RHSA-2022:8267 Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: off-path attacker may inject data or terminate victim's TCP session kernel: use-after-free vulnerability in function sco_sock_sendmsg() kernel: fix 'struct pid' leaks in 'dbgfs_target_ids_write()' kernel: veth: ensure skb entering GRO are not cloned. kernel: inet: fully convert sk->sk_rx_dst to RCU rules kernel: irqchip/gic-v3-its: Fix potential VPE leak on error kernel: nvme-rdma: destroy cm id before destroy qp to avoid use after free kernel: ptp: Fix possible memory leak in ptp_clock_register() kernel: ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce() kernel: net: nexthop: fix null pointer dereference when IPv6 is not enabled kernel: scsi: scsi_debug: Fix type in min_t to avoid stack OOB kernel: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU kernel: Revert "Revert "block, bfq: honor already-setup queue merges"" kernel: udmabuf: validate ubuf->pagecount kernel: drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() kernel: smb2_ioctl_query_info NULL pointer dereference kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback kernel: swiotlb information leak with DMA_FROM_DEVICE kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM kernel: race condition in snd_pcm_hw_free leading to use-after-free kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region kernel: use-after-free and memory errors in ext4 when mounting and operating on a corrupted image kernel: KVM: NULL pointer dereference in kvm_dirty_ring_push in virt/kvm/dirty_ring.c kernel: concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources kernel: kernel info leak issue in pfkey_register kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges kernel: NULL pointer dereference in x86_emulate_insn may lead to DoS kernel: fanotify misuses fd_install() which could lead to use-after-free kernel: KVM: NULL pointer dereference in kvm_irq_delivery_to_apic_fast() kernel: LoadPin bypass via dm-verity table reload kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() kernel: hv_netvsc: NULL pointer dereference in netvsc_get_ethtool_stats() kernel: drm/amdkfd: NULL pointer dereference in kfd_parse_subtype_iolink() kernel: media: em28xx: initialize refcount before kref_get kernel: net/packet: slab-out-of-bounds access in packet_recvmsg() kernel: missing DM_TARGET_IMMUTABLE feature flag in verity_target in drivers/md/dm-verity-target.c hw: cpu: incomplete clean-up of multi-core shared buffers (aka SBDR) hw: cpu: incomplete clean-up of microarchitectural fill buffers (aka SBDS) hw: cpu: incomplete clean-up in specific special register write operations (aka DRPW) kernel: possible to use the debugger to write zero into a location of choice hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions hw: cpu: AMD: Branch Type Confusion (non-retbleed) kernel: nfs_atomic_open() returns uninitialized data instead of ENOTDIR hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c hw: cpu: Intel: information disclosure via local access kernel: use after free in SUNRPC subsystem kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c kernel: nf_tables disallow binding to already bound chain kernel: netfilter: nfnetlink_osf: uninitialized variable information disclosure vulnerability kernel: ALSA: hda: Fix UAF of leds class devs at unbinding kernel: ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() kernel: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC kernel: vsock: remove vsock from connected table when connect is interrupted by a signal kernel: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts kernel: ibmvnic: free reset-work-item when flushing kernel: netfilter: fix use-after-free in __nf_register_net_hook() kernel: iwlwifi: mvm: check debugfs_dir ptr before use kernel: sched/fair: Fix fault in reweight_entity kernel: gso: do not skip outer ip header in case of ipip and net_failover kernel: KVM: x86/mmu: make apf token non-zero to fix bug kernel: block: null_blk: end timed out poll request kernel: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() kernel: veth: Ensure eth header is in skb's linear part kernel: net: openvswitch: fix leak of nested actions kernel: arch/arm64: Fix topology initialization for core scheduling kernel: skbuff: fix coalescing for page_pool fragment recycling kernel: Drivers: hv: vmbus: Fix potential crash on module unload kernel: ceph: fix memory leak in ceph_readdir when note_last_dentry returns error kernel: ceph: fix inode reference leakage in ceph_get_snapdir() kernel: dm ioctl: prevent potential spectre v1 gadget kernel: ath11k: Fix frames flush failure caused by deadlock kernel: mt76: mt7921: fix crash when startup fails. kernel: ath11k: mhi: use mhi_sync_power_up() kernel: net: preserve skb_end_offset() in skb_unclone_keeptruesize() kernel: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data kernel: block: Fix the maximum minor value is blk_alloc_ext_minor() kernel: XArray: Fix xas_create_range() when multi-order entry present kernel: wireguard: socket: free skb in send6 when ipv6 is disabled kernel: scsi: qla2xxx: Fix scheduling while atomic kernel: scsi: qla2xxx: Fix warning message due to adisc being flushed kernel: scsi: qla2xxx: Fix crash during module load unload test kernel: PM: core: keep irq flags in device_pm_check_callbacks() kernel: block, bfq: don't move oom_bfqq kernel: LSM: general protection fault in legacy_parse_param kernel: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region kernel: RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit() kernel: xsk: Fix race at socket teardown kernel: igc: avoid kernel warning when changing RX ring parameters kernel: bpf: Fix a btf decl_tag bug when tagging a function kernel: ptp: unregister virtual clocks when unregistering physical clock. kernel: ath9k_htc: fix uninit value bugs kernel: ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 kernel: media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED kernel: media: usb: go7007: s2250-board: fix leak in probe() kernel: block: don't delete queue kobject before its children kernel: brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path kernel: exec: Force single empty string when argv is empty kernel: PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove() kernel: ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM kernel: dm: fix use-after-free in dm_cleanup_zoned_dev() kernel: ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock kernel: cifs: fix handlecache and multiuser kernel: ALSA: pcm: Fix races among concurrent prealloc proc writes kernel: mac80211: fix potential double free on mesh join kernel: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls kernel: ALSA: oss: Fix PCM OSS buffer allocation overflow kernel: nbd: fix io hung while disconnecting device kernel: usb: dwc3: host: Stop setting the ACPI companion kernel: tcp: add accessors to read/set tp->snd_cwnd kernel: tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd kernel: scsi: lpfc: Address NULL pointer dereference after starget_to_rport() kernel: mm/huge_memory: Fix xarray node memory leak kernel: ip_gre: test csum_start instead of transport header kernel: ext4: avoid cycles in directory h-tree kernel: ext4: fix bug_on in ext4_writepages kernel: ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state kernel: ext4: fix use-after-free in ext4_rename_dir_prepare kernel: tipc: check attribute length for bearer name kernel: sfc: fix considering that all channels have TX queues kernel: usb: usbip: fix a refcount leak in stub_probe() kernel: blk-iolatency: Fix inflight count imbalances and IO hangs on offline kernel: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback kernel: RDMA/hfi1: Fix potential integer multiplication overflow errors kernel: ext4: fix memory leak in parse_apply_sb_mount_options() kernel: ext4: fix bug_on in __es_tree_search kernel: bfq: Make sure bfqg for which we are queueing requests is online kernel: bfq: Avoid merging queues with different parents kernel: bfq: Update cgroup information before merging bio kernel: NFSv4: Fix free of uninitialized nfs4_label on referral lookup. kernel: iommu/arm-smmu-v3-sva: Fix mm use-after-free kernel: RDMA/hfi1: Prevent use of lock before it is initialized kernel: powerpc/rtas: Keep MSR[RI] set when calling RTAS kernel: firmware: arm_scmi: Fix list protocols enumeration in the base protocol kernel: blk-throttle: Set BIO_THROTTLED when bio has been throttled kernel: scsi: lpfc: Inhibit aborts if external loopback plug is inserted kernel: ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t kernel: loop: implement ->free_disk kernel: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT kernel: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock kernel: scsi: lpfc: Fix call trace observed during I/O with CMF enabled kernel: ALSA: jack: Access input_dev under mutex kernel: ath11k: fix the warning of dev_wake in mhi_pm_disable_transition() kernel: ALSA: usb-audio: Cancel pending work at closing a MIDI substream kernel: x86/fpu: KVM: Set the base guest FPU uABI size to sizeof(struct kvm_xsave) kernel: KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2 kernel: netfilter: conntrack: re-fetch conntrack after insertion kernel: ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero kernel: igc: Reinstate IGC_REMOVED logic and implement it properly kernel: RDMA/irdma: Fix sleep from invalid context BUG kernel: ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error kernel: sfc: fix kernel panic when creating VF kernel: sfc: fix use after free when disabling sriov kernel: tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() kernel: tipc: move bc link creation back to tipc_node_create kernel: mptcp: fix race on unaccepted mptcp sockets kernel: RDMA/cm: Fix memory leak in ib_cm_insert_listen kernel: dm raid: fix KASAN warning in raid5_add_disks kernel: erspan: do not assume transport header is always set kernel: igb: fix a use-after-free issue in igb_clean_tx_ring kernel: bpf: Fix request_sock leak in sk lookup helpers kernel: netfilter: use get_random_u32 instead of prandom kernel: ext4: add reserved GDT blocks check kernel: ext4: fix bug_on ext4_mb_use_inode_pa kernel: dm mirror log: round up region bitmap size to BITS_PER_LONG kernel: sock: redo the psock vs ULP protection check kernel: netfilter: flowtable: fix stuck flows on cleanup due to pending work kernel: netfilter: nft_tproxy: restrict to prerouting hook kernel: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE kernel: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input kernel: netfilter: nf_tables: possible module reference underflow in error path kernel: dm raid: fix address sanitizer warning in raid_status kernel: dm raid: fix address sanitizer warning in raid_resume kernel: dm thin: fix use-after-free crash in dm_sm_register_threshold_callback kernel: posix-cpu-timers: Cleanup CPU timers before freeing them during exec kernel: ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes kernel: wifi: rtw89: 8852a: rfk: fix div 0 exception kernel: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb kernel: ath11k: fix netdev open race kernel: netfilter: nf_tables: do not allow CHAIN_ID to refer to another table kernel: netfilter: nf_tables: do not allow SET_ID to refer to another table kernel: drbd: only clone bio if we have a backing device kernel: bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data kernel: netfilter: NULL pointer dereference in nf_tables due to zeroed list head kernel: udmabuf: improper validation of array index leading to local privilege escalation kernel: vmxnet3: use-after-free in vmxnet3_rq_alloc_rx_buf() hw: Intel: Improper restriction in memory buffer in graphics drivers cause escalation of privilege kernel: dma-buf/dma-resv: Stop leaking on krealloc() failure kernel: bpf, cpumap: Handle skb as well when clean up ptr_ring
CVSS v3.1 score: 5.5