Red Hat Security Advisory: kernel security update

Fixed packages 43

Vulnerabilities 4

• High 7.8
  CVE-2024-53197 Exploited

  ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configura…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 27, 2024

  KEV Apr 9, 2025
• Medium 5.5
  CVE-2024-50302 Exploited

  HID: core: zero-initialize the report buffer

  In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 19, 2024

  KEV Mar 4, 2025
• High 7.8
  CVE-2023-52922

  can: bcm: Fix UAF in bcm_proc_show()

  In the Linux kernel, the following vulnerability has been resolved: can: bcm: Fix UAF in bcm_proc_show() BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862 CPU: 1 PID: 7862 Comm: cat Not taint…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Nov 28, 2024
• High 7.3
  CVE-2024-50275

  arm64/sve: Discard stale CPU state when handling SVE traps

  In the Linux kernel, the following vulnerability has been resolved: arm64/sve: Discard stale CPU state when handling SVE traps The logic for handling SVE traps manipulates saved FPSIMD/SVE state incorrectly, and a race with preemption can result in a task hav…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 19, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2327169
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2327198
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2329370
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334412
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2525.json
• report
  https://access.redhat.com/security/cve/CVE-2023-52922
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52922
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52922
• article
  https://lore.kernel.org/linux-cve-announce/2024112856-CVE-2023-52922-39e1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-50275
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-50275
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-50275
• article
  https://lore.kernel.org/linux-cve-announce/2024111934-CVE-2024-50275-2e49@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-50302
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-50302
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-50302
• article
  https://lore.kernel.org/linux-cve-announce/2024111908-CVE-2024-50302-f677@gregkh/T
• article
  https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2024-53197
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-53197
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-53197
• article
  https://lore.kernel.org/linux-cve-announce/2024122725-CVE-2024-53197-6aef@gregkh/T