RHSA-2024:7000 Red Hat Security Advisory: kernel security update
kernel: kyber: fix out of bounds access when preempted kernel: Input: elantech - fix stack out of bound access in elantech_change_report_id() kernel: asix: fix uninit-value in asix_mdio_read() kernel: driver core: auxiliary bus: Fix memory leak when driver_register() fail kernel: ACPI: fix NULL pointer dereference kernel: watchdog: Fix possible use-after-free by calling del_timer_sync() kernel: fbmem: Do not delete the mode that is still in use kernel: virtio-net: Add validation for used length kernel: tty: Fix out-of-bound vmalloc access in imageblit kernel: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field kernel: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field kernel: hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field kernel: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs kernel: block: don't call rq_qos_ops->done_bio if the bio isn't tracked kernel: lib/generic-radix-tree.c: Don't overflow in peek() kernel: mlxsw: thermal: Fix out-of-bounds memory accesses kernel: ptp: Fix possible memory leak in ptp_clock_register() kernel: mm, slub: fix potential memoryleak in kmem_cache_open() kernel: nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells kernel: serial: core: fix transmit-buffer reset and memleak kernel: mlxsw: spectrum: Protect driver from buggy firmware kernel: USB: core: Make do_proc_control() and do_proc_bulk() killable kernel: firmware: arm_scpi: Fix string overflow in SCPI genpd driver kernel: event code falling outside of a bitmap in input_set_capability() leads to panic kernel: phylib: fix potential use-after-free kernel: USB: core: Fix hang in usb_kill_urb by adding memory barriers kernel: vt_ioctl: fix array_index_nospec in vt_setactivate kernel: Input: aiptek - properly check endpoint type kernel: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts kernel: net: asix: add proper error handling of usb read errors kernel: NFSv4: Don't hold the layoutget locks across multiple RPC calls kernel: NFSv4/pnfs: Fix a use-after-free bug in open kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() kernel: null-ptr-deref in alloc_workqueue kernel: perf/x86/lbr: Filter vsyscall addresses kernel: HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect kernel: net: fix possible store tearing in neigh_periodic_work() kernel: ACPI: extlog: fix NULL pointer dereference check kernel: ACPI: LPIT: Avoid u32 multiplication overflow kernel: wifi: ath11k: fix dfs radar event locking kernel: wifi: ath11k: fix htt pktlog locking kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() kernel: drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL kernel: Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() kernel: usb-storage: alauda: Fix uninit-value in alauda_check_media() kernel: SUNRPC: double free xprt_ctxt while still in use kernel: use-after-free in cec_queue_msg_fh kernel: mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path kernel: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP kernel: nbd: always initialize struct msghdr completely kernel: tracing: Ensure visibility when inserting an element into tracing_map kernel: null pointer when load rlc firmware kernel: tunnels: fix out of bounds access when building IPv6 PMTU error kernel: HID: i2c-hid-of: fix NULL-deref on failed power up kernel: mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again kernel: nvmet-fc: avoid deadlock on delete association path kernel: nvme-fc: do not wait in vain when unloading module kernel: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() kernel: dm: call the resume method on internal suspend kernel: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() kernel: af_unix: Fix garbage collector racing against connect() kernel: drm/i915/vma: Fix UAF on destroy against retire race kernel: tun: limit printing rate when illegal packet received by tun dev kernel: drm/amdgpu: Fix potential out-of-bounds access in &#39;amdgpu_discovery_reg_base_init()&#39; kernel: PCI/PM: Drain runtime-idle callbacks before driver removal kernel: x86/mm/pat: fix VM_PAT handling in COW mappings kernel: udp: do not accept non-tunnel GSO skbs landing in a tunnel kernel: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() kernel: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms kernel: net: fix out-of-bounds access in ops_init kernel: ipv6: prevent NULL dereference in ip6_output() kernel: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() kernel: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload kernel: scsi: mpi3mr: Avoid memcpy field-spanning write WARNING kernel: wifi: iwlwifi: read txq-&gt;read_ptr under lock kernel: nfs: Handle error of rpc_proc_register() in nfs_net_init(). kernel: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() kernel: tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). kernel: net: openvswitch: fix overwriting ct original tuple for ICMPv6 kernel: scsi: qedf: Ensure the copied buf is NUL terminated kernel: gfs2: Fix potential glock use-after-free on unmount kernel: crypto: bcm - Fix pointer arithmetic kernel: drm/amdgpu/mes: fix use-after-free issue kernel: usb-storage: alauda: Check whether the media is initialized kernel: drm/amdgpu: add error handle to avoid out-of-bounds kernel: vmci: prevent speculation leaks by sanitizing event in event_deliver() kernel: drivers: core: synchronize really_probe() and dev_uevent() kernel: liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet kernel: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages kernel: wifi: cfg80211: Lock wiphy in cfg80211_get_station kernel: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() kernel: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids kernel: mptcp: ensure snd_una is properly initialized on connect kernel: wifi: iwlwifi: mvm: don&#39;t read past the mfuart notifcation kernel: net: do not leave a dangling sk pointer, when socket creation fails kernel: netns: Make get_net_ns() handle zero refcount net kernel: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() kernel: ipv6: prevent possible NULL dereference in rt6_probe() kernel: ext4: do not create EA inode under buffer lock kernel: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery kernel: scsi: qedi: Fix crash while reading debugfs attribute kernel: drm/radeon: fix UBSAN warning in kv_dpm.c kernel: KVM: arm64: Disassociate vcpus from redistributor region on teardown kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() kernel: cpufreq: amd-pstate: fix memory leak on CPU EPP exit kernel: ext4: fix uninitialized ratelimit_state-&gt;lock access in __ext4_fill_super() kernel: netpoll: Fix race condition in netpoll_owner_active kernel: tcp: avoid too many retransmit packets kernel: drm/amdgpu: change vm-&gt;task_info handling kernel: filelock: Remove locks reliably when fcntl/close race is detected kernel: xfs: don&#39;t walk off the end of a directory data block kernel: xfs: add bounds checking to xlog_recover_process_data kernel: sched/deadline: Fix task_struct reference leak kernel: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers kernel: firmware: cs_dsp: Fix overflow checking of wmfw header kernel: net/sched: Fix UAF when resolving a clash kernel: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() kernel: ppp: reject claimed-as-LCP but actually malformed packets kernel: mm: prevent derefencing NULL ptr in pfn_section_valid() kernel: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files kernel: drm/radeon: check bo_va-&gt;bo is non-NULL before using it kernel: powerpc/eeh: avoid possible crash when edev-&gt;pdev changes kernel: powerpc/pseries: Whitelist dtl slub object for copying to userspace kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing kernel: NFSv4: Fix memory leak in nfs4_set_security_label kernel: virtio-net: tap: mlx5_core short frame denial of service kernel: virtio-net: tun: mlx5_core short frame denial of service kernel: usb: atm: cxacru: fix endpoint checking in cxacru_bind() kernel: ftruncate: pass a signed offset kernel: pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER kernel: net/iucv: Avoid explicit cpumask var allocation on stack kernel: x86: stop playing stack games in profile_pc() kernel: wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values kernel: scsi: qedf: Make qedf_execute_tmf() non-preemptible kernel: mm: avoid overflows in dirty throttling logic kernel: nvmet: fix a possible leak when destroy a ctrl during qp establishment kernel: tcp_metrics: validate source addr length kernel: wifi: mt76: replace skb_put with skb_put_zero kernel: usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB kernel: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc kernel: firmware: cs_dsp: Validate payload length before processing block kernel: firmware: cs_dsp: Return error if block header overflows file kernel: x86/bhi: Avoid warning in #DB handler due to BHI mitigation kernel: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket kernel: protect the fetch of -&gt;fd[fd] in do_dup2() from mispredictions kernel: ipvs: properly dereference pe in ip_vs_add_service kernel: leds: trigger: Unregister sysfs attributes before calling deactivate() kernel: devres: Fix memory leakage caused by driver API devm_free_percpu() kernel: s390/dasd: fix error recovery leading to data corruption on ESE devices
CVSS v3.1 score: 6.7