Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 42

• Critical 9.8
  CVE-2024-38544

  RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt In rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the resp_pkts queue and then a decision is made whether to run the complet…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• Critical 9.8
  CVE-2024-40983

  tipc: force a dst refcount before doing decryption

  In the Linux kernel, the following vulnerability has been resolved: tipc: force a dst refcount before doing decryption As it says in commit 3bc07321ccc2 ("xfrm: Force a dst refcount before entering the xfrm type handlers"): "Crypto requests might return async…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• High 8.8
  CVE-2024-27415

  netfilter: bridge: confirm multicast packets before passing them up the stack

  In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: confirm multicast packets before passing them up the stack conntrack nf_confirm logic cannot handle cloned skbs referencing the same nf_conn entry, which will happen for mu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• High 8.8
  CVE-2024-40911

  wifi: cfg80211: Lock wiphy in cfg80211_get_station

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Lock wiphy in cfg80211_get_station Wiphy should be locked before calling rdev_get_station() (see lockdep assert in ieee80211_get_station()). This fixes the following kernel NU…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• High 8.8
  CVE-2024-41090

  tap: add missing verification for short frame

  In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• High 8.8
  CVE-2024-41091

  tun: add missing verification for short frame

  In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• High 8.1
  CVE-2024-40941

  wifi: iwlwifi: mvm: don't read past the mfuart notifcation

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't read past the mfuart notifcation In case the firmware sends a notification that claims it has more data than it has, we will read past that was allocated for the not…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• High 7.8
  CVE-2023-52880

  tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc

  In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc Any unprivileged user can attach N_GSM0710 ldisc, but it requires CAP_NET_ADMIN to create a GSM network anyway. Require initial nam…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 24, 2024
• High 7.8
  CVE-2024-26581 Public exploit

  netfilter: nft_set_rbtree: skip end interval element from gc

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: skip end interval element from gc rbtree lazy gc on insert might collect an end interval element that has been just added in this transactions, skip end interval el…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 20, 2024
• High 7.8
  CVE-2024-26810

  vfio/pci: Lock external INTx masking ops

  In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask operations through config space changes to DisINTx may race INTx configuration changes via ioctl. Create wrappers that add locking for paths outs…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 5, 2024
• High 7.8
  CVE-2024-26925

  netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), o…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 24, 2024
• High 7.8
  CVE-2024-27019

  netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() nft_unregister_obj() can concurrent with __nft_obj_type_get(), and there is not any protection when iterate over nf_table…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• High 7.8
  CVE-2024-27020

  netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_ta…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• High 7.8
  CVE-2024-35839

  netfilter: bridge: replace physindev with physinif in nf_bridge_info

  In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: replace physindev with physinif in nf_bridge_info An skb can be added to a neigh->arp_queue while waiting for an arp reply. Where original skb's skb->dev can be different t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 17, 2024
• High 7.8
  CVE-2024-35897

  netfilter: nf_tables: discard table flag update with pending basechain deletion

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: discard table flag update with pending basechain deletion Hook unregistration is deferred to the commit phase, same occurs with hook updates triggered by the table dorma…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 19, 2024
• High 7.8
  CVE-2024-41041

  udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().

  In the Linux kernel, the following vulnerability has been resolved: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). syzkaller triggered the warning [0] in udp_v4_early_demux(). In udp_v[46]_early_demux() and sk_lookup(), we do not touch the refcount of …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• High 7.5
  CVE-2024-40957

  seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors

  In the Linux kernel, the following vulnerability has been resolved: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors input_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for PREROUTING hook, in PREROUTING h…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• High 7.5
  CVE-2024-42110

  net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()

  In the Linux kernel, the following vulnerability has been resolved: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() The following is emitted when using idxd (DSA) dmanegine as the data mover for ntb_transport that ntb_netdev…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 30, 2024
• High 7.5
  CVE-2024-42152

  nvmet: fix a possible leak when destroy a ctrl during qp establishment

  In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a possible leak when destroy a ctrl during qp establishment In nvmet_sq_destroy we capture sq->ctrl early and if it is non-NULL we know that a ctrl was allocated (in the admin conn…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 30, 2024
• High 7.3
  CVE-2024-38538

  net: bridge: xmit: make sure we have at least eth header len bytes

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: xmit: make sure we have at least eth header len bytes syzbot triggered an uninit value[1] error in bridge device's xmit path by sending a short (less than ETH_HLEN bytes) skb. To…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 19, 2024
• High 7.1
  CVE-2024-27016

  netfilter: flowtable: validate pppoe header

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate pppoe header Ensure there is sufficient room to access the protocol field of the PPPoe header. Validate it once before the flowtable lookup, then use a helper f…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• High 7.1
  CVE-2024-35896

  netfilter: validate user input for expected length

  In the Linux kernel, the following vulnerability has been resolved: netfilter: validate user input for expected length I got multiple syzbot reports showing old bugs exposed by BPF after commit 20f2505fb436 ("bpf: Try to avoid kzalloc in cgroup/{s,g}etsockopt…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 19, 2024
• High 7.1
  CVE-2024-35962

  netfilter: complete validation of user input

  In the Linux kernel, the following vulnerability has been resolved: netfilter: complete validation of user input In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() ca…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 20, 2024
• High 7.1
  CVE-2024-40929

  wifi: iwlwifi: mvm: check n_ssids before accessing the ssids

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids In some versions of cfg80211, the ssids poinet might be a valid one even though n_ssids is 0. Accessing the pointer in this case w…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• High 7.0
  CVE-2024-35898

  netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() nft_unregister_flowtable_type() within nf_flow_inet_module_exit() can concurrent with __nft_flowtable_type_get() wi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 19, 2024
• Medium 4.4
  CVE-2023-52771

  cxl/port: Fix delete_endpoint() vs parent unregistration race

  In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix delete_endpoint() vs parent unregistration race The CXL subsystem, at cxl_mem ->probe() time, establishes a lineage of ports (struct cxl_port objects) between an endpoint and th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Medium 4.4
  CVE-2024-38540

  bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq

  In the Linux kernel, the following vulnerability has been resolved: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Undefined behavior is triggered when bnxt_qplib_alloc_init_hwq is called with hwq_attr->aux_depth != 0 and hwq_attr->aux_s…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 19, 2024
• Unscored —
  CVE-2022-50495 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Oct 4, 2025
• Unscored —
  CVE-2024-26668

  netfilter: nft_limit: reject configurations that cause integer overflow

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_limit: reject configurations that cause integer overflow Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 2, 2024
• Unscored —
  CVE-2024-26855

  net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()

  In the Linux kernel, the following vulnerability has been resolved: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() The function ice_bridge_setlink() may encounter a NULL pointer dereference if nlmsg_find_attr() returns NULL and br_sp…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• Unscored —
  CVE-2024-26908 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Apr 17, 2024
• Unscored —
  CVE-2024-36003

  ice: fix LAG and VF lock dependency in ice_reset_vf()

  In the Linux kernel, the following vulnerability has been resolved: ice: fix LAG and VF lock dependency in ice_reset_vf() 9f74a3dfcf83 ("ice: Fix VF Reset paths when interface in a failed over aggregate"), the ice driver has acquired the LAG mutex in ice_rese…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 20, 2024
• Unscored —
  CVE-2024-36025

  scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() The app_reply->elem[] array is allocated earlier in this function and it has app_req.num_ports elements. Thus this > comparison needs …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• Unscored —
  CVE-2024-38579

  crypto: bcm - Fix pointer arithmetic

  In the Linux kernel, the following vulnerability has been resolved: crypto: bcm - Fix pointer arithmetic In spu2_dump_omd() value of ptr is increased by ciph_key_len instead of hash_iv_len which could lead to going beyond the buffer boundaries. Fix this bug b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• Unscored —
  CVE-2024-38608

  net/mlx5e: Fix netif state handling

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix netif state handling mlx5e_suspend cleans resources only if netif_device_present() returns true. However, mlx5e_resume changes the state of netif, via mlx5e_nic_enable, only if…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 19, 2024
• Unscored —
  CVE-2024-39476

  md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING

  In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING Xiao reported that lvm2 test lvconvert-raid-takeover.sh can hang with small possibility, the root cause is e…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 5, 2024
• Unscored —
  CVE-2024-40905

  ipv6: fix possible race in __fib6_drop_pcpu_from()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible race in __fib6_drop_pcpu_from() syzbot found a race in __fib6_drop_pcpu_from() [1] If compiler reads more than once (*ppcpu_rt), second read could read NULL, if another cpu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40912

  wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() The ieee80211_sta_ps_deliver_wakeup() function takes sta->ps_lock to synchronizes with ieee80211_tx_h_unicast_ps_buf() which …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40914

  mm/huge_memory: don't unpoison huge_zero_folio

  In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: don't unpoison huge_zero_folio When I did memory failure tests recently, below panic occurs: kernel BUG at include/linux/mm.h:1135! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40939

  net: wwan: iosm: Fix tainted pointer delete is case of region creation fail

  In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail In case of region creation fail in ipc_devlink_create_region(), previously created regions delete process starts fr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40978

  scsi: qedi: Fix crash while reading debugfs attribute

  In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix crash while reading debugfs attribute The qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly on a __user pointer, which results into the crash. To fix this…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-41076

  NFSv4: Fix memory leak in nfs4_set_security_label

  In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix memory leak in nfs4_set_security_label We leak nfs_fattr and nfs4_label every time we set a security xattr.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265185
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2272797
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273654
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275742
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275744
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2277166
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278256
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278258
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278264
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281101
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281284
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281669
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281672
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281675
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281916
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281958
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282720
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2283468
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284421
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293356
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293414
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293455
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293459
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293461
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295914
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297489
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297495
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297496
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297498
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297513
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297523
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297525
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297541
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297562
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297567
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2299240
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2299336
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300410