Red Hat Security Advisory: kernel security and bug fix update

Fixed packages 43

Vulnerabilities 13

• Critical 9.8
  CVE-2021-47013

  net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send

  In the Linux kernel, the following vulnerability has been resolved: net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be fre…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 28, 2024
• Critical 9.8
  CVE-2022-50717

  nvmet-tcp: add bounds check on Transfer Tag

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds check on Transfer Tag ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(), add a bounds check to avoid out-of-bounds access.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2023-1118

  A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user det…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Mar 2, 2023
• High 7.8
  CVE-2024-26586

  mlxsw: spectrum_acl_tcam: Fix stack corruption

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a lis…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 22, 2024
• High 7.8
  CVE-2024-26642

  netfilter: nf_tables: disallow anonymous set with timeout flag

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 21, 2024
• High 7.1
  CVE-2024-25743

  In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time an…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  May 15, 2024
• Medium 6.5
  CVE-2023-6356

  Kernel: null pointer dereference in nvmet_tcp_build_iovec

  A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing ke…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 7, 2024
• Medium 6.5
  CVE-2023-6535

  Kernel: null pointer dereference in nvmet_tcp_execute_request

  A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kerne…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 7, 2024
• Medium 6.5
  CVE-2023-6536

  Kernel: null pointer dereference in __nvmet_req_complete

  A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kerne…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Feb 7, 2024
• Medium 6.5
  CVE-2024-25742

  In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  May 17, 2024
• Medium 5.6
  CVE-2023-1998 Public exploit

  Spectre v2 SMT mitigations problem in Linux kernel

  The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 21, 2023
• Unscored —
  CVE-2023-52578

  net: bridge: use DEV_STATS_INC()

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: use DEV_STATS_INC() syzbot/KCSAN reported data-races in br_handle_frame_finish() [1] This function can run from multiple cpus without mutual exclusion. Adopt SMP safe DEV_STATS_I…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• Unscored —
  CVE-2024-26602

  sched/membarrier: reduce the ability to hammer on sys_membarrier

  In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 24, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2174400
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2187257
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254052
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254053
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254054
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265645
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266841
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2267695
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2267758
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270836
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270881
• article
  https://issues.redhat.com/browse/RHEL-27235
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3810.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47013
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47013
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47013
• article
  https://lore.kernel.org/linux-cve-announce/2024022831-CVE-2021-47013-034a@gregkh/T/#u
• report
  https://access.redhat.com/security/cve/CVE-2022-50717
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2425070
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-50717
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-50717
• article
  https://lore.kernel.org/linux-cve-announce/2025122416-CVE-2022-50717-dc68@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-1118
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-1118
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-1118
• article
  https://github.com/torvalds/linux/commit/29b0589a865b6f66d141d79b2dd1373e4e50fe17
• report
  https://access.redhat.com/security/cve/CVE-2023-1998
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-1998
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-1998
• article
  https://github.com/google/security-research/security/advisories/GHSA-mj4w-6495-6crx
• report
  https://access.redhat.com/security/cve/CVE-2023-6356
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6356
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6356
• report
  https://access.redhat.com/security/cve/CVE-2023-6535
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6535
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-6535
• report
  https://access.redhat.com/security/cve/CVE-2023-6536
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-6536