Red Hat Security Advisory: kernel security update

Fixed packages 81

Vulnerabilities 6

• Critical 9.8
  CVE-2022-48686

  nvme-tcp: fix UAF when detecting digest errors

  In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix UAF when detecting digest errors We should also bail from the io_work loop when we set rd_enabled to true, so we don't attempt to read data from the socket when the TCP stream i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 3, 2024
• High 8.8
  CVE-2023-52522

  net: fix possible store tearing in neigh_periodic_work()

  In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• Medium 5.3
  CVE-2022-48638

  cgroup: cgroup_get_from_id() must check the looked-up kn is a directory

  In the Linux kernel, the following vulnerability has been resolved: cgroup: cgroup_get_from_id() must check the looked-up kn is a directory cgroup has to be one kernfs dir, otherwise kernel panic is caused, especially cgroup id is provide from userspace.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 28, 2024
• Unscored —
  CVE-2024-26686

  fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats

  In the Linux kernel, the following vulnerability has been resolved: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats lock_task_sighand() can trigger a hard lockup. If NR_CPUS threads call do_task_stat() at the same time and the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 3, 2024
• Unscored —
  CVE-2024-36889

  mptcp: ensure snd_nxt is properly initialized on connect

  In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_nxt is properly initialized on connect Christoph reported a splat hinting at a corrupted snd_una: WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• Unscored —
  CVE-2024-41071 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Jul 29, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2267795
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273109
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2277829
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278931
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284571
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300448
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6998.json
• report
  https://access.redhat.com/security/cve/CVE-2022-48638
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48638
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48638
• article
  https://lore.kernel.org/linux-cve-announce/2024042855-CVE-2022-48638-e1bd@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2022-48686
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-48686
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-48686
• article
  https://lore.kernel.org/linux-cve-announce/2024050342-CVE-2022-48686-5e8e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52522
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52522
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52522
• article
  https://lore.kernel.org/linux-cve-announce/2024030253-CVE-2023-52522-6abd@gregkh/T/#u
• report
  https://access.redhat.com/security/cve/CVE-2024-26686
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26686
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26686
• article
  https://lore.kernel.org/linux-cve-announce/2024040335-CVE-2024-26686-b22f@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-36889
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-36889
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-36889
• article
  https://lore.kernel.org/linux-cve-announce/2024053033-CVE-2024-36889-222d@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-41071
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-41071