Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 23

• High 7.8
  CVE-2021-47383

  tty: Fix out-of-bound vmalloc access in imageblit

  In the Linux kernel, the following vulnerability has been resolved: tty: Fix out-of-bound vmalloc access in imageblit This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• High 7.8
  CVE-2023-54153

  ext4: turn quotas off if mount failed after enabling quotas

  In the Linux kernel, the following vulnerability has been resolved: ext4: turn quotas off if mount failed after enabling quotas Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4_mark_recovery_complete() ret…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2024-26640

  tcp: add sanity checks to rx zerocopy

  In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to can_map_frag() these additional …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 18, 2024
• High 7.8
  CVE-2024-26923

  af_unix: Fix garbage collector racing against connect()

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a pe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 24, 2024
• High 7.5
  CVE-2024-26826

  mptcp: fix data re-injection from stale subflow

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• High 7.3
  CVE-2024-39472

  xfs: fix log recovery buffer allocation for the legacy h_size fixup

  In the Linux kernel, the following vulnerability has been resolved: xfs: fix log recovery buffer allocation for the legacy h_size fixup Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by mkfs") added a fixup for incorrect h_size values use…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 5, 2024
• High 7.1
  CVE-2024-41014

  xfs: add bounds checking to xlog_recover_process_data

  In the Linux kernel, the following vulnerability has been resolved: xfs: add bounds checking to xlog_recover_process_data There is a lack of verification of the space occupied by fixed members of xlog_op_header in the xlog_recover_process_data. We can create …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• High 7.0
  CVE-2024-26961

  mac802154: fix llsec key resources release in mac802154_llsec_key_del

  In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024
• Medium 4.7
  CVE-2024-2201

  CVE-2024-2201

  A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.

  Xen Xen linux-raspi2 linux-hwe Virtualization Debian Ubuntu Alpine
  Dec 19, 2024
• Unscored —
  CVE-2024-26935

  scsi: core: Fix unremoved procfs host directory regression

  In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} directory earlier") fixed a bug related to modules loading/unlo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• Unscored —
  CVE-2024-36244

  net/sched: taprio: extend minimum interval restriction to entire cycle too

  In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: extend minimum interval restriction to entire cycle too It is possible for syzbot to side-step the restriction imposed by the blamed commit in the Fixes: tag, because the t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 21, 2024
• Unscored —
  CVE-2024-39504

  netfilter: nft_inner: validate mandatory meta and payload

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: validate mandatory meta and payload Check for mandatory netlink attributes in payload and meta expression when used embedded from the inner expression, otherwise NULL po…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40904

  USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages

  In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver was taking too long, and the driv…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40931

  mptcp: ensure snd_una is properly initialized on connect

  In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_una is properly initialized on connect This is strictly related to commit fb7a0d334894 ("mptcp: ensure snd_nxt is properly initialized on connect"). It turns out that syzkal…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40960

  ipv6: prevent possible NULL dereference in rt6_probe()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible NULL dereference in rt6_probe() syzbot caught a NULL dereference in rt6_probe() [1] Bail out if __in6_dev_get() returns NULL. [1] Oops: general protection fault, probab…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40972

  ext4: do not create EA inode under buffer lock

  In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock ext4_xattr_set_entry() creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 12, 2024
• Unscored —
  CVE-2024-40977

  wifi: mt76: mt7921s: fix potential hung tasks during chip recovery

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery During chip recovery (e.g. chip reset), there is a possible situation that kernel worker reset_work is holding the lock and …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 12, 2024
• Unscored —
  CVE-2024-40995

  net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

  In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() syzbot found hanging tasks waiting on rtnl_lock [1] A reproducer is available in the syzbot bug. When a request to add …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-40998

  ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() In the following concurrency we will access the uninitialized rs->lock: ext4_fill_super ext4_register_sysfs // sysf…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 12, 2024
• Unscored —
  CVE-2024-41005

  netpoll: Fix race condition in netpoll_owner_active

  In the Linux kernel, the following vulnerability has been resolved: netpoll: Fix race condition in netpoll_owner_active KCSAN detected a race condition in netpoll: BUG: KCSAN: data-race in net_rx_action / netpoll_send_skb write (marked) to 0xffff8881164168b0 …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 12, 2024
• Unscored —
  CVE-2024-41013

  xfs: don't walk off the end of a directory data block

  In the Linux kernel, the following vulnerability has been resolved: xfs: don't walk off the end of a directory data block This adds sanity checks for xfs_dir2_data_unused and xfs_dir2_data_entry to make sure don't stray beyond valid memory region. Before patc…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• Unscored —
  CVE-2024-43854

  block: initialize integrity buffer to zero before writing it to media

  In the Linux kernel, the following vulnerability has been resolved: block: initialize integrity buffer to zero before writing it to media Metadata added by bio_integrity_prep is using plain kmalloc, which leads to random kernel memory being written media. For…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 17, 2024
• Unscored —
  CVE-2024-45018

  netfilter: flowtable: initialise extack before use

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: initialise extack before use Fix missing initialisation of extack in flow offload.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 11, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268118
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2270100
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275604
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2277171
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278176
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278235
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282357
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2293654
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2296067
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297476
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297488
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297515
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297544
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297556
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297561
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297579
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297582
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2297589
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300296
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300297
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2311715
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8617.json
• report
  https://access.redhat.com/security/cve/CVE-2021-47383
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-47383
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-47383
• article
  https://lore.kernel.org/linux-cve-announce/2024052144-CVE-2021-47383-a8f4@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-54153
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2425153
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-54153
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-54153
• article
  https://lore.kernel.org/linux-cve-announce/2025122427-CVE-2023-54153-63a8@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-2201
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-2201
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-2201
• article
  https://download.vusec.net/papers/inspectre_sec24.pdf
• article
  https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html#inpage-nav-8
• article
  https://www.openwall.com/lists/oss-security/2024/04/09/15
• article
  https://www.vusec.net/projects/native-bhi/