RHSA-2023:2951 Red Hat Security Advisory: kernel security, bug fix, and enhancement update
hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch kernel: malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory kernel: when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds kernel: mm/slub: actually fix freelist pointer vs redzoning kernel: net: stmmac: fix tc flower deletion for VLAN priority Rx steering kernel: possible race condition in drivers/tty/tty_buffers.c kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges kernel: KVM: NULL pointer dereference in kvm_mmu_invpcid_gva kernel: KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks kernel: netfilter: nf_conntrack_irc message handling issue kernel: race condition in xfrm_probe_algs can lead to OOB read/write kernel: media: em28xx: initialize refcount before kref_get kernel: race condition in hugetlb_no_page() in mm/hugetlb.c kernel: memory leak in ipv6_renew_options() kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt kernel: data races around sk->sk_prot kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c kernel: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry kernel: use-after-free after failed devlink reload in devlink_param_get kernel: USB-accessible buffer overflow in brcmfmac kernel: Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed kernel: l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference kernel: Recursive locking violation in usb-storage that can cause the kernel to deadlock kernel: igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets kernel: Executable Space Protection Bypass kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option kernel: xfrm_expand_policies() in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry kernel: TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning kernel: Report vmalloc UAF in dvb-core/dmxdev kernel: u8 overflow problem in cfg80211_update_notlisted_nontrans() kernel: use-after-free related to leaf anon_vma double reuse kernel: use-after-free in bss_ref_get in net/wireless/scan.c kernel: BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c kernel: Denial of service in beacon protection for P2P-device kernel: memory corruption in usbmon driver kernel: NULL pointer dereference in traffic control subsystem kernel: scsi: mpt3sas: Fix use-after-free warning kernel: regmap: spi: Reserve space for register address/padding kernel: ALSA: usb-audio: ALSA USB Audio Out-of-Bounds Bug kernel: net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent kernel: net/mlx5: Fix command stats access after free kernel: ASoC: soc-pcm: Add NULL check in BE reparenting kernel: hwmon: (coretemp) Check for null before removing sysfs attrs kernel: scsi: libfc: Fix use after free in fc_exch_abts_resp() kernel: drm/amd/display: Check if modulo is 0 before dividing. kernel: iommu/arm-smmu-v3: check return value after calling platform_get_resource() kernel: iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() kernel: mt76: fix use-after-free by removing a non-RCU wcid pointer kernel: tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd kernel: net/mlx5: E-Switch, pair only capable devices kernel: net: ipv6: unexport __init-annotated seg6_hmac_init() kernel: drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq() kernel: driver core: fix deadlock in __device_attach kernel: tcp: tcp_rtx_synack() can be called from process context kernel: scsi: sd: Fix potential NULL pointer dereference kernel: wifi: mac80211: fix use-after-free in chanctx code kernel: RDMA/hfi1: Prevent panic when SDMA is disabled kernel: rtw89: cfo: check mac_id to avoid out-of-bounds kernel: fbdev: defio: fix the pagelist corruption kernel: cpufreq: governor: Use kobject release() method to free dbs_data kernel: Linux kernel (ath10k): Double free vulnerability during suspend/resume kernel: rtw89: ser: fix CAM leaks occurring in L2 reset kernel: ALSA: usb-audio: Cancel pending work at closing a MIDI substream kernel: udp: Fix a data-race around sysctl_udp_l3mdev_accept. kernel: iavf: Fix handling of dummy receive descriptors kernel: net: stmmac: fix dma queue left shift overflow issue kernel: vlan: fix memory leak in vlan_newlink() kernel: net: stmmac: dwc-qos: Disable split header for Tegra194 kernel: drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() kernel: wifi: mac80211: fix queue selection for mesh/OCB interfaces kernel: i2c: piix4: Fix a memory leak in the EFCH MMIO support kernel: tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() kernel: erspan: do not assume transport header is always set kernel: drm/i915/reset: Fix error_state_read ptr + offset use kernel: clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() kernel: sock: redo the psock vs ULP protection check kernel: net: gso: fix panic on frag_list with mixed head alloc types kernel: Bluetooth: L2CAP: Fix memory leak in vhci_write kernel: RDMA/core: Fix null-ptr-deref in ib_core_cleanup() kernel: wifi: mac80211: Fix UAF in ieee80211_scan_rx() kernel: dma-buf/dma-resv: check if the new fence is really later kernel: USB: core: Prevent nested device-reset calls kernel: wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected kernel: firmware_loader: Fix use-after-free during unregister kernel: net/sched: fix netdevice reference leaks in attach_default_qdiscs() kernel: openvswitch: fix memory leak at failed datapath creation kernel: drm/i915: fix null pointer dereference kernel: xhci: Fix null pointer dereference in remove if xHC has only one roothub kernel: arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level kernel: drm/amd/pm: add missing ->fini_xxxx interfaces for some SMU13 asics kernel: drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid kernel: drm/amd/display: clear optc underflow before turn off odm clock kernel: drm/amd/pm: Fix a potential gpu_metrics_table memory leak kernel: media: pvrusb2: fix memory leak in pvr_probe kernel: udmabuf: Set the DMA mask for the udmabuf device (v2) kernel: scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq kernel: netfilter: flowtable: fix stuck flows on cleanup due to pending work kernel: netfilter: nft_tproxy: restrict to prerouting hook kernel: net/mlx5: LAG, fix logic over MLX5_LAG_FLAG_NDEVS_READY kernel: xfrm: fix refcount leak in __xfrm_policy_check() kernel: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot kernel: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot kernel: drivers:md:fix a potential use-after-free bug kernel: drm/amdgpu: Fix use-after-free on amdgpu_bo_list mutex kernel: drm/i915/ttm: don't leak the ccs state kernel: stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove() kernel: ice: Fix call trace with null VSI during VF reset kernel: net: qrtr: start MHI channel after endpoit creation kernel: netfilter: nf_tables: possible module reference underflow in error path kernel: ASoC: DPCM: Don't pick up BE without substream kernel: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() kernel: ASoC: Intel: avs: Fix potential buffer overflow by snprintf() kernel: drm/ttm: Fix dummy res NULL ptr deref bug kernel: mptcp: do not queue data on closed subflows kernel: drm/amd/display: Check correct bounds for stream encoder instances for DCN303 kernel: iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) kernel: sched/core: Do not requeue task on CPU excluded from cpus_mask kernel: ASoC: mt6359: Fix refcount leak bug kernel: ASoc: audio-graph-card2: Fix refcount leak bug in __graph_get_type() kernel: RDMA/rxe: Fix error unwind in rxe_create_qp() kernel: RDMA/srpt: Fix a use-after-free kernel: staging: fbtft: core: set smem_len before fb_deferred_io_init call kernel: usb: xhci_plat_remove: avoid NULL dereference kernel: RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup kernel: RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event kernel: RDMA/irdma: Fix a window for use-after-free kernel: RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() kernel: driver core: fix potential deadlock in __driver_attach kernel: wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue kernel: mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg kernel: virtio-gpu: fix a missing check to avoid NULL dereference kernel: drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() kernel: tools/power turbostat: Fix file pointer leak kernel: md-raid10: fix KASAN warning kernel: drm/fb-helper: Fix out-of-bounds access kernel: crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak kernel: ALSA: bcd2000: Fix a UAF bug on the error path of probing kernel: NFSD: Protect against send buffer overflow in NFSv2 READDIR kernel: sctp: handle the error returned from sctp_auth_asoc_init_active_key kernel: Linux kernel: Denial of Service due to memory allocation failure in vhost/vsock kernel: md: Replace snprintf with scnprintf kernel: ASoC: qcom: Add checks for devm_kcalloc kernel: perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() kernel: ASoC: Intel: avs: Fix potential RX buffer overflow kernel: scsi: target: iscsi: Fix a race condition between login_work and the login thread kernel: md: fix a crash in mempool_free kernel: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() kernel: NFSD: Protect against send buffer overflow in NFSv2 READ kernel: wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register() kernel: x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly kernel: ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() kernel: ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() kernel: scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID kernel: iommu/vt-d: Clean up si_domain in the init_dmars() error path kernel: ALSA: usb-audio: Fix potential memory leaks kernel: NFSD: Protect against send buffer overflow in NFSv3 READDIR kernel: scsi: qla2xxx: Fix crash when I/O abort times out kernel: dm cache: Fix UAF in destroy() kernel: fs: dlm: fix invalid derefence of sb_lvbptr kernel: Linux kernel (TIPC): Information disclosure via uninitialized memory in tipc_topsrv_kern_subscr kernel: dm thin: Use last transaction's pmd->root when commit failed kernel: RDMA/rxe: Fix mr->map double free kernel: dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata kernel: blk-mq: avoid double ->queue_rq() because of early timeout kernel: dm thin: Fix UAF in run_timer_softirq() kernel: xfrm: Update ipcomp_scratches with NULL when freed kernel: md/raid0, raid10: Don't set discard sectors for request queue kernel: perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() kernel: RDMA/rxe: Fix "kernel NULL pointer dereference" error kernel: wifi: brcmfmac: fix invalid address access when enabling SCAN log level kernel: ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() kernel: Linux kernel: Denial of Service in mt7921e driver during module unload kernel: md/raid1: stop mdx_raid1 thread when raid1 array run failed kernel: Kernel: Denial of Service via memory leak in bnxt_nvm_test() kernel: net/mlx5: Fix possible use-after-free in async command interface kernel: Linux kernel: Hard lockup in lpfc driver leads to Denial of Service kernel: md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() kernel: scsi: smartpqi: Correct device removal for multi-actuator devices kernel: Linux kernel ALSA mts64 module: Denial of Service via null pointer dereference kernel: Kernel: Denial of Service via memory leak in wifi power saving mode kernel: ASoC: pxa: fix null-pointer dereference in filter() kernel: dm integrity: Fix UAF in dm_integrity_dtr() kernel: NULL pointer dereference in rawv6_push_pending_frames kernel: net/ulp: use-after-free in listening ULP sockets kernel: netfilter: NULL pointer dereference in nf_tables due to zeroed list head kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c kernel: Soft lockup occurred during __page_mapcount Kernel: NULL pointer dereference problem in sctp_sched_dequeue_common kernel: drm/virtio: improper return value check in virtio_gpu_object_shmem_init() kernel: slab-out-of-bounds read vulnerabilities in cbq_classify kernel: iavf: fix hang on reboot with ice kernel: Drivers: vmbus: Check for channel allocation before looking up relids kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device kernel: netfilter: ipset: Rework long task execution when adding/deleting entries kernel: drm/i915: mark requests for GuC virtual engines to avoid use-after-free kernel: RDMA/irdma: Cap MSIX used to online CPUs + 1
CVSS v3.1 score: 4.4