Skip to content
OpenAdvisories
Critical RHSA-2024:4740 17 CVEs

Red Hat Security Advisory: kernel security update

Published Sep 27, 2024 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 43

ReleasePackageFixed in
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos bpftool 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos bpftool-debuginfo 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-core 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-core 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-devel 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-modules 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-aarch64 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-ppc64le 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-s390x 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-devel 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-doc 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-modules 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-modules-extra 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-tools 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-tools-libs 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-core 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-debuginfo 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-devel 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-modules 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-modules-extra 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos perf 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos perf-debuginfo 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos python3-perf 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb bpftool-debuginfo 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debug-debuginfo 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo-common-aarch64 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo-common-ppc64le 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo-common-x86_64 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-tools-debuginfo 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-tools-libs-devel 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb perf-debuginfo 0:4.18.0-477.64.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb python3-perf-debuginfo 0:4.18.0-477.64.1.el8_8

Vulnerabilities 17

  • Critical 9.8
    CVE-2021-47548

    ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()

    In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port less than DSAF…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2024-35960

    net/mlx5: Properly link new fs rules into the tree

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Properly link new fs rules into the tree Previously, add_rule_fg would only add newly created rules from the handle into the tree when they had a refcount of 1. On the other hand, c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2023-52530

    wifi: mac80211: fix potential key use-after-free

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential key use-after-free When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gt…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2024-26598

    KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2024-26801

    Bluetooth: Avoid potential use-after-free in hci_error_reset

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset While handling the HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2024-35937

    wifi: cfg80211: check A-MSDU format more carefully

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check A-MSDU format more carefully If it looks like there's another subframe in the A-MSDU but the header isn't fully there, we can end up reading data out of bounds, only to …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2023-52667

    net/mlx5e: fix a potential double-free in fs_any_create_groups

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a potential double-free in fs_any_create_groups When kcalloc() for ft->g succeeds but kvzalloc() for in fails, fs_any_create_groups() will free ft->g. However, its caller fs_an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26656

    drm/amdgpu: fix use-after-free bug

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free bug The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-26804

    net: ip_tunnel: prevent perpetual headroom growth

    In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: prevent perpetual headroom growth syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-27397

    netfilter: nf_tables: use timestamp to check for set element timeout

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use timestamp to check for set element timeout Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .in…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-35958

    net: ena: Fix incorrect descriptor free behavior

    In the Linux kernel, the following vulnerability has been resolved: net: ena: Fix incorrect descriptor free behavior ENA has two types of TX queues: - queues which only process TX packets arriving from the network stack - queues which only process TX packets …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.0
    CVE-2023-1989

    Kernel: use after free bug in btsdio_remove due to race condition

    A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2023-4155

    Sev-es / sev-snp vmgexit double fetch vulnerability

    A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker…

    Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2021-47310

    net: ti: fix UAF in tlan_remove_one

    In the Linux kernel, the following vulnerability has been resolved: net: ti: fix UAF in tlan_remove_one priv is netdev private data and it cannot be used after free_netdev() call. Using priv after free_netdev() can cause UAF bug. Fix it by moving free_netdev(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2021-47311

    net: qcom/emac: fix UAF in emac_remove

    In the Linux kernel, the following vulnerability has been resolved: net: qcom/emac: fix UAF in emac_remove adpt is netdev private data and it cannot be used after free_netdev() call. Using adpt after free_netdev() can cause UAF bug. Fix it by moving free_netd…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52639

    KVM: s390: vsie: fix race during shadow creation

    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: fix race during shadow creation Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26735

    ipv6: sr: fix possible use-after-free and null-ptr-deref

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix possible use-after-free and null-ptr-deref The pernet operations structure for the subsystem must be registered before registering the generic netlink family.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2185945
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2213802
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2265801
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2267787
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2272692
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273080
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273278
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273423
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273429
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2280434
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281350
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281821
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281920
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281925
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282471
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282472
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2283401
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4740.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-47310
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-47310
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-47310
  • article
    https://lore.kernel.org/linux-cve-announce/2024052128-CVE-2021-47310-a59d@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2021-47311
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-47311
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-47311
  • article
    https://lore.kernel.org/linux-cve-announce/2024052129-CVE-2021-47311-47f4@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2021-47548
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-47548
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-47548
  • article
    https://lore.kernel.org/linux-cve-announce/2024052441-CVE-2021-47548-e9c0@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-1989
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-1989
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-1989
  • article
    https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=f132c2d13088
  • report
    https://access.redhat.com/security/cve/CVE-2023-4155
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-4155
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-4155
  • report
    https://access.redhat.com/security/cve/CVE-2023-52530