RHSA-2023:6901 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update
kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c kernel: Rate limit overflow messages in r8152 in intr_callback kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c kernel: tun: avoid double free in tun_free_netdev kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c kernel: vmwgfx: use-after-free in vmw_cmd_res_check kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c kernel: KVM: x86/mmu: race condition in direct_page_fault() kernel: memory leak in ttusb_dec_exit_dvb() in media/usb/ttusb-dec/ttusb_dec.c kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c kernel: use-after-free due to race condition in qdisc_graft() kernel: x86/mm: Randomize per-cpu entry area kernel: HID: check empty report_list in hid_validate_values() kernel: sctp: fail if no bound addresses can be used for a given scope kernel: net/tls: tls_is_tx_ready() checked list_entry kernel: hid: Use After Free in asus_remove() kernel: use-after-free in drivers/media/rc/ene_ir.c due to race condition kernel: hash collisions in the IPv6 connection lookup table kernel: ovl: fix use after free in struct ovl_aio_req kernel: denial of service in tipc_conn_close kernel: use-after-free bug in remove function xgene_hwmon_remove kernel: Use after free bug in btsdio_remove due to race condition kernel: Spectre v2 SMT mitigations problem kernel: A possible deadlock in dm_get_inactive_table in dm- ioctl.c leads to dos kernel: ext4: use-after-free in ext4_xattr_set_entry() kernel: Use after free bug in r592_remove kernel: fbcon: shift-out-of-bounds in fbcon_set_font() kernel: gfs2: NULL pointer dereference in gfs2_evict_inode() kernel: out-of-bounds access in relay_file_read kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue overhead kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params() kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route kernel: smsusb: use-after-free caused by do_submit_urb() kernel: KVM: SEV-ES / SEV-SNP VMGEXIT double fetch vulnerability kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route kernel: Race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode BUG in include/linux/swapops.h Kernel: denial of service in atm_tc_enqueue in net/sched/sch_atm.c due to type confusion kernel: mpls: double free on sysctl allocation failure kernel: Denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow kernel: KVM: nVMX: missing consistency checks for CR0 and CR4 kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible kernel: out-of-bounds write in qfq_change_class function kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove() kernel: vmwgfx: race condition leading to information disclosure vulnerability kernel: vmwgfx: double free within the handling of vmw_buffer_object objects kernel: saa7134: race condition leading to use-after-free in saa7134_finidev() kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c() kernel: r592: race condition leading to use-after-free in r592_remove()
CVSS v3.1 score: 6.4
CVSS v3.0 score: 5.6