RHSA-2024:2950 Red Hat Security Advisory: kernel-rt security and bug fix update
kernel: OOB writes in parse_hid_report_descriptor in drivers/input/tablet/gtco.c kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c kernel: use-after-free in read in vt_do_kdgkb_ioctl kernel: a race out-of-bound read in vt kernel: improper input validation may lead to privilege escalation kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges kernel: use-after-free in l1oip timer handlers kernel: local privileges escalation in kernel/bpf/verifier.c kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c kernel: KVM: information leak in KVM_GET_DEBUGREGS ioctl on 32-bit systems kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race kernel: cxgb4: use-after-free in ch_flower_stats_cb() kernel: Use-after-free in nft_verdict_dump due to a race between set GC and transaction kernel: NVMe: info leak due to out-of-bounds read in nvmet_ctrl_find_get kernel: local dos vulnerability in scatterwalk_copychunks kernel: null pointer dereference vulnerability in nft_dynset_init() kernel: Null Pointer Dereference vulnerability in ida_free in lib/idr.c kernel: use-after-free in IPv4 IGMP kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses kernel: irdma: Improper access control Kernel: double free in hci_conn_cleanup of the bluetooth subsystem kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl kernel: usb: out-of-bounds read in read_descriptors kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one() kernel: netfilter: xtables out-of-bounds read in u32_match_it() kernel: netfilter: xtables sctp out-of-bounds read in match_flags() kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match() kernel: QXL: race condition leading to use-after-free in qxl_mode_dumb_create() kernel: ipv4: NULL pointer dereference in ipv4_send_dest_unreach() kernel: rsvp: out-of-bounds read in rsvp_classify() kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write kernel: bluetooth: bt_sock_ioctl race condition leads to use-after-free in bt_sock_recvmsg kernel: use-after-free in net/atm/ioctl.c kernel: ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU kernel: smb: client: fix potential OOBs in smb2_parse_contexts() kernel: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump kernel: mm/sparsemem: fix race in accessing memory_section->usage kernel: team: NULL pointer dereference when team device type is changed kernel: net/core: kernel crash in ETH_P_1588 flow dissector kernel: netfilter: nf_tables: memory leak when more than 255 elements expired kernel: KVM: s390: fix setting of fpc register kernel: netfilter: nf_tables: disallow timeout for anonymous sets kernel: hugetlbfs: Null pointer dereference in hugetlbfs_fill_super function hw: amd: Instruction raise #VC exception at exit hw: amd: Instruction raise #VC exception at exit kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters kernel: blk-mq: fix IO hang from sbitmap wakeup race
CVSS v3.1 score: 4.4
CVSS v3.0 score: 5.3