RHSA-2024:3138 Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: OOB writes in parse_hid_report_descriptor in drivers/input/tablet/gtco.c kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c kernel: use-after-free in read in vt_do_kdgkb_ioctl kernel: a race out-of-bound read in vt kernel: improper input validation may lead to privilege escalation kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges kernel: use-after-free in l1oip timer handlers kernel: local privileges escalation in kernel/bpf/verifier.c kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c kernel: Bluetooth: L2CAP: Fix u8 overflow kernel: highmem: fix checks in __kmap_local_sched_{in,out} kernel: mm/slub: add missing TID updates on slab deactivation kernel: VMCI: Use threaded irqs instead of tasklets kernel: ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() kernel: tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() kernel: tty: n_gsm: fix deadlock and link starvation in outgoing data path kernel: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted kernel: usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe kernel: media: dvbdev: adopts refcnt to avoid UAF kernel: ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline kernel: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value kernel: ext4: fix null-ptr-deref in ext4_write_info kernel: ext4: init quota for 'old.inode' in 'ext4_rename' kernel: ext4: fix undefined behavior in bit shift for ext4_check_flag_values kernel: Linux kernel: Information disclosure and denial of service via use-after-free in ACPI subsystem kernel: ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode kernel: ext4: fix uninititialized value in 'ext4_evict_inode' kernel: powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe() kernel: ext4: fix bug_on in __es_tree_search caused by bad boot loader inode kernel: ext4: fix deadlock due to mbcache entry corruption kernel: nvmet-tcp: add bounds check on Transfer Tag kernel: ext4: silence the warning when evicting inode with dioread_nolock kernel: ext4: fix bug_on in __es_tree_search caused by bad quota inode kernel: KVM: information leak in KVM_GET_DEBUGREGS ioctl on 32-bit systems kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race kernel: cxgb4: use-after-free in ch_flower_stats_cb() kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction kernel: NVMe: info leak due to out-of-bounds read in nvmet_ctrl_find_get kernel: local dos vulnerability in scatterwalk_copychunks kernel: null pointer dereference vulnerability in nft_dynset_init() kernel: Null Pointer Dereference vulnerability in ida_free in lib/idr.c kernel: use-after-free in IPv4 IGMP kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses kernel: irdma: Improper access control Kernel: double free in hci_conn_cleanup of the bluetooth subsystem kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl kernel: usb: out-of-bounds read in read_descriptors kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one() kernel: netfilter: xtables out-of-bounds read in u32_match_it() kernel: netfilter: xtables sctp out-of-bounds read in match_flags() kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match() kernel: QXL: race condition leading to use-after-free in qxl_mode_dumb_create() kernel: ipv4: NULL pointer dereference in ipv4_send_dest_unreach() kernel: rsvp: out-of-bounds read in rsvp_classify() kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write kernel: bluetooth: bt_sock_ioctl race condition leads to use-after-free in bt_sock_recvmsg kernel: use-after-free in net/atm/ioctl.c kernel: ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU kernel: smb: client: fix potential OOBs in smb2_parse_contexts() kernel: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump kernel: mm/sparsemem: fix race in accessing memory_section->usage kernel: team: NULL pointer dereference when team device type is changed kernel: net/core: kernel crash in ETH_P_1588 flow dissector kernel: netfilter: nf_tables: memory leak when more than 255 elements expired kernel: KVM: s390: fix setting of fpc register kernel: netfilter: nf_tables: disallow timeout for anonymous sets kernel: netfilter: nf_tables: don't skip expired elements during walk kernel: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF kernel: ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent kernel: mptcp: use the workqueue to destroy unaccepted sockets kernel: mptcp: fix UaF in listener shutdown kernel: ext4: fix task hung in ext4_xattr_delete_inode kernel: bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails kernel: bnxt_en: Avoid order-5 memory allocation for TPA data kernel: scsi: core: Remove the /proc/scsi/${proc_name} directory earlier kernel: igb: Fix igb_down hung on surprise removal kernel: scsi: qla2xxx: Pointer may be dereferenced kernel: Linux kernel: md/raid10 soft lockup due to unlimited plugged bio kernel: Linux kernel: ACPICA undefined behavior due to zero offset to null pointer kernel: PM: domains: fix memory leak with using debugfs_lookup() kernel: KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler kernel: md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() kernel: ext4: Fix function prototype mismatch for ext4_feat_ktype kernel: arm64: acpi: Fix possible memory leak of ffh_ctxt kernel: ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() kernel: scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue kernel: scsi: qla2xxx: Wait for io return on terminate rport kernel: RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() kernel: icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev() kernel: skbuff: skb_segment, Call zero copy functions before using skbuff frags kernel: ip6mr: Fix skb_under_panic in ip6mr_cache_report() kernel: net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create kernel: md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request kernel: HID: intel-ish-hid: Fix kernel panic during warm reset kernel: bpf: cpumap: Fix memory leak in cpu_map_update_elem kernel: ice: Block switchdev mode when ADQ is active and vice versa kernel: scsi: qla2xxx: Fix potential NULL pointer dereference kernel: iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() kernel: ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() kernel: x86/platform/uv: Use alternate source for socket to node data kernel: Linux kernel: Denial of Service due to race condition in IOMMU pasid unbinding kernel: RDMA/cma: Allow UD qp_type to join multicast only kernel: scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id() kernel: net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx kernel: cpufreq: amd-pstate: fix global sysfs attribute type kernel: ip_vti: fix potential slab-use-after-free in decode_session6 kernel: null_blk: Always check queue mode setting from configfs kernel: bpf, cpumap: Make sure kthread is running before map update returns kernel: net/mlx5e: Check for NOT_READY flag state after locking kernel: scsi: target: Fix multiple LUN_RESET handling kernel: ipmi_si: fix a memleak in try_smi_init() kernel: scsi: qla2xxx: Fix deletion race condition kernel: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() kernel: ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer kernel: ice: Don't tx before switchdev is fully configured kernel: bnxt: avoid overflow in bnxt_get_nvram_directory() kernel: scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() kernel: xsk: fix refcount underflow in error path kernel: ipv6: Fix out-of-bounds access in ipv6_find_tlv() kernel: md: raid1: fix potential OOB in raid1_remove_disk() kernel: s390/vfio-ap: fix memory leak in vfio_ap device driver kernel: USB: usbtmc: Fix direction for 0-length ioctl control messages kernel: ethtool: Fix uninitialized number of lanes kernel: ip6_vti: fix slab-use-after-free in decode_session6 kernel: net: openvswitch: reject negative ifindex kernel: md/raid5-cache: fix a deadlock in r5l_exit_log() kernel: ceph: fix potential use-after-free bug when trimming caps kernel: Linux kernel: Denial of Service due to memory leak in IP address deletion kernel: x86/sev: Make enc_dec_hypercall() accept a size instead of npages kernel: Linux kernel: Denial of Service due to memory leak in mlx5e driver kernel: Linux kernel: RDMA/core GID entry leak causes Denial of Service kernel: Linux kernel UDPLITE: Denial of Service via null pointer dereference kernel: Linux kernel: Denial of Service via null pointer dereference in ACPI kernel: scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() kernel: iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter kernel: Kernel: Memory leak in IPMI SSIF module leads to Denial of Service kernel: Linux kernel igb driver: Denial of Service due to improper SR-IOV cleanup kernel: Linux kernel: Denial of service or memory corruption due to a data race in ALSA PCM memory allocation kernel: ixgbe: Fix panic during XDP_TX with > 64 CPUs kernel: Linux kernel (soundwire): Memory corruption due to incorrect device enumeration completion kernel: scsi: qedi: Fix use after free bug in qedi_remove() kernel: Linux kernel: Denial of Service via memory leak in mlx5e_init_rep_rx kernel: net/mlx5e: Move representor neigh cleanup to profile cleanup_tx kernel: igc: Fix Kernel Panic during ndo_tx_timeout callback kernel: net/mlx5e: fix memory leak in mlx5e_ptp_open kernel: scsi: qla2xxx: Array index may go out of bound kernel: scsi: target: iscsit: Free cmds before session free kernel: usb: typec: altmodes/displayport: fix pin_assignment_show kernel: RDMA/efa: Fix wrong resources deallocation order kernel: ACPI: EC: Fix oops when removing custom query handlers kernel: RDMA/srpt: Add a check for valid 'mad_agent' pointer kernel: scsi: qedf: Fix NULL dereference in error handling kernel: platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2() kernel: dm: fix a race condition in retrieve_deps kernel: hugetlbfs: Null pointer dereference in hugetlbfs_fill_super function hw: amd: Instruction raise #VC exception at exit hw: amd: Instruction raise #VC exception at exit kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters kernel: blk-mq: fix IO hang from sbitmap wakeup race kernel: i40e: Do not allow untrusted VF to remove administratively set MAC
CVSS v3.1 score: 4.4
CVSS v3.0 score: 5.3