Red Hat Security Advisory: kernel security update

Fixed packages 85

Vulnerabilities 20

• Critical 9.8
  CVE-2023-52881

  tcp: do not accept ACK of bytes we never sent

  In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. ACK seq validation is currently following RFC 5961 5.2 g…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 29, 2024
• High 8.1
  CVE-2023-53803

  scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()

  In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() A fix for: BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] Read of size 1 at addr ffff88a1b043…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2022-50341

  cifs: fix oops during encryption

  In the Linux kernel, the following vulnerability has been resolved: cifs: fix oops during encryption When running xfstests against Azure the following oops occurred on an arm64 system Unable to handle kernel write to read-only memory at virtual address ffff00…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• High 7.8
  CVE-2024-36928

  s390/qeth: Fix kernel panic after setting hsuid

  In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Fix kernel panic after setting hsuid Symptom: When the hsuid attribute is set for the first time on an IQD Layer3 device while the corresponding network interface is already UP, th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• High 7.8
  CVE-2024-41009

  bpf: Fix overrunning reservations in ringbuf

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumer_pos i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 17, 2024
• High 7.8
  CVE-2024-41041

  udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().

  In the Linux kernel, the following vulnerability has been resolved: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). syzkaller triggered the warning [0] in udp_v4_early_demux(). In udp_v[46]_early_demux() and sk_lookup(), we do not touch the refcount of …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• High 7.1
  CVE-2024-41014

  xfs: add bounds checking to xlog_recover_process_data

  In the Linux kernel, the following vulnerability has been resolved: xfs: add bounds checking to xlog_recover_process_data There is a lack of verification of the space occupied by fixed members of xlog_op_header in the xlog_recover_process_data. We can create …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• Medium 5.5
  CVE-2023-0597

  A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Feb 23, 2023
• Medium 5.5
  CVE-2024-26984

  nouveau: fix instmem race condition around ptr stores

  In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash. BUG: kernel NULL point…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• Unscored —
  CVE-2023-52619

  pstore/ram: Fix crash when setting number of cpus to an odd number

  In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fix crash when setting number of cpus to an odd number When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number. The address of …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 18, 2024
• Unscored —
  CVE-2023-52749

  spi: Fix null dereference on suspend

  In the Linux kernel, the following vulnerability has been resolved: spi: Fix null dereference on suspend A race condition exists where a synchronous (noqueue) transfer can be active during a system suspend. This can cause a null pointer dereference exception …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 21, 2024
• Unscored —
  CVE-2023-53521

  scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()

  In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() A fix for: BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses] Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/120…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2024-27399

  Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 13, 2024
• Unscored —
  CVE-2024-36920

  scsi: mpi3mr: Avoid memcpy field-spanning write WARNING

  In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Avoid memcpy field-spanning write WARNING When the "storcli2 show" command is executed for eHBA-9600, mpi3mr driver prints this WARNING message: memcpy: detected field-spanning …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• Unscored —
  CVE-2024-37356

  tcp: Fix shift-out-of-bounds in dctcp_update_alpha().

  In the Linux kernel, the following vulnerability has been resolved: tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). In dctcp_update_alpha(), we use a module parameter dctcp_shift_g as follows: alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g); ... de…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 21, 2024
• Unscored —
  CVE-2024-40988

  drm/radeon: fix UBSAN warning in kv_dpm.c

  In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix UBSAN warning in kv_dpm.c Adds bounds check for sumo_vid_mapping_entry.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-41093

  drm/amdgpu: avoid using null object of framebuffer

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid using null object of framebuffer Instead of using state->fb->obj[0] directly, get object from framebuffer by calling drm_gem_fb_get_obj() and return error code when object i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• Unscored —
  CVE-2024-42154

  tcp_metrics: validate source addr length

  In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at al…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 30, 2024
• Unscored —
  CVE-2024-42240

  x86/bhi: Avoid warning in #DB handler due to BHI mitigation

  In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in #DB handler due to BHI mitigation When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set then entry_SYSENTER_compat() uses CLEAR_BRANCH_HISTORY …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 7, 2024
• Unscored —
  CVE-2024-43854

  block: initialize integrity buffer to zero before writing it to media

  In the Linux kernel, the following vulnerability has been resolved: block: initialize integrity buffer to zero before writing it to media Metadata added by bio_integrity_prep is using plain kmalloc, which leads to random kernel memory being written media. For…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 17, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2165926
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2258875
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270084
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278333
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2280462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282679
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284515
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293658
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297572
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2298412
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300297
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300410
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300488
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2301522
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10772.json
• report
  https://access.redhat.com/security/cve/CVE-2022-50341
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395879
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50341
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50341
• article
  https://lore.kernel.org/linux-cve-announce/2025091638-CVE-2022-50341-12c1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-0597
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-0597
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-0597
• article
  https://lore.kernel.org/lkml/Yz%2FmfJ1gjgshF19t@hirez.programming.kicks-ass.net/
• report
  https://access.redhat.com/security/cve/CVE-2023-52619
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52619
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52619
• article
  https://lore.kernel.org/linux-cve-announce/20240318102117.2839904-9-lee@kernel.org/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52749
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52749
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52749
• article
  https://lore.kernel.org/linux-cve-announce/2024052144-CVE-2023-52749-684e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52881
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52881
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52881
• article
  https://lore.kernel.org/all/20231205161841.2702925-1-edumazet@google.com/
• article
  https://lore.kernel.org/linux-cve-announce/2024052941-CVE-2023-52881-4283@gregkh/T/#u
• report
  https://access.redhat.com/security/cve/CVE-2023-53521