Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 6

• High 7.8
  CVE-2024-26872

  RDMA/srpt: Do not register event handler until srpt device is fully setup

  In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Do not register event handler until srpt device is fully setup Upon rare occasions, KASAN reports a use-after-free Write in srpt_refresh_port(). This seems to be because an event h…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• High 7.8
  CVE-2024-35835

  net/mlx5e: fix a double-free in arfs_create_groups

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfs_create_groups When `in` allocated by kvzalloc fails, arfs_create_groups will free ft->g and return an error. However, arfs_create_table, the only caller o…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• High 7.8
  CVE-2024-43892

  memcg: protect concurrent access to mem_cgroup_idr

  In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to mem_cgroup_idr Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after many small jobs") decoupled the memcg IDs from the CSS ID space to f…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Aug 26, 2024
• Medium 5.5
  CVE-2024-35809

  PCI/PM: Drain runtime-idle callbacks before driver removal

  In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal A race condition between the .runtime_idle() callback and the .remove() callback in the rtsx_pcr PCI driver leads to a kernel crash …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 17, 2024
• Unscored —
  CVE-2023-52605 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Mar 6, 2024
• Unscored —
  CVE-2024-27014

  net/mlx5e: Prevent deadlock while disabling aRFS

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent deadlock while disabling aRFS When disabling aRFS under the `priv->state_lock`, any scheduled aRFS works are canceled using the `cancel_work_sync` function, which waits for…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 1, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268295
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275707
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278268
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281165
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281217
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2307865
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3021.json
• report
  https://access.redhat.com/security/cve/CVE-2023-52605
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52605
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52605
• article
  https://lore.kernel.org/linux-cve-announce/2024030647-CVE-2023-52605-292a@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26872
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26872
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26872
• article
  https://lore.kernel.org/linux-cve-announce/2024041738-CVE-2024-26872-2d38@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-27014
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-27014
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-27014
• article
  https://lore.kernel.org/linux-cve-announce/2024050149-CVE-2024-27014-d2dc@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-35809
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-35809
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-35809
• article
  https://lore.kernel.org/linux-cve-announce/2024051740-CVE-2024-35809-4a4e@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-35835
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-35835
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-35835
• article
  https://lore.kernel.org/linux-cve-announce/2024051730-CVE-2024-35835-d75f@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-43892
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-43892
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-43892
• article
  https://lore.kernel.org/linux-cve-announce/2024082604-CVE-2024-43892-584a@gregkh/T