Red Hat Security Advisory: kernel security update

Fixed packages 81

Vulnerabilities 12

• High 8.0
  CVE-2024-35789

  wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• High 7.8
  CVE-2023-52486

  drm: Don't unref the same fb many times by mistake due to deadlock handling

  In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 29, 2024
• High 7.8
  CVE-2024-26640

  tcp: add sanity checks to rx zerocopy

  In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to can_map_frag() these additional …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 18, 2024
• High 7.8
  CVE-2024-26810

  vfio/pci: Lock external INTx masking ops

  In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask operations through config space changes to DisINTx may race INTx configuration changes via ioctl. Create wrappers that add locking for paths outs…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 5, 2024
• High 7.8
  CVE-2024-26870

  NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102

  In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 A call to listxattr() with a buffer size = 0 returns the actual size of the buffer needed for a subsequent call. When size > 0, nfs…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• High 7.5
  CVE-2024-26826

  mptcp: fix data re-injection from stale subflow

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• High 7.0
  CVE-2024-26961

  mac802154: fix llsec key resources release in mac802154_llsec_key_del

  In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• High 7.0
  CVE-2024-38555

  net/mlx5: Discard command completions in internal error

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Discard command completions in internal error Fix use after free when FW completion arrives while device is in internal error state. Avoid calling completion handler in this case, s…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• Unscored —
  CVE-2021-47393

  hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs Fan speed minimum can be enforced from sysfs. For example, setting current fan speed to 20 is used to e…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Unscored —
  CVE-2024-33621

  ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound

  In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Raw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will hit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xm…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 21, 2024
• Unscored —
  CVE-2024-36000

  mm/hugetlb: fix missing hugetlb_lock for resv uncharge

  In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/ 350: lockdep_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 20, 2024
• Unscored —
  CVE-2024-36489

  tls: fix missing memory barrier in tls_init

  In the Linux kernel, the following vulnerability has been resolved: tls: fix missing memory barrier in tls_init In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}. CPU0 CPU1 -…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 21, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2269070
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270100
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273654
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275604
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275711
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278176
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281057
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281968
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282345
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293444
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293657
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293687
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5065.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47393
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47393
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47393
• article
  https://lore.kernel.org/linux-cve-announce/2024052147-CVE-2021-47393-ea1c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52486
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52486
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52486
• article
  https://lore.kernel.org/linux-cve-announce/20240229155245.1571576-27-lee@kernel.org/T/#u
• report
  https://access.redhat.com/security/cve/CVE-2024-26640
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26640
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26640
• article
  https://lore.kernel.org/linux-cve-announce/20240318102117.2839904-11-lee@kernel.org/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26810
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26810
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26810
• article
  https://lore.kernel.org/linux-cve-announce/2024040548-CVE-2024-26810-4371@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26826
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26826
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26826
• article
  https://lore.kernel.org/linux-cve-announce/2024041703-CVE-2024-26826-b984@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26870
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26870
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26870
• article
  https://lore.kernel.org/linux-cve-announce/2024041738-CVE-2024-26870-7aea@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26961