

  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Oct 16, 2022
• High 7.0
  CVE-2023-35823

  An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/medi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jun 18, 2023
• High 7.0
  CVE-2023-35824

  An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jun 18, 2023
• High 7.0
  CVE-2023-42753

  Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

  An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer o…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Sep 25, 2023
• Medium 6.8
  CVE-2023-1079

  A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconn…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Mar 27, 2023
• Medium 6.7
  CVE-2022-43750

  drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 26, 2022
• Medium 6.7
  CVE-2023-2194

  An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->bl…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Apr 20, 2023
• Medium 6.7
  CVE-2023-2513

  A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode si…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  May 8, 2023
• Medium 6.6
  CVE-2022-3628

  A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user conn…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jan 12, 2023
• Medium 6.6
  CVE-2023-1073

  A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Mar 27, 2023
• Medium 6.5
  CVE-2022-40982

  Information exposure through microarchitectural state after transient execution in certain vector execution units for s…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Alpine
  Aug 11, 2023
• Medium 6.5
  CVE-2023-1192

  Use-after-free in smb2_is_status_io_timeout()

  A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses …

  Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Nov 1, 2023
• Medium 6.4
  CVE-2023-33203

  The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/e…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  May 18, 2023
• Medium 6.3
  CVE-2023-1855

  A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux K…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 5, 2023
• Medium 5.6
  CVE-2023-1998 Public exploit

  Spectre v2 SMT mitigations problem in Linux kernel

  The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 21, 2023
• Medium 5.5
  CVE-2022-41218 Public exploit

  In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount ra…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Sep 21, 2022
• Medium 5.5
  CVE-2022-4129

  A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu
  Nov 28, 2022
• Medium 5.5
  CVE-2022-47929

  In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivilege…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jan 17, 2023
• Medium 5.5
  CVE-2023-0394

  A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jan 24, 2023
• Medium 5.5
  CVE-2023-1195

  A use-after-free flaw was found in reconn_set_ipaddr_from_hostname in fs/cifs/connect.c in the Linux kernel. The issue …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  May 18, 2023
• Medium 5.5
  CVE-2023-2162

  A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-compone…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 19, 2023
• Medium 5.5
  CVE-2023-23454

  cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (sl…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jan 12, 2023
• Medium 5.5
  CVE-2023-3161

  A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height gr…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Jun 12, 2023
• Medium 5.5
  CVE-2023-3772

  Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()

  A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jul 25, 2023
• Medium 5.5
  CVE-2023-4459

  Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()

  A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Aug 21, 2023
• Medium 5.5
  CVE-2023-53015

  HID: betop: check shape of output reports

  In the Linux kernel, the following vulnerability has been resolved: HID: betop: check shape of output reports betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields.…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Medium 4.7
  CVE-2023-1382

  A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads t…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 19, 2023
• Medium 4.7
  CVE-2023-26545

  In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registe…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Feb 25, 2023
• Medium 4.7
  CVE-2023-4732

  Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.h

  A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Oct 3, 2023
• Medium 4.6
  CVE-2022-3567

  Linux Kernel IPv6 inet6_dgram_ops race condition

  A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch …

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 17, 2022
• Unscored —
  CVE-2022-0854

  A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw al…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Mar 23, 2022
• Unscored —
  CVE-2022-1016

  A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 29, 2022
• Unscored —
  CVE-2022-1679 Public exploit

  A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  May 16, 2022
• Unscored —
  CVE-2022-20141

  In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local esca…

  linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu
  Jun 15, 2022
• Unscored —
  CVE-2022-3028

  A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple c…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Aug 31, 2022
• Unscored —
  CVE-2022-30594 Public exploit

  The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass in…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  May 12, 2022
• Unscored —
  CVE-2022-50083 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Jun 18, 2025
• Unscored —
  CVE-2022-50179

  ath9k: fix use-after-free in ath9k_hif_usb_rx_cb

  In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• Unscored —
  CVE-2023-1838

  A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the L…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 5, 2023
• Unscored —
  CVE-2023-38409

  An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Becaus…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jul 17, 2023
• Unscored —
  CVE-2023-45871

  An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 15, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/solutions/7027704
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2058395
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2066614
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2084125
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2085300
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2087568
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2114937
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2122228
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2122960
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134528
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143943
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2144379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150960
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150979
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2151270
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2154171
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2154178
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2162120
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2168246
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2168297
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2173403
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2173444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177371
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2182443
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184578
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187257
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187773
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2188396
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2192667
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2192671
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2193097
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2213485
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215502
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215835
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215836
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2218943
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2219268
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2221463