Red Hat Security Advisory: kernel security and bug fix update

Fixed packages 43

Vulnerabilities 37

• High 7.8
  CVE-2024-1086 Exploited · Ransomware Public exploit EPSS 28%

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slo…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 31, 2024

  KEV May 30, 2024
• High 7.8
  CVE-2022-4744

  A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the devi…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Mar 30, 2023
• High 7.8
  CVE-2023-2176

  A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The im…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 20, 2023
• High 7.8
  CVE-2023-40283

  An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Aug 14, 2023
• High 7.8
  CVE-2023-4921

  Use-after-free in Linux kernel's net/sched: sch_qfq component

  A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue()…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 12, 2023
• High 7.8
  CVE-2023-51042

  In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jan 23, 2024
• High 7.8
  CVE-2023-5633

  Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

  The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Oct 23, 2023
• High 7.8
  CVE-2023-6817

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PI…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 18, 2023
• High 7.8
  CVE-2023-6931 Public exploit

  Out-of-bounds write in Linux kernel's Performance Events system component

  A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_…

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 19, 2023
• High 7.8
  CVE-2023-6932

  Use-after-free in Linux kernel's ipv4: igmp component

  A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 19, 2023
• High 7.1
  CVE-2022-41858

  A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Jan 17, 2023
• High 7.1
  CVE-2023-6606

  Kernel: out-of-bounds read vulnerability in smbcalcsize

  An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Dec 8, 2023
• High 7.1
  CVE-2023-6610

  Kernel: oob access in smb2_dump_detail

  An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Dec 8, 2023
• High 7.0
  CVE-2023-51043

  In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a n…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jan 23, 2024
• High 7.0
  CVE-2024-0646

  Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

  An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privile…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 17, 2024
• Medium 6.8
  CVE-2024-0565

  Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client

  An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.

  Linux Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Jan 15, 2024
• Medium 6.7
  CVE-2023-28772 Public exploit

  An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Mar 23, 2023
• Medium 6.7
  CVE-2023-33951

  Kernel: vmwgfx: race condition leading to information disclosure vulnerability

  A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jul 24, 2023
• Medium 6.7
  CVE-2023-33952

  Kernel: vmwgfx: double free within the handling of vmw_buffer_object objects

  A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which m…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jul 24, 2023
• Medium 6.5
  CVE-2023-30456

  An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 10, 2023
• Medium 6.3
  CVE-2022-36402

  There is an int overflow vulnerability in vmwgfx driver

  An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain …

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2022
• Medium 6.3
  CVE-2022-38096

  There is a NULL pointer vulnerability in vmwgfx driver

  A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system t…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 9, 2022
• Medium 6.3
  CVE-2022-38457

  There is an UAF vulnerability in vmwgfx driver

  A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 9, 2022
• Medium 6.3
  CVE-2022-40133

  There is an UAF vulnerability in vmwgfx driver

  A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account …

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 9, 2022
• Medium 5.5
  CVE-2022-28388

  usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 3, 2022
• Medium 5.5
  CVE-2022-3545

  Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free

  A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 17, 2022
• Medium 5.5
  CVE-2022-45869

  A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial o…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Nov 30, 2022
• Medium 5.5
  CVE-2023-2166

  A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may n…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu Azure Linux
  Apr 19, 2023
• Medium 5.5
  CVE-2023-31084

  An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 24, 2023
• Medium 5.5
  CVE-2023-53421

  blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()

  In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() When blkg_alloc() is called to allocate a blkcg_gq structure with the associated blkg_iostat_set's, there are 2 fields…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 18, 2025
• Medium 5.5
  CVE-2023-7192

  Kernel: refcount leak in ctnetlink_create_conntrack()

  A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 2, 2024
• Medium 5.3
  CVE-2022-3594

  Linux Kernel BPF r8152.c intr_callback logging of excessive data

  A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The att…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 18, 2022
• Medium 4.7
  CVE-2022-45887

  An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak be…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Nov 25, 2022
• Medium 4.7
  CVE-2023-1382

  A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads t…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Apr 19, 2023
• Unscored —
  CVE-2021-43975

  In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_ut…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Nov 17, 2021
• Unscored —
  CVE-2022-50148

  kernfs: fix potential NULL dereference in __kernfs_remove

  In the Linux kernel, the following vulnerability has been resolved: kernfs: fix potential NULL dereference in __kernfs_remove When lockdep is enabled, lockdep_assert_held_write would cause potential NULL pointer dereference. Fix the following smatch warnings:…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• Unscored —
  CVE-2023-45862

  An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 14, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2024989
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2073091
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2133451
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2133452
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2133453
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2133455
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2144379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2148520
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2149024
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2151317
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2156322
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177371
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2181330
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187813
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187931
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2188468
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2213139
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2218195
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2218212
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231800
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2244715
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2245514
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2245663
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2252731
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253611
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253614
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253908
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255139
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255283
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2256279
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2258518
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259866
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2260005
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262126
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1404.json
• report
  https://access.redhat.com/security/cve/CVE-2021-43975
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-43975