Red Hat Security Advisory: kernel security update

Fixed packages 78

Vulnerabilities 12

• Critical 9.8
  CVE-2021-47378

  nvme-rdma: destroy cm id before destroy qp to avoid use after free

  In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: destroy cm id before destroy qp to avoid use after free We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use aft…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• High 7.8
  CVE-2021-47461

  userfaultfd: fix a race between writeprotect and exit_mmap()

  In the Linux kernel, the following vulnerability has been resolved: userfaultfd: fix a race between writeprotect and exit_mmap() A race is possible when a process exits, its VMAs are removed by exit_mmap() and at the same time userfaultfd_writeprotect() is ca…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 22, 2024
• High 7.8
  CVE-2022-48796

  iommu: Fix potential use-after-free during probe

  In the Linux kernel, the following vulnerability has been resolved: iommu: Fix potential use-after-free during probe Kasan has reported the following use after free on dev->iommu. when a device probe fails and it is in process of freeing dev->iommu in dev_iom…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 16, 2024
• High 7.8
  CVE-2024-38564

  bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE

  In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE bpf_prog_attach uses attach_type_to_prog_type to enforce proper attach type for BPF_PROG_TYPE_CGROUP_SKB. link_cre…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 19, 2024
• High 7.1
  CVE-2024-41014

  xfs: add bounds checking to xlog_recover_process_data

  In the Linux kernel, the following vulnerability has been resolved: xfs: add bounds checking to xlog_recover_process_data There is a lack of verification of the space occupied by fixed members of xlog_op_header in the xlog_recover_process_data. We can create …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• Medium 5.3
  CVE-2024-35823

  vt: fix unicode buffer corruption when deleting characters

  In the Linux kernel, the following vulnerability has been resolved: vt: fix unicode buffer corruption when deleting characters This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting char…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• Medium 4.4
  CVE-2024-38540

  bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq

  In the Linux kernel, the following vulnerability has been resolved: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq Undefined behavior is triggered when bnxt_qplib_alloc_init_hwq is called with hwq_attr->aux_depth != 0 and hwq_attr->aux_s…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 19, 2024
• Unscored —
  CVE-2021-47138

  cxgb4: avoid accessing registers when clearing filters

  In the Linux kernel, the following vulnerability has been resolved: cxgb4: avoid accessing registers when clearing filters Hardware register having the server TID base can contain invalid values when adapter is in bad state (for example, due to AER fatal erro…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 25, 2024
• Unscored —
  CVE-2022-48659

  mm/slub: fix to return errno if kmalloc() fails

  In the Linux kernel, the following vulnerability has been resolved: mm/slub: fix to return errno if kmalloc() fails In create_unique_id(), kmalloc(, GFP_KERNEL) can fail due to out-of-memory, if it fails, return errno correctly rather than triggering panic vi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 28, 2024
• Unscored —
  CVE-2024-26698

  hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove

  In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove In commit ac5047671758 ("hv_netvsc: Disable NAPI before closing the VMBus channel"), napi_disable was getting called for a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2024
• Unscored —
  CVE-2024-26982

  Squashfs: check the inode number is not the invalid value of zero

  In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero Syskiller has produced an out of bounds access in fill_meta_index(). That out of bounds access is ultimately caused because t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• Unscored —
  CVE-2024-38586

  r8169: Fix possible ring buffer corruption on fragmented Tx packets.

  In the Linux kernel, the following vulnerability has been resolved: r8169: Fix possible ring buffer corruption on fragmented Tx packets. An issue was found on the RTL8125b when transmitting small fragmented packets, whereby invalid entries were inserted into …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2271484
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273117
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2277801
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278337
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281190
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282362
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282896
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293402
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293429
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293459
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2298132
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300297
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6297.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47138
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47138
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47138
• article
  https://lore.kernel.org/linux-cve-announce/2024032557-CVE-2021-47138-9241@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2021-47378
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47378
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47378
• article
  https://lore.kernel.org/linux-cve-announce/2024052142-CVE-2021-47378-8e72@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2021-47461
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47461
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47461
• article
  https://lore.kernel.org/linux-cve-announce/2024052225-CVE-2021-47461-a472@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-48659
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48659
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48659
• article
  https://lore.kernel.org/linux-cve-announce/2024042800-CVE-2022-48659-8ccb@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-48796
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48796
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48796
• article
  https://lore.kernel.org/linux-cve-announce/2024071642-CVE-2022-48796-8474@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26698
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26698
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26698
• article
  https://lore.kernel.org/linux-cve-announce/2024040338-CVE-2024-26698-36ac@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26982