Skip to content
OpenAdvisories
Critical 1 exploited CVE RHSA-2024:5365 23 CVEs

Red Hat Security Advisory: kernel-rt security update

Published Oct 1, 2024 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 32

ReleasePackageFixed in
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-core 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-core 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-debuginfo 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-devel 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-kvm 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-modules 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-modules-core 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debug-modules-extra 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debuginfo 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-debuginfo-common-x86_64 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-devel 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-kvm 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-modules 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-modules-core 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::nfv kernel-rt-modules-extra 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-core 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug-core 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug-debuginfo 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug-devel 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug-modules 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug-modules-core 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debug-modules-extra 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debuginfo 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-debuginfo-common-x86_64 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-devel 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-modules 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-modules-core 0:5.14.0-284.79.1.rt14.364.el9_2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::realtime kernel-rt-modules-extra 0:5.14.0-284.79.1.rt14.364.el9_2

Vulnerabilities 23

  • High 7.8
    CVE-2024-36971 Exploited Public exploit

    net: fix __dst_negative_advice() race

    In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV Aug 7, 2024
  • Critical 9.1
    CVE-2024-35845

    wifi: iwlwifi: dbg-tlv: ensure NUL termination

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2024-36922

    wifi: iwlwifi: read txq->read_ptr under lock

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq->read_ptr under lock If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2024-35937

    wifi: cfg80211: check A-MSDU format more carefully

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check A-MSDU format more carefully If it looks like there's another subframe in the A-MSDU but the header isn't fully there, we can end up reading data out of bounds, only to …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.0
    CVE-2024-35789

    wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2021-47383

    tty: Fix out-of-bound vmalloc access in imageblit

    In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-27052

    wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work

    In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work The workqueue might still be running, when the driver is stopped. To avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop().

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-38556

    net/mlx5: Add a timeout to acquire the command queue semaphore

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Add a timeout to acquire the command queue semaphore Prevent forced completion handling on an entry that has not yet been assigned an index, causing an out of bounds access on idx =…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2024-21823

    Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generatio…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • High 7.3
    CVE-2024-38538

    net: bridge: xmit: make sure we have at least eth header len bytes

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: xmit: make sure we have at least eth header len bytes syzbot triggered an uninit value[1] error in bridge device's xmit path by sending a short (less than ETH_HLEN bytes) skb. To…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2023-52864

    platform/x86: wmi: Fix opening of char device

    In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.0
    CVE-2024-38555

    net/mlx5: Discard command completions in internal error

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Discard command completions in internal error Fix use after free when FW completion arrives while device is in internal error state. Avoid calling completion handler in this case, s…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2024-36941

    wifi: nl80211: don't free NULL coalescing rule

    In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: don't free NULL coalescing rule If the parsing fails, we can dereference a NULL pointer here.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 4.4
    CVE-2023-52771

    cxl/port: Fix delete_endpoint() vs parent unregistration race

    In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix delete_endpoint() vs parent unregistration race The CXL subsystem, at cxl_mem ->probe() time, establishes a lineage of ports (struct cxl_port objects) between an endpoint and th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52448

    gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump

    In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52651 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2024-26855

    net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()

    In the Linux kernel, the following vulnerability has been resolved: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() The function ice_bridge_setlink() may encounter a NULL pointer dereference if nlmsg_find_attr() returns NULL and br_sp…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26897

    wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete The ath9k_wmi_event_tasklet() used in ath9k_htc assumes that all the data structures have been fully initialised by …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-27046

    nfp: flower: handle acti_netdevs allocation failure

    In the Linux kernel, the following vulnerability has been resolved: nfp: flower: handle acti_netdevs allocation failure The kmalloc_array() in nfp_fl_lag_do_work() will return null, if the physical memory has run out. As a result, if we dereference the acti_n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-35852

    mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work

    In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as suppose…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-35907

    mlxbf_gige: call request_irq() after NAPI initialized

    In the Linux kernel, the following vulnerability has been resolved: mlxbf_gige: call request_irq() after NAPI initialized The mlxbf_gige driver encounters a NULL pointer exception in mlxbf_gige_open() when kdump is enabled. The sequence to reproduce the excep…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-38586

    r8169: Fix possible ring buffer corruption on fragmented Tx packets.

    In the Linux kernel, the following vulnerability has been resolved: r8169: Fix possible ring buffer corruption on fragmented Tx packets. An issue was found on the RTL8125b when transmitting small fragmented packets, whereby invalid entries were inserted into …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-38627

    stm class: Fix a double free in stm_register_device()

    In the Linux kernel, the following vulnerability has been resolved: stm class: Fix a double free in stm_register_device() The put_device(&stm->dev) call will trigger stm_device_release() which frees "stm" so the vfree(stm) on the next line is a double free.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2265653
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2275655
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2275742
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278417
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278435
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278519
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278989
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281057
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281257
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281272
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281647
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281821
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282357
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282719
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282720
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2284474
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2284511
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2292331
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293402
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293443
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293444
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293461
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293700
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5365.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-47383
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-47383
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-47383
  • article
    https://lore.kernel.org/linux-cve-announce/2024052144-CVE-2021-47383-a8f4@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-52448
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-52448
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-52448
  • article
    https://lore.kernel.org/linux-cve-announce/2024022255-CVE-2023-52448-7bf2@gregkh/T/#u
  • report
    https://access.redhat.com/security/cve/CVE-2023-52651
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-52651
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-52651
  • article
    https://lore.kernel.org/linux-cve-announce/2024050110-CVE-2023-52651-5907@gregkh/T
  • report
    https://access.redhat.com/security/cve/CVE-2023-52771
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-52771