Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 19

• High 7.8
  CVE-2022-49846

  udf: Fix a slab-out-of-bounds write bug in udf_find_entry()

  In the Linux kernel, the following vulnerability has been resolved: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() Syzbot reported a slab-out-of-bounds Write bug: loop0: detected capacity change from 0 to 2048 ====================================…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2025
• High 7.8
  CVE-2024-36940

  pinctrl: core: delete incorrect free in pinctrl_enable()

  In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• High 7.8
  CVE-2024-39471

  drm/amdgpu: add error handle to avoid out-of-bounds

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add error handle to avoid out-of-bounds if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 25, 2024
• High 7.8
  CVE-2024-41092

  drm/i915/gt: Fix potential UAF by revoke of fence registers

  In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix potential UAF by revoke of fence registers CI has been sporadically reporting the following issue triggered by igt@i915_selftest@live@hangcheck on ADL-P and similar machines:…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jul 29, 2024
• High 7.8
  CVE-2024-43880

  mlxsw: spectrum_acl_erp: Fix object nesting warning

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_erp: Fix object nesting warning ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can con…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 21, 2024
• High 7.8
  CVE-2024-56614

  xsk: fix OOB map writes when deleting elements

  In the Linux kernel, the following vulnerability has been resolved: xsk: fix OOB map writes when deleting elements Jordy says: " In the xsk_map_delete_elem function an unsigned integer (map->max_entries) is compared with a user-controlled signed integer (k). …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 27, 2024
• High 7.5
  CVE-2023-52834

  atl1c: Work around the DMA RX overflow issue

  In the Linux kernel, the following vulnerability has been resolved: atl1c: Work around the DMA RX overflow issue This is based on alx driver commit 881d0327db37 ("net: alx: Work around the DMA RX overflow issue"). The alx and atl1c drivers had RX overflow err…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• High 7.1
  CVE-2023-52565

  media: uvcvideo: Fix OOB read

  In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix OOB read If the index provided by the user is bigger than the mask size, we might do an out of bound read.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• High 7.1
  CVE-2024-35924

  usb: typec: ucsi: Limit read size on v1.2

  In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Limit read size on v1.2 Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was increased from 16 to 256. In order to avoid overflowing reads for older systems,…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 19, 2024
• Unscored —
  CVE-2023-52477

  usb: hub: Guard against accesses to uninitialized BOS descriptors

  In the Linux kernel, the following vulnerability has been resolved: usb: hub: Guard against accesses to uninitialized BOS descriptors Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev->bos without checking if it was…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 29, 2024
• Unscored —
  CVE-2023-52595

  wifi: rt2x00: restart beacon queue when hardware reset

  In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: restart beacon queue when hardware reset When a hardware reset is triggered, all registers are reset, so all queues are forced to stop in hardware interface. However, mac80211 w…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 6, 2024
• Unscored —
  CVE-2023-52781

  usb: config: fix iteration issue in 'usb_get_bos_descriptor()'

  In the Linux kernel, the following vulnerability has been resolved: usb: config: fix iteration issue in 'usb_get_bos_descriptor()' The BOS descriptor defines a root descriptor and is the base descriptor for accessing a family of related descriptors. Function …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Unscored —
  CVE-2024-26717

  HID: i2c-hid-of: fix NULL-deref on failed power up

  In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid-of: fix NULL-deref on failed power up A while back the I2C HID implementation was split in an ACPI and OF part, but the new OF driver never initialises the client pointer which i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2024
• Unscored —
  CVE-2024-35790

  usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group

  In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group The DisplayPort driver's sysfs nodes may be present to the userspace before typec_altmode_set_d…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 17, 2024
• Unscored —
  CVE-2024-35807

  ext4: fix corruption during on-line resize

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks res…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• Unscored —
  CVE-2024-36006

  mlxsw: spectrum_acl_tcam: Fix incorrect list API usage

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage Both the function that migrates all the chunks within a region and the function that migrates all the entries within a chunk call list_f…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 20, 2024
• Unscored —
  CVE-2024-41097

  usb: atm: cxacru: fix endpoint checking in cxacru_bind()

  In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacru_bind() Syzbot is still reporting quite an old issue [1] that occurs due to incomplete checking of present usb endpoints. As such, wrong endpo…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• Unscored —
  CVE-2024-46826

  ELF: fix kernel.randomize_va_space double read

  In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomize_va_space double read ELF loader uses "randomize_va_space" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with un…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 27, 2024
• Unscored —
  CVE-2025-22126

  md: fix mddev uaf while iterating all_mddevs list

  In the Linux kernel, the following vulnerability has been resolved: md: fix mddev uaf while iterating all_mddevs list While iterating all_mddevs list from md_notify_reboot() and md_exit(), list_for_each_entry_safe is used, and this can race with deletint the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 16, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2267038
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2267724
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268315
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273148
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281054
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281221
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281758
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281989
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282698
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2282744
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284477
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2294313
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300487
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300492
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315178
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334573
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2360236
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2363432
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10701.json
• report
  https://access.redhat.com/security/cve/CVE-2022-49846
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-49846
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-49846
• article
  https://kernelcve.org/list/?q=CVE-2022-49846
• article
  https://lore.kernel.org/linux-cve-announce/2025050142-CVE-2022-49846-728c@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52477
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52477
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52477
• article
  https://lore.kernel.org/linux-cve-announce/2024022921-CVE-2023-52477-6f20@gregkh/T/#u
• report
  https://access.redhat.com/security/cve/CVE-2023-52565
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52565
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52565
• article
  https://lore.kernel.org/linux-cve-announce/2024030254-CVE-2023-52565-07ce@gregkh/
• report
  https://access.redhat.com/security/cve/CVE-2023-52595
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52595
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52595
• article
  https://lore.kernel.org/linux-cve-announce/2024030645-CVE-2023-52595-d018@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52781
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52781