Skip to content
OpenAdvisories
Critical 1 exploited CVE RHSA-2024:5255 22 CVEs

Red Hat Security Advisory: kernel security update

Published Oct 1, 2024 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 43

ReleasePackageFixed in
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos bpftool 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos bpftool-debuginfo 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-core 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-core 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-devel 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-modules 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-aarch64 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-ppc64le 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-s390x 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-devel 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-doc 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-modules 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-modules-extra 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-tools 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-tools-libs 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-core 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-debuginfo 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-devel 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-modules 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-modules-extra 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos perf 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos perf-debuginfo 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos python3-perf 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb bpftool-debuginfo 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debug-debuginfo 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo-common-aarch64 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo-common-ppc64le 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo-common-x86_64 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-tools-debuginfo 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-tools-libs-devel 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb perf-debuginfo 0:4.18.0-477.67.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb python3-perf-debuginfo 0:4.18.0-477.67.1.el8_8

Vulnerabilities 22

  • High 7.8
    CVE-2024-36971 Exploited Public exploit

    net: fix __dst_negative_advice() race

    In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV Aug 7, 2024
  • Critical 9.8
    CVE-2024-26583

    tls: fix race between async notify and socket close

    In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past tha…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2024-26584

    net: tls: handle backlogging of crypto requests

    In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY inst…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2024-26585

    tls: fix race between tx work scheduling and socket close

    In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2024-36886 Public exploit

    tipc: fix UAF in error path

    In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported a UAF in the tipc_buf_append() error path: BUG: KASAN: slab-use-after-free in kfree_skb_list…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26640

    tcp: add sanity checks to rx zerocopy

    In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to can_map_frag() these additional …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26704

    ext4: fix double-free of blocks due to wrong extents moved_len

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents moved_len In ext4_move_extents(), moved_len is only updated when all moves are successfully executed, and only discards orig_inode and don…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26773

    ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()

    In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid alloc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26870

    NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102

    In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 A call to listxattr() with a buffer size = 0 returns the actual size of the buffer needed for a subsequent call. When size > 0, nfs…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-35910

    tcp: properly terminate timers for kernel sockets

    In the Linux kernel, the following vulnerability has been resolved: tcp: properly terminate timers for kernel sockets We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled. Fortunately Josef Bacik could trigge…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-36020

    i40e: fix vf may be used uninitialized in this function warning

    In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2023-52610

    net/sched: act_ct: fix skb leak and crash on ooo frags

    In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix skb leak and crash on ooo frags act_ct adds skb->users before defragmentation. If frags arrive in order, the last frag's reference is reset in: inet_frag_reasm_prepare …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.3
    CVE-2024-38538

    net: bridge: xmit: make sure we have at least eth header len bytes

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: xmit: make sure we have at least eth header len bytes syzbot triggered an uninit value[1] error in bridge device's xmit path by sending a short (less than ETH_HLEN bytes) skb. To…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2024-38555

    net/mlx5: Discard command completions in internal error

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Discard command completions in internal error Fix use after free when FW completion arrives while device is in internal error state. Avoid calling completion handler in this case, s…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2022-48627

    vt: fix memory overlapping when deleting chars in the buffer

    In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars in the buffer A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpy…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-20569

    A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. …

    AMD 3rd Gen AMD EPYC™ Processors 2nd Gen AMD EPYC™ Processors 4th Gen AMD EPYC™ Processors Debian Ubuntu Alpine
  • Unscored —
    CVE-2023-52448

    gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump

    In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26686

    fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats

    In the Linux kernel, the following vulnerability has been resolved: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats lock_task_sighand() can trigger a hard lockup. If NR_CPUS threads call do_task_stat() at the same time and the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-26733

    arp: Prevent overflow in arp_req_get().

    In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_req_get(). syzkaller reported an overflown write in arp_req_get(). [0] When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour entry and copies neigh-…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26982

    Squashfs: check the inode number is not the invalid value of zero

    In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero Syskiller has produced an out of bounds access in fill_meta_index(). That out of bounds access is ultimately caused because t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-35852

    mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work

    In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as suppose…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-36000

    mm/hugetlb: fix missing hugetlb_lock for resv uncharge

    In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix missing hugetlb_lock for resv uncharge There is a recent report on UFFDIO_COPY over hugetlb: https://lore.kernel.org/all/000000000000ee06de0616177560@google.com/ 350: lockdep_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2207625
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2265517
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2265519
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2265520
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2265653
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2267509
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2270080
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2270100
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273109
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273174
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273236
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273247
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2275711
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2277238
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278337
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281257
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281641
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281968
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2284400
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2292331
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293444
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293461
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5255.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-48627
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-48627
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-48627
  • article
    https://lore.kernel.org/linux-cve-announce/2024030252-CVE-2022-48627-c7bf@gregkh/T/#u
  • report
    https://access.redhat.com/security/cve/CVE-2023-20569
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-20569
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-20569
  • article
    https://access.redhat.com/solutions/7049120
  • article
    https://www.amd.com/content/dam/amd/en/documents/corporate/cr/speculative-return-stack-overflow-whitepaper.pdf
  • article
    https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7005.html
  • report
    https://access.redhat.com/security/cve/CVE-2023-52448
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-52448
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-52448
  • article
    https://lore.kernel.org/linux-cve-announce/2024022255-CVE-2023-52448-7bf2@gregkh/T/#u
  • report
    https://access.redhat.com/security/cve/CVE-2023-52610