Red Hat Security Advisory: kernel security update

Fixed packages 143

Vulnerabilities 6

• High 7.8
  CVE-2024-53197 Exploited

  ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configura…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 27, 2024

  KEV Apr 9, 2025
• Medium 5.5
  CVE-2024-50302 Exploited

  HID: core: zero-initialize the report buffer

  In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 19, 2024

  KEV Mar 4, 2025
• High 7.8
  CVE-2023-52922

  can: bcm: Fix UAF in bcm_proc_show()

  In the Linux kernel, the following vulnerability has been resolved: can: bcm: Fix UAF in bcm_proc_show() BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862 CPU: 1 PID: 7862 Comm: cat Not taint…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Nov 28, 2024
• High 7.8
  CVE-2024-50264

  vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans

  In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 19, 2024
• Unscored —
  CVE-2023-52605 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Mar 6, 2024
• Unscored —
  CVE-2024-53113

  mm: fix NULL pointer dereference in alloc_pages_bulk_noprof

  In the Linux kernel, the following vulnerability has been resolved: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof We triggered a NULL pointer dereference for ac.preferred_zoneref->zone in alloc_pages_bulk_noprof() when the task is migrated betwe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 2, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268295
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2327168
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2327169
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2329370
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2329924
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2334412
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2627.json
• report
  https://access.redhat.com/security/cve/CVE-2023-52605
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52605
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52605
• article
  https://lore.kernel.org/linux-cve-announce/2024030647-CVE-2023-52605-292a@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2023-52922
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52922
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52922
• article
  https://lore.kernel.org/linux-cve-announce/2024112856-CVE-2023-52922-39e1@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-50264
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-50264
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-50264
• article
  https://lore.kernel.org/linux-cve-announce/2024111920-CVE-2024-50264-0889@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-50302
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-50302
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-50302
• article
  https://lore.kernel.org/linux-cve-announce/2024111908-CVE-2024-50302-f677@gregkh/T
• article
  https://securitylab.amnesty.org/latest/2025/02/cellebrite-zero-day-exploit-used-to-target-phone-of-serbian-student-activist/
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2024-53113
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-53113
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-53113
• article
  https://lore.kernel.org/linux-cve-announce/2024120249-CVE-2024-53113-57df@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-53197
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-53197
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-53197
• article
  https://lore.kernel.org/linux-cve-announce/2024122725-CVE-2024-53197-6aef@gregkh/T