Skip to content
OpenAdvisories
Critical RHSA-2024:6206 34 CVEs

Red Hat Security Advisory: kernel security update

Published Oct 2, 2024 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 43

ReleasePackageFixed in
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos bpftool 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos bpftool-debuginfo 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-core 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-core 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-devel 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-modules 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-aarch64 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-ppc64le 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-s390x 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-devel 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-doc 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-modules 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-modules-extra 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-tools 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-tools-libs 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-core 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-debuginfo 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-devel 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-modules 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-modules-extra 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos perf 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos perf-debuginfo 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos python3-perf 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb bpftool-debuginfo 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debug-debuginfo 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo-common-aarch64 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo-common-ppc64le 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo-common-x86_64 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-tools-debuginfo 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-tools-libs-devel 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb perf-debuginfo 0:4.18.0-477.70.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb python3-perf-debuginfo 0:4.18.0-477.70.1.el8_8

Vulnerabilities 34

  • Critical 9.8
    CVE-2023-52881

    tcp: do not accept ACK of bytes we never sent

    In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. ACK seq validation is currently following RFC 5961 5.2 g…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2024-26853

    igc: avoid returning frame twice in XDP_REDIRECT

    In the Linux kernel, the following vulnerability has been resolved: igc: avoid returning frame twice in XDP_REDIRECT When a frame can not be transmitted in XDP_REDIRECT (e.g. due to a full queue), it is necessary to free it by calling xdp_return_frame_rx_napi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2024-38570

    gfs2: Fix potential glock use-after-free on unmount

    In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix potential glock use-after-free on unmount When a DLM lockspace is released and there ares still locks in that lockspace, DLM will unlock those locks automatically. Commit fb6791d100…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2024-35845

    wifi: iwlwifi: dbg-tlv: ensure NUL termination

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2024-41090

    tap: add missing verification for short frame

    In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2024-41091

    tun: add missing verification for short frame

    In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.1
    CVE-2022-48743

    net: amd-xgbe: Fix skb data length underflow

    In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fix skb data length underflow There will be BUG_ON() triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.0
    CVE-2024-35789

    wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2021-47069

    ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry

    In the Linux kernel, the following vulnerability has been resolved: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry do_mq_timedreceive calls wq_sleep with a stack local address. The sender (do_mq_timedsend) uses this address to later …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2022-48754

    phylib: fix potential use-after-free

    In the Linux kernel, the following vulnerability has been resolved: phylib: fix potential use-after-free Commit bafbdd527d56 ("phylib: Add device reset GPIO support") added call to phy_device_reset(phydev) after the put_device() call in phy_detach(). The comm…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2023-52486

    drm: Don't unref the same fb many times by mistake due to deadlock handling

    In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26810

    vfio/pci: Lock external INTx masking ops

    In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask operations through config space changes to DisINTx may race INTx configuration changes via ioctl. Create wrappers that add locking for paths outs…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26852

    net/ipv6: avoid possible UAF in ip6_route_mpath_notify()

    In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_rout…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26974

    crypto: qat - resolve race condition during AER recovery

    In the Linux kernel, the following vulnerability has been resolved: crypto: qat - resolve race condition during AER recovery During the PCI AER system's error recovery process, the kernel driver may encounter a race condition with freeing the reset_data struc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-36883

    net: fix out-of-bounds access in ops_init

    In the Linux kernel, the following vulnerability has been resolved: net: fix out-of-bounds access in ops_init net_alloc_generic is called by net_alloc, which is called without any locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It is …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-36904

    tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().

    In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis. Since commit ec94c2696f0b ("tcp/dccp: avoid…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-36979

    net: bridge: mst: fix vlan use-after-free

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix vlan use-after-free syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-39502

    ionic: fix use after netif_napi_del()

    In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi_del() When queues are started, netif_napi_add() and napi_enable() are called. If there are 4 queues and only 3 queues are used for the current configuration, o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2023-52883

    drm/amdgpu: Fix possible null pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix possible null pointer dereference abo->tbo.resource may be NULL in amdgpu_vm_bo_update.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2024-21823

    Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generatio…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Medium 5.5
    CVE-2024-36941

    wifi: nl80211: don't free NULL coalescing rule

    In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: don't free NULL coalescing rule If the parsing fails, we can dereference a NULL pointer here.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 4.4
    CVE-2024-38540

    bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq

    In the Linux kernel, the following vulnerability has been resolved: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Undefined behavior is triggered when bnxt_qplib_alloc_init_hwq is called with hwq_attr->aux_depth != 0 and hwq_attr->aux_s…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2021-47385

    hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field

    In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field If driver read val value sufficient for (val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2022-48757

    net: fix information leakage in /proc/net/ptype

    In the Linux kernel, the following vulnerability has been resolved: net: fix information leakage in /proc/net/ptype In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new `packet_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52619

    pstore/ram: Fix crash when setting number of cpus to an odd number

    In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fix crash when setting number of cpus to an odd number When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number. The address of …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26720 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2024-26993

    fs: sysfs: Fix reference leak in sysfs_break_active_protection()

    In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_ge…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-33621

    ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound

    In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Raw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will hit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xm…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-36017

    rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation

    In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute nee…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-36489

    tls: fix missing memory barrier in tls_init

    In the Linux kernel, the following vulnerability has been resolved: tls: fix missing memory barrier in tls_init In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}. CPU0 CPU1 -…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-37356

    tcp: Fix shift-out-of-bounds in dctcp_update_alpha().

    In the Linux kernel, the following vulnerability has been resolved: tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). In dctcp_update_alpha(), we use a module parameter dctcp_shift_g as follows: alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g); ... de…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-38586

    r8169: Fix possible ring buffer corruption on fragmented Tx packets.

    In the Linux kernel, the following vulnerability has been resolved: r8169: Fix possible ring buffer corruption on fragmented Tx packets. An issue was found on the RTL8125b when transmitting small fragmented packets, whereby invalid entries were inserted into …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-38596

    af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg

    In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg A data-race condition has been identified in af_unix. In one data path, the write function unix_release_sock() atomically writ…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-41076

    NFSv4: Fix memory leak in nfs4_set_security_label

    In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix memory leak in nfs4_set_security_label We leak nfs_fattr and nfs4_label every time we set a security xattr.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2258875
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2267513
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2269070
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2270084
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273141
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273654
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2275748
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2275761
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278314
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278354
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278989
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281057
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281272
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282355
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2284271
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2284417
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2284474
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2284541
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293276
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293300
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293304
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293316
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293371
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293383
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293402
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293423
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293459
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293657
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293658
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293687
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2297474
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2299240
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2299336
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2300453
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6206.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-47069
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-47069
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-47069