Skip to content
OpenAdvisories
High RHSA-2024:5067 22 CVEs

Red Hat Security Advisory: kernel-rt security update

Published Sep 30, 2024 · Updated Sep 28, 2026

Ecosystem: Red Hat

Fixed packages 32

ReleasePackageFixed in
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-core 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-core 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-debuginfo 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-devel 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-kvm 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-modules 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-modules-core 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-modules-extra 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debuginfo 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debuginfo-common-x86_64 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-devel 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-kvm 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-modules 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-modules-core 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-modules-extra 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-core 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug-core 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug-debuginfo 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug-devel 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug-modules 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug-modules-core 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug-modules-extra 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debuginfo 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debuginfo-common-x86_64 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-devel 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-modules 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-modules-core 0:5.14.0-284.77.1.rt14.362.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-modules-extra 0:5.14.0-284.77.1.rt14.362.el9_2

Vulnerabilities 22

  • High 8.1
    CVE-2023-52885

    SUNRPC: Fix UAF in svc_tcp_listen_data_ready()

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener svc_sock is freed, and before invoking svc_tcp_accept() for the established child sock, there is a window that the newsock re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-48637

    bnxt: prevent skb UAF after handing over to PTP worker

    In the Linux kernel, the following vulnerability has been resolved: bnxt: prevent skb UAF after handing over to PTP worker When reading the timestamp is required bnxt_tx_int() hands over the ownership of the completed skb to the PTP worker. The skb should not…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26601

    ext4: regenerate buddy after block freeing failed if under fc replay

    In the Linux kernel, the following vulnerability has been resolved: ext4: regenerate buddy after block freeing failed if under fc replay This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_bu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26737

    bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel The following race is possible between bpf_timer_cancel_and_free and bpf_timer_cancel. It will lead a UAF on the timer->…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-27030

    octeontx2-af: Use separate handlers for interrupts

    In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Use separate handlers for interrupts For PF to AF interrupt vector and VF to AF vector same interrupt handler is registered which is causing race condition. When two interrupts …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-27062

    nouveau: lock the client object tree.

    In the Linux kernel, the following vulnerability has been resolved: nouveau: lock the client object tree. It appears the client object tree has no locking unless I've missed something else. Fix races around adding/removing client objects, mostly vram bar mapp…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-36020

    i40e: fix vf may be used uninitialized in this function warning

    In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-38384

    blk-cgroup: fix list corruption from reorder of WRITE ->lqueued

    In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued __blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start is being executed. If WRITE of `->lqueued` is re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-38663

    blk-cgroup: fix list corruption from resetting io stat

    In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from resetting io stat Since commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()"), each iostat instance is added to blkcg percpu list, so blkcg_res…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2024-36929

    net: core: reject skb_copy(_expand) for fraglist GSO skbs

    In the Linux kernel, the following vulnerability has been resolved: net: core: reject skb_copy(_expand) for fraglist GSO skbs SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2024-35896

    netfilter: validate user input for expected length

    In the Linux kernel, the following vulnerability has been resolved: netfilter: validate user input for expected length I got multiple syzbot reports showing old bugs exposed by BPF after commit 20f2505fb436 ("bpf: Try to avoid kzalloc in cgroup/{s,g}etsockopt…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2024-35962

    netfilter: complete validation of user input

    In the Linux kernel, the following vulnerability has been resolved: netfilter: complete validation of user input In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() ca…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2024-36960

    drm/vmwgfx: Fix invalid reads in fence signaled events

    In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix invalid reads in fence signaled events Correctly set the length of the drm_event to the size of the structure that's actually used. The length of the drm_event was set to the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.0
    CVE-2024-26930

    scsi: qla2xxx: Fix double free of the ha->vp_map pointer

    In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the ha->vp_map pointer Coverity scan reported potential risk of double free of the pointer ha->vp_map. ha->vp_map was freed in qla2x00_mem_alloc(), and again…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.3
    CVE-2024-35823

    vt: fix unicode buffer corruption when deleting characters

    In the Linux kernel, the following vulnerability has been resolved: vt: fix unicode buffer corruption when deleting characters This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting char…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52458

    block: add check that partition length needs to be aligned with block size

    In the Linux kernel, the following vulnerability has been resolved: block: add check that partition length needs to be aligned with block size Before calling add partition or resize partition, there is no check on whether the length is aligned with the logica…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52635

    PM / devfreq: Synchronize devfreq_monitor_[start/stop]

    In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfreq_monitor_[start/stop] There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52809

    scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()

    In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() fc_lport_ptp_setup() did not check the return value of fc_rport_create() which can return NULL and would cause a NU…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26947

    ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses

    In the Linux kernel, the following vulnerability has been resolved: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memory map alignment") changes the sem…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-33621

    ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound

    In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Raw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will hit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xm…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-35885

    mlxbf_gige: stop interface during shutdown

    In the Linux kernel, the following vulnerability has been resolved: mlxbf_gige: stop interface during shutdown The mlxbf_gige driver intermittantly encounters a NULL pointer exception while the system is shutting down via "reboot" command. The mlxbf_driver wi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-36017

    rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation

    In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute nee…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2265794
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2265836
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2272808
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273274
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2277831
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278167
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278248
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278387
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278473
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281190
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281675
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281700
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281916
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282669
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2284400
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2284417
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2284496
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2290408
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293657
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2294220
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2294225
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2297730
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5067.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-48637
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-48637
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-48637
  • article
    https://lore.kernel.org/linux-cve-announce/2024042855-CVE-2022-48637-d149@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-52458
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-52458
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-52458
  • article
    https://lore.kernel.org/linux-cve-announce/2024022332-CVE-2023-52458-d1cd@gregkh/T/#u
  • report
    https://access.redhat.com/security/cve/CVE-2023-52635
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-52635
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-52635
  • article
    https://lore.kernel.org/linux-cve-announce/2024040219-CVE-2023-52635-8b18@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-52809
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-52809
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-52809