Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: block: null pointer dereference in ioctl.c when length and logical block size are misaligned (CVE-2023-52458)
* kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (CVE-2024-26773)
* kernel: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (CVE-2024-26737)
* kernel: dm: call the resume method on internal suspend (CVE-2024-26880)
* kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (CVE-2024-26852)
* kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982)
* kernel: nfp: flower: handle acti_netdevs allocation failure (CVE-2024-27046)
* kernel: octeontx2-af: Use separate handlers for interrupts (CVE-2024-27030)
* kernel: icmp: prevent possible NULL dereferences from icmp_build_probe() (CVE-2024-35857)
* kernel: mlxbf_gige: call request_irq() after NAPI initialized (CVE-2024-35907)
* kernel: mlxbf_gige: stop interface during shutdown (CVE-2024-35885)
* kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809)
* kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (CVE-2021-47459)
* kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (CVE-2024-36924)
* kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (CVE-2024-36952)
* kernel: net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743)
* kernel: epoll: be better about file lifetimes (CVE-2024-38580)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | kernel | 0:5.14.0-427.28.1.el9_4 |
Vulnerabilities 17
-
High 8.1
net: amd-xgbe: Fix skb data length underflow
In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fix skb data length underflow There will be BUG_ON() triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix th…
-
High 7.8
can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv It will trigger UAF for rx_kref of j1939_priv as following. cpu0 cpu1 j1939_sk_bind(socket0, ndev0, ...) j1939_netdev_start…
-
High 7.8
bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel The following race is possible between bpf_timer_cancel_and_free and bpf_timer_cancel. It will lead a UAF on the timer->…
-
High 7.8
ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid alloc…
-
High 7.8
net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_rout…
-
High 7.8
dm: call the resume method on internal suspend
In the Linux kernel, the following vulnerability has been resolved: dm: call the resume method on internal suspend There is this reported crash when experimenting with the lvm2 testsuite. The list corruption is caused by the fact that the postsuspend and resu…
-
High 7.8
octeontx2-af: Use separate handlers for interrupts
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Use separate handlers for interrupts For PF to AF interrupt vector and VF to AF vector same interrupt handler is registered which is causing race condition. When two interrupts …
-
High 7.8
epoll: be better about file lifetimes
In the Linux kernel, the following vulnerability has been resolved: epoll: be better about file lifetimes epoll can call out to vfs_poll() with a file pointer that may race with the last 'fput()'. That would make f_count go down to zero, and while the ep->mtx…
-
High 7.5
icmp: prevent possible NULL dereferences from icmp_build_probe()
In the Linux kernel, the following vulnerability has been resolved: icmp: prevent possible NULL dereferences from icmp_build_probe() First problem is a double call to __in_dev_get_rcu(), because the second one could return NULL. if (__in_dev_get_rcu(dev) && _…
-
Unscored —
block: add check that partition length needs to be aligned with block size
In the Linux kernel, the following vulnerability has been resolved: block: add check that partition length needs to be aligned with block size Before calling add partition or resize partition, there is no check on whether the length is aligned with the logica…
-
Unscored —
scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() fc_lport_ptp_setup() did not check the return value of fc_rport_create() which can return NULL and would cause a NU…
-
Unscored —
Squashfs: check the inode number is not the invalid value of zero
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero Syskiller has produced an out of bounds access in fill_meta_index(). That out of bounds access is ultimately caused because t…
-
Unscored —
nfp: flower: handle acti_netdevs allocation failure
In the Linux kernel, the following vulnerability has been resolved: nfp: flower: handle acti_netdevs allocation failure The kmalloc_array() in nfp_fl_lag_do_work() will return null, if the physical memory has run out. As a result, if we dereference the acti_n…
-
Unscored —
mlxbf_gige: stop interface during shutdown
In the Linux kernel, the following vulnerability has been resolved: mlxbf_gige: stop interface during shutdown The mlxbf_gige driver intermittantly encounters a NULL pointer exception while the system is shutting down via "reboot" command. The mlxbf_driver wi…
-
Unscored —
mlxbf_gige: call request_irq() after NAPI initialized
In the Linux kernel, the following vulnerability has been resolved: mlxbf_gige: call request_irq() after NAPI initialized The mlxbf_gige driver encounters a NULL pointer exception in mlxbf_gige_open() when kdump is enabled. The sequence to reproduce the excep…
-
Unscored —
scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() lpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the hbalock. Thus, lpfc_worker_wake_up() should not be c…
-
Unscored —
scsi: lpfc: Move NPIV's transport unregistration to after resource clean up
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2265794
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2273236
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2273274
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275690
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2275761
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278337
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278435
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2278473
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281247
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281647
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2281700
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2282669
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2282898
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2284506
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2284598
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293316
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2293412