Red Hat Security Advisory: kernel security and bug fix update

Fixed packages 43

Vulnerabilities 36

• Critical 10.0
  CVE-2023-2163 Public exploit

  Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation

  Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 20, 2023
• Critical 9.3
  CVE-2023-53996

  x86/sev: Make enc_dec_hypercall() accept a size instead of npages

  In the Linux kernel, the following vulnerability has been resolved: x86/sev: Make enc_dec_hypercall() accept a size instead of npages enc_dec_hypercall() accepted a page count instead of a size, which forced its callers to round up. As a result, non-page alig…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 8.8
  CVE-2023-5178 Public exploit

  Kernel: use after free in nvmet_tcp_free_crypto in nvme

  A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, whic…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Nov 1, 2023
• High 8.2
  CVE-2023-53372

  sctp: fix a potential overflow in sctp_ifwdtsn_skip

  In the Linux kernel, the following vulnerability has been resolved: sctp: fix a potential overflow in sctp_ifwdtsn_skip Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only checks the pos against the end of the chunk. However, the data le…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• High 7.8
  CVE-2022-49995

  writeback: avoid use-after-free after removing device

  In the Linux kernel, the following vulnerability has been resolved: writeback: avoid use-after-free after removing device When a disk is removed, bdi_unregister gets called to stop further writeback and wait for associated delayed work to complete. However, w…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• High 7.8
  CVE-2023-31436

  qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax ca…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 28, 2023
• High 7.8
  CVE-2023-3611

  Out-of-bounds write in Linux kernel's net/sched: sch_qfq component

  An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated accordin…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 21, 2023
• High 7.8
  CVE-2023-3812

  Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags

  An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jul 24, 2023
• High 7.8
  CVE-2023-4622 Public exploit

  Use-after-free in Linux kernel's af_unix component

  A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-4623

  Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component

  A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-52973

  vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF

  In the Linux kernel, the following vulnerability has been resolved: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF After a call to console_unlock() in vcs_read() the vc_data struct can be freed by vc_deallocate(). Because of that, t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• High 7.8
  CVE-2023-52974

  scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress

  In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipadd…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• High 7.8
  CVE-2023-52975

  scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress

  In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• High 7.8
  CVE-2023-5717 Public exploit

  Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component

  A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's si…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 25, 2023
• High 7.1
  CVE-2023-3141

  A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. Thi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jun 9, 2023
• High 7.1
  CVE-2023-3567

  Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race

  A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jul 24, 2023
• High 7.0
  CVE-2023-35823

  An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/medi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jun 18, 2023
• High 7.0
  CVE-2023-35824

  An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jun 18, 2023
• High 7.0
  CVE-2023-46813 Public exploit

  An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO regi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 27, 2023
• Medium 6.8
  CVE-2023-1079

  A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconn…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Mar 27, 2023
• Medium 6.6
  CVE-2023-1073

  A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Mar 27, 2023
• Medium 6.4
  CVE-2023-33203

  The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/e…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  May 18, 2023
• Medium 6.3
  CVE-2023-1855

  A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux K…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 5, 2023
• Medium 5.5
  CVE-2023-2162

  A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-compone…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 19, 2023
• Medium 5.5
  CVE-2023-23455

  atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service b…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jan 12, 2023
• Medium 5.5
  CVE-2023-28328

  A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kerne…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Apr 19, 2023
• Medium 5.5
  CVE-2023-3772

  Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()

  A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jul 25, 2023
• Medium 5.5
  CVE-2023-4132

  Kernel: smsusb: use-after-free caused by do_submit_urb()

  A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Aug 3, 2023
• Medium 5.5
  CVE-2023-53296

  sctp: check send stream number after wait_for_sndbuf

  In the Linux kernel, the following vulnerability has been resolved: sctp: check send stream number after wait_for_sndbuf This patch fixes a corner case where the asoc out stream count may change after wait_for_sndbuf. When the main thread in the client starts…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• Medium 5.3
  CVE-2023-0458

  Spectre V1 Gadget in do_prlimit in the Linux Kernel

  A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading…

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 26, 2023
• Medium 4.7
  CVE-2023-26545

  In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registe…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Feb 25, 2023
• Low 3.3
  CVE-2023-1075

  A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessin…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Mar 27, 2023
• Unscored —
  CVE-2023-1838

  A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the L…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 5, 2023
• Unscored —
  CVE-2023-35825 Rejected

  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-3141. Reason: This candidate is a reservation duplicate of CVE-2…

  linux-raspi2 linux-azure linux-riscv linux-gcp Ubuntu
  Jun 18, 2023
• Unscored —
  CVE-2023-45871

  An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 15, 2023
• Unscored —
  CVE-2023-53147

  xfrm: add NULL check in xfrm_update_ae_params

  In the Linux kernel, the following vulnerability has been resolved: xfrm: add NULL check in xfrm_update_ae_params Normally, x->replay_esn and x->preplay_esn should be allocated at xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the xfrm_u…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2087568
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2168332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2173403
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2173434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2173444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177389
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2182443
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184578
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187773
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2192667
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2192671
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2193219
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2213199
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215835
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215836
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2215837
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2218943
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2221463
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2221707
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2224048
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2225191
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2230094
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237757
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237760
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2240249
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2241924
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2244723
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246944
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246945
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0575.json
• report
  https://access.redhat.com/security/cve/CVE-2022-49995
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373560
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-49995
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-49995
• article
  https://lore.kernel.org/linux-cve-announce/2025061826-CVE-2022-49995-2d74@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-0458
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-0458
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-0458