Red Hat Security Advisory: kernel security and bug fix update

Fixed packages 59

Vulnerabilities 16

• High 7.8
  CVE-2024-1086 Exploited · Ransomware Public exploit EPSS 28%

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slo…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 31, 2024

  KEV May 30, 2024
• High 7.8
  CVE-2022-49920

  netfilter: nf_tables: netlink notifier might race to release objects

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: netlink notifier might race to release objects commit release path is invoked via call_rcu and it runs lockless to release the objects after rcu grace period. The netlin…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2025
• High 7.8
  CVE-2022-50048

  netfilter: nf_tables: possible module reference underflow in error path

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: possible module reference underflow in error path dst->ops is set on when nft_expr_clone() fails, but module refcount has not been bumped yet, therefore nft_expr_destroy…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• High 7.8
  CVE-2022-50213

  netfilter: nf_tables: do not allow SET_ID to refer to another table

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not allow SET_ID to refer to another table When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the tab…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• High 7.8
  CVE-2023-4244

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it …

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 6, 2023
• High 7.8
  CVE-2023-52628

  netfilter: nftables: exthdr: fix 4-byte stack OOB write

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv->len is a multiple of 4, then dst[len / 4] can write past the destination array which leads to stack corruption. This construct…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 28, 2024
• High 7.8
  CVE-2023-53566

  netfilter: nft_set_rbtree: fix null deref on element insertion

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: fix null deref on element insertion There is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem(): general protection fault, probably for non-ca…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 7.8
  CVE-2023-54035

  netfilter: nf_tables: fix underflow in chain reference counter

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix underflow in chain reference counter Set element addition error path decrements reference counter on chains twice: once on element release and again via nft_data_rel…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2023-6817

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PI…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 18, 2023
• High 7.8
  CVE-2024-26586

  mlxsw: spectrum_acl_tcam: Fix stack corruption

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a lis…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 22, 2024
• High 7.1
  CVE-2024-25743

  In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time an…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  May 15, 2024
• Medium 6.5
  CVE-2023-6240

  Kernel: marvin vulnerability side-channel leakage in the rsa decryption operation

  A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt ciphertexts or forge signatures, limiting the services that use that private key.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 4, 2024
• Medium 6.5
  CVE-2024-25742

  In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  May 17, 2024
• Medium 5.5
  CVE-2023-52993

  x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL

  In the Linux kernel, the following vulnerability has been resolved: x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL Baoquan reported that after triggering a crash the subsequent crash-kernel fails to boot about half of the time. It triggers a NULL pointe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Medium 5.5
  CVE-2023-53304

  netfilter: nft_set_rbtree: fix overlap expiration walk

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: fix overlap expiration walk The lazy gc on insert that should remove timed-out entries fails to release the other half of the interval, if any. Can be reproduced wi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• Unscored —
  CVE-2023-52924

  netfilter: nf_tables: don't skip expired elements during walk

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't skip expired elements during walk There is an asymmetry between commit/abort and preparation phase if the following conditions are met: 1. set is a verdict map ("1…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 5, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2235306
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250843
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255139
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262126
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265645
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270836
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2272041
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3421.json
• report
  https://access.redhat.com/security/cve/CVE-2022-49920
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363410
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-49920
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-49920
• article
  https://lore.kernel.org/linux-cve-announce/2025050108-CVE-2022-49920-667b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-50048
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373580
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50048
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50048
• article
  https://lore.kernel.org/linux-cve-announce/2025061845-CVE-2022-50048-40d7@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-50213
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373522
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50213
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50213
• article
  https://lore.kernel.org/linux-cve-announce/2025061844-CVE-2022-50213-bc19@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-4244
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-4244
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-4244
• article
  https://lore.kernel.org/netdev/20230810070830.24064-1-pablo@netfilter.org/
• article
  https://lore.kernel.org/netdev/20230815223011.7019-1-fw@strlen.de/
• report
  https://access.redhat.com/security/cve/CVE-2023-6240
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6240
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6240
• article
  https://people.redhat.com/~hkario/marvin/
• article
  https://securitypitfalls.wordpress.com/2023/10/16/experiment-with-side-channel-attacks-yourself/
• report
  https://access.redhat.com/security/cve/CVE-2023-6817
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6817
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6817
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=317eb9685095678f2c9f5a8189de698c5354316a
• report
  https://access.redhat.com/security/cve/CVE-2023-52628