Red Hat Security Advisory: kernel security update

Fixed packages 142

Vulnerabilities 11

• High 7.8
  CVE-2024-35854

  mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash The rehash delayed work migrates filters from one region to another according to the number of available credits. The migra…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 17, 2024
• High 7.8
  CVE-2025-21785

  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array

  In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache le…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 27, 2025
• High 7.5
  CVE-2024-26851

  netfilter: nf_conntrack_h323: Add protection for bmp length out of range

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vml…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 17, 2024
• Medium 5.5
  CVE-2024-26940

  drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed

  In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed The driver creates /sys/kernel/debug/dri/0/mob_ttm even when the corresponding ttm_resource_manager is not allocated. This…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 1, 2024
• Medium 4.6
  CVE-2024-24857

  Race condition vulnerability in Linux kernel bluetooth in conn_info_{min,max}_age_set()

  A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 5, 2024
• Unscored —
  CVE-2024-26733

  arp: Prevent overflow in arp_req_get().

  In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_req_get(). syzkaller reported an overflown write in arp_req_get(). [0] When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour entry and copies neigh-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 3, 2024
• Unscored —
  CVE-2024-36901

  ipv6: prevent NULL dereference in ip6_output()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent NULL dereference in ip6_output() According to syzbot, there is a chance that ip6_dst_idev() returns NULL in ip6_output(). Most places in IPv6 stack deal with a NULL idev just fi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 30, 2024
• Unscored —
  CVE-2024-36920

  scsi: mpi3mr: Avoid memcpy field-spanning write WARNING

  In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Avoid memcpy field-spanning write WARNING When the "storcli2 show" command is executed for eHBA-9600, mpi3mr driver prints this WARNING message: memcpy: detected field-spanning …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 30, 2024
• Unscored —
  CVE-2024-36927

  ipv4: Fix uninit-value access in __ip_make_skb()

  In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix uninit-value access in __ip_make_skb() KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb() tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 30, 2024
• Unscored —
  CVE-2024-42084

  ftruncate: pass a signed offset

  In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset The old ftruncate() syscall, using the 32-bit off_t misses a sign extension when called in compat mode on 64-bit architectures. As a result, passing a negative…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jul 29, 2024
• Unscored —
  CVE-2024-42265

  protect the fetch of ->fd[fd] in do_dup2() from mispredictions

  In the Linux kernel, the following vulnerability has been resolved: protect the fetch of ->fd[fd] in do_dup2() from mispredictions both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd];…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Aug 17, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2266247
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2273247
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2275750
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2278218
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2281253
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284500
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284515
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2284634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2300533
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2348630
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3215.json
• report
  https://access.redhat.com/security/cve/CVE-2024-24857
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24857
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24857
• report
  https://access.redhat.com/security/cve/CVE-2024-26733
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26733
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26733
• article
  https://lore.kernel.org/linux-cve-announce/2024040358-CVE-2024-26733-617f@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26851
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26851
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26851
• article
  https://lore.kernel.org/linux-cve-announce/2024041723-CVE-2024-26851-4652@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-26940
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-26940
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-26940
• article
  https://lore.kernel.org/linux-cve-announce/2024050125-CVE-2024-26940-1785@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-35854
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-35854
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-35854
• article
  https://lore.kernel.org/linux-cve-announce/2024051740-CVE-2024-35854-d17b@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-36901
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-36901
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-36901
• article
  https://lore.kernel.org/linux-cve-announce/2024053035-CVE-2024-36901-fb16@gregkh/T
• report
  https://access.redhat.com/security/cve/CVE-2024-36920
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-36920
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-36920
• article
  https://lore.kernel.org/linux-cve-announce/2024053039-CVE-2024-36920-b4a7@gregkh/T