Skip to content
OpenAdvisories
Critical RHSA-2024:6993 38 CVEs

Red Hat Security Advisory: kernel security update

Published Oct 2, 2024 · Updated Nov 13, 2026

Fixed packages 43

ReleasePackageFixed in
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos bpftool 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos bpftool-debuginfo 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-abi-stablelists 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-core 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-core 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-debuginfo 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-devel 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-modules 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debug-modules-extra 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-aarch64 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-ppc64le 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-s390x 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-debuginfo-common-x86_64 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-devel 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-doc 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-modules 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-modules-extra 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-tools 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-tools-debuginfo 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-tools-libs 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-core 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-debuginfo 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-devel 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-modules 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos kernel-zfcpdump-modules-extra 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos perf 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos perf-debuginfo 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos python3-perf 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::baseos python3-perf-debuginfo 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb bpftool-debuginfo 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debug-debuginfo 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo-common-aarch64 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo-common-ppc64le 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-debuginfo-common-x86_64 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-tools-debuginfo 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb kernel-tools-libs-devel 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb perf-debuginfo 0:4.18.0-477.74.1.el8_8
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::crb python3-perf-debuginfo 0:4.18.0-477.74.1.el8_8

Vulnerabilities 38

  • Critical 9.1

    tunnels: fix out of bounds access when building IPv6 PMTU error

    In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in do_csum+0x220/…

  • High 8.8

    net: fix possible store tearing in neigh_periodic_work()

    In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an …

  • High 8.8

    ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

    In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item…

  • High 8.4

    virtio-net: Add validation for used length

    In the Linux kernel, the following vulnerability has been resolved: virtio-net: Add validation for used length This adds validation for used length (might come from an untrusted device) to avoid data corruption or loss.

  • High 8.1

    smb: client: fix potential OOBs in smb2_parse_contexts()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing i…

  • High 7.8

    uio: Fix use-after-free in uio_open

    In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_de…

  • High 7.8

    ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()

    In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avo…

  • High 7.8

    af_unix: Fix garbage collector racing against connect()

    In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a pe…

  • High 7.8

    netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() nft_unregister_obj() can concurrent with __nft_obj_type_get(), and there is not any protection when iterate over nf_table…

  • High 7.8

    netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_ta…

  • High 7.8

    tty: n_gsm: fix possible out-of-bounds in gsm0_receive()

    In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with…

  • High 7.8

    net: sched: sch_multiq: fix possible OOB write in multiq_tune()

    In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used…

  • High 7.8

    udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().

    In the Linux kernel, the following vulnerability has been resolved: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). syzkaller triggered the warning [0] in udp_v4_early_demux(). In udp_v[46]_early_demux() and sk_lookup(), we do not touch the refcount of …

  • High 7.7

    mISDN: fix possible use-after-free in HFC_cleanup()

    In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible use-after-free in HFC_cleanup() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the tim…

  • High 7.5

    mptcp: fix data re-injection from stale subflow

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring…

  • High 7.5

    netfilter: nf_conntrack_h323: Add protection for bmp length out of range

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vml…

  • High 7.5

    net: core: reject skb_copy(_expand) for fraglist GSO skbs

    In the Linux kernel, the following vulnerability has been resolved: net: core: reject skb_copy(_expand) for fraglist GSO skbs SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_…

  • High 7.5

    cppc_cpufreq: Fix possible null pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: cppc_cpufreq: Fix possible null pointer dereference cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() can be called from different places with various parameters. So cpufreq_cpu_get() …

  • High 7.0

    platform/x86: wmi: Fix opening of char device

    In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp…

  • High 7.0

    netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() nft_unregister_flowtable_type() within nf_flow_inet_module_exit() can concurrent with __nft_flowtable_type_get() wi…

  • Medium 5.5

    scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool

    In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool In practice the driver should never send more commands than are allocated to a queue's event pool. In the unlikely event that th…

  • Medium 5.3

    hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field

    In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field If driver read tmp value sufficient for (tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0…

  • Medium 5.3

    cgroup: cgroup_get_from_id() must check the looked-up kn is a directory

    In the Linux kernel, the following vulnerability has been resolved: cgroup: cgroup_get_from_id() must check the looked-up kn is a directory cgroup has to be one kernfs dir, otherwise kernel panic is caused, especially cgroup id is provide from userspace.

  • Unscored —

    isdn: mISDN: Fix sleeping function called from invalid context

    In the Linux kernel, the following vulnerability has been resolved: isdn: mISDN: Fix sleeping function called from invalid context The driver can call card->isac.release() function from an atomic context. Fix this by calling this function after releasing the …

  • Unscored —

    proc/vmcore: fix clearing user buffer by properly using clear_user()

    In the Linux kernel, the following vulnerability has been resolved: proc/vmcore: fix clearing user buffer by properly using clear_user() To clear a user buffer we cannot simply use memset, we have to use clear_user(). With a virtio-mem device that registers a…

  • Unscored —

    bonding: stop the device in bond_setup_by_slave()

    In the Linux kernel, the following vulnerability has been resolved: bonding: stop the device in bond_setup_by_slave() Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today. In the fo…

  • Unscored —

    hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove

    In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove In commit ac5047671758 ("hv_netvsc: Disable NAPI before closing the VMBus channel"), napi_disable was getting called for a…

  • Unscored —
    CVE-2024-26908 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the…

  • Unscored —

    netfilter: nf_tables: honor table dormant flag from netdev release event path

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor table dormant flag from netdev release event path Check for table dormant flag otherwise netdev release event path tries to unregister an already unregistered hook…

  • Unscored —

    netfilter: tproxy: bail out if IP has been disabled on the device

    In the Linux kernel, the following vulnerability has been resolved: netfilter: tproxy: bail out if IP has been disabled on the device syzbot reports: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN …

  • Unscored —

    md: fix resync softlockup when bitmap size is less than array size

    In the Linux kernel, the following vulnerability has been resolved: md: fix resync softlockup when bitmap size is less than array size Is is reported that for dm-raid10, lvextend + lvchange --syncaction will trigger following softlockup: kernel:watchdog: BUG:…

  • Unscored —

    cpufreq: exit() callback is optional

    In the Linux kernel, the following vulnerability has been resolved: cpufreq: exit() callback is optional The exit() callback is optional and shouldn't be called without checking a valid pointer first. Also, we must clear freq_table pointer even if the exit() …

  • Unscored —

    net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

    In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() syzbot found hanging tasks waiting on rtnl_lock [1] A reproducer is available in the syzbot bug. When a request to add …

  • Unscored —

    ppp: reject claimed-as-LCP but actually malformed packets

    In the Linux kernel, the following vulnerability has been resolved: ppp: reject claimed-as-LCP but actually malformed packets Since 'ppp_async_encode()' assumes valid LCP packets (with code from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that LCP p…

  • Unscored —
    CVE-2024-41071 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    drm/amdgpu: avoid using null object of framebuffer

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid using null object of framebuffer Instead of using state->fb->obj[0] directly, get object from framebuffer by calling drm_gem_fb_get_obj() and return error code when object i…

  • Unscored —

    tcp_metrics: validate source addr length

    In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at al…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2265271
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2265285
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2267795
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2272793
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273117
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2273242
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2275604
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2275744
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2275750
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2277171
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2277829
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278256
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278258
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2280462
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281669
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281900
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2281949
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282356
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282394
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282401
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282719
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282743
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282772
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2282887
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2283463
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2283894
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2284496
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293078
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293348
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293367
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293420
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2293653
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2297579
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2300410
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2300414
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2300448
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2300488
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2301522