Red Hat Security Advisory: kernel security and bug fix update

Fixed packages 52

Vulnerabilities 57

• Medium 5.3
  CVE-2022-2586 Exploited Public exploit EPSS 10%

  It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…

  The Linux Kernel Organization linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 8, 2024

  KEV Jun 26, 2024
• High 8.8
  CVE-2021-34866

  This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jan 25, 2022
• High 7.8
  CVE-2022-39189

  An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Sep 2, 2022
• High 7.8
  CVE-2022-50213

  netfilter: nf_tables: do not allow SET_ID to refer to another table

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not allow SET_ID to refer to another table When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the tab…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• High 7.8
  CVE-2023-1252

  A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations s…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Mar 23, 2023
• High 7.8
  CVE-2023-2176

  A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The im…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 20, 2023
• High 7.8
  CVE-2023-40283

  An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 14, 2023
• High 7.8
  CVE-2023-4921

  Use-after-free in Linux kernel's net/sched: sch_qfq component

  A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue()…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 12, 2023
• High 7.8
  CVE-2023-5717 Public exploit

  Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component

  A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's si…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 25, 2023
• High 7.8
  CVE-2023-6817

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PI…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 18, 2023
• High 7.8
  CVE-2023-6932

  Use-after-free in Linux kernel's ipv4: igmp component

  A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 19, 2023
• High 7.5
  CVE-2022-36946 Public exploit

  nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jul 27, 2022
• High 7.1
  CVE-2023-3141

  A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. Thi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jun 9, 2023
• High 7.1
  CVE-2023-6610

  Kernel: oob access in smb2_dump_detail

  An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Dec 8, 2023
• High 7.0
  CVE-2023-1989

  Kernel: use after free bug in btsdio_remove due to race condition

  A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Apr 11, 2023
• High 7.0
  CVE-2023-46813 Public exploit

  An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO regi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 27, 2023
• High 7.0
  CVE-2024-0646

  Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

  An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privile…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 17, 2024
• Medium 6.7
  CVE-2022-21499

  KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker w…

  Oracle Oracle Linux Oracle VM linux-raspi2 Linux Debian Ubuntu
  Jun 9, 2022
• Medium 6.7
  CVE-2023-28772 Public exploit

  An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Mar 23, 2023
• Medium 6.5
  CVE-2023-6356

  Kernel: null pointer dereference in nvmet_tcp_build_iovec

  A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing ke…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 7, 2024
• Medium 6.5
  CVE-2023-6535

  Kernel: null pointer dereference in nvmet_tcp_execute_request

  A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kerne…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 7, 2024
• Medium 6.5
  CVE-2023-6536

  Kernel: null pointer dereference in __nvmet_req_complete

  A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kerne…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 7, 2024
• Medium 5.5
  CVE-2022-28388

  usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 3, 2022
• Medium 5.5
  CVE-2022-3545

  Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free

  A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 17, 2022
• Medium 5.5
  CVE-2022-3707

  A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resou…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Mar 6, 2023
• Medium 5.5
  CVE-2022-49908

  Bluetooth: L2CAP: Fix memory leak in vhci_write

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix memory leak in vhci_write Syzkaller reports a memory leak as follows: ==================================== BUG: memory leak unreferenced object 0xffff88810d81ac00 (size …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2025
• Medium 5.5
  CVE-2023-2166

  A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may n…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Apr 19, 2023
• Medium 5.5
  CVE-2023-23455

  atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service b…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jan 12, 2023
• Medium 5.5
  CVE-2023-28328

  A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kerne…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Apr 19, 2023
• Medium 5.5
  CVE-2023-4132

  Kernel: smsusb: use-after-free caused by do_submit_urb()

  A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Aug 3, 2023
• Medium 5.3
  CVE-2022-3594

  Linux Kernel BPF r8152.c intr_callback logging of excessive data

  A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The att…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 18, 2022
• Medium 5.3
  CVE-2023-0458

  Spectre V1 Gadget in do_prlimit in the Linux Kernel

  A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading…

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 26, 2023
• Medium 5.0
  CVE-2022-3623

  Linux Kernel BPF gup.c follow_page_pte race condition

  A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation leads to race condition. The attack can be launched remo…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 20, 2022
• Medium 4.7
  CVE-2022-45887

  An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak be…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Nov 25, 2022
• Medium 4.6
  CVE-2022-3566

  Linux Kernel TCP tcp_setsockopt race condition

  A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. Such manipulation leads to race condition. A high complexity level is associated wit…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 17, 2022
• Medium 4.3
  CVE-2022-3524

  Linux Kernel IPv6 ipv6_renew_options memory leak

  A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is …

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 16, 2022
• Low 3.5
  CVE-2022-3619

  Linux Kernel Bluetooth l2cap_core.c l2cap_recv_acldata memory leak

  A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to memory leak. It is recommende…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 20, 2022
• Low 3.3
  CVE-2023-1075

  A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessin…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Mar 27, 2023
• Unscored —
  CVE-2021-30002

  An issue was discovered in the Linux kernel before 5.11.3 when a webcam device exists. video_usercopy in drivers/media/…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 2, 2021
• Unscored —
  CVE-2021-3640

  A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Mar 3, 2022
• Unscored —
  CVE-2021-4204 Public exploit

  An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. Thi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Aug 24, 2022
• Unscored —
  CVE-2022-0168

  A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 26, 2022
• Unscored —
  CVE-2022-0500

  A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in th…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Mar 25, 2022
• Unscored —
  CVE-2022-0617

  A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers ud…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Feb 16, 2022
• Unscored —
  CVE-2022-1462

  An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  May 31, 2022
• Unscored —
  CVE-2022-2078 Public exploit

  A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to t…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jun 30, 2022
• Unscored —
  CVE-2022-23222 Public exploit

  kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availabi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jan 14, 2022
• Unscored —
  CVE-2022-24448

  An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag,…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Feb 4, 2022
• Unscored —
  CVE-2022-25265 Public exploit

  In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approxi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Feb 16, 2022
• Unscored —
  CVE-2022-2663

  An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly m…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu
  Sep 1, 2022
• Unscored —
  CVE-2022-28390

  ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 3, 2022
• Unscored —
  CVE-2022-28893

  The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the i…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 11, 2022
• Unscored —
  CVE-2022-50272

  media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()

  In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in ra…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2023-20569

  A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. …

  AMD 3rd Gen AMD EPYC™ Processors 2nd Gen AMD EPYC™ Processors 4th Gen AMD EPYC™ Processors Debian Ubuntu Alpine
  Aug 8, 2023
• Unscored —
  CVE-2023-35825 Rejected

  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-3141. Reason: This candidate is a reservation duplicate of CVE-2…

  linux-raspi2 linux-azure linux-riscv linux-gcp Ubuntu
  Jun 18, 2023
• Unscored —
  CVE-2023-45862

  An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 14, 2023
• Unscored —
  CVE-2023-54270

  media: usb: siano: Fix use after free bugs caused by do_submit_urb

  In the Linux kernel, the following vulnerability has been resolved: media: usb: siano: Fix use after free bugs caused by do_submit_urb There are UAF bugs caused by do_submit_urb(). One of the KASan reports is shown below: [ 36.403605] BUG: KASAN: use-after-fr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1946279
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1980646
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2000457
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2037386
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2039178
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2043520
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044578
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2051444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2053632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2055499
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2073064
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2073091
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2074208
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2078466
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2084183
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2096178
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2114878
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2115278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2123056
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2124788
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2137979
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2143893
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2148520
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2149024
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2150947
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2154235
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2165721
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2168332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2173434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2176140
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177389
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2181330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2185945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187813
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187931
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2193219
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2207625