RHSA-2023:7077 Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c kernel: Rate limit overflow messages in r8152 in intr_callback kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c kernel: tun: avoid double free in tun_free_netdev kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c kernel: vmwgfx: use-after-free in vmw_cmd_res_check kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c kernel: KVM: x86/mmu: race condition in direct_page_fault() kernel: memory leak in ttusb_dec_exit_dvb() in media/usb/ttusb-dec/ttusb_dec.c kernel: memcg: fix possible use-after-free in memcg_write_event_control() kernel: char: tpm: Protect tpm_pm_suspend with locks kernel: ixgbevf: Fix resource leak in ixgbevf_init_module() kernel: mm/mempolicy: fix mpol_new leak in shared_policy_replace kernel: LSM: general protection fault in legacy_parse_param kernel: SUNRPC: Trap RDMA segment overflows kernel: mm/page_owner: use strscpy() instead of strlcpy() kernel: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags kernel: cipso: Fix data-races around sysctl. kernel: cgroup: Use separate src/dst nodes when preloading css_sets for migration kernel: tick/nohz: unexport __init-annotated tick_nohz_full_setup() kernel: device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() kernel: drm/amd/display: Fix optc2_configure warning on dcn314 kernel: drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() kernel: net: macvlan: fix memory leaks of macvlan_common_newlink kernel: tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header kernel: drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram() kernel: capabilities: fix potential memleak on error path from vfs_getxattr_alloc() kernel: ipv6: fix WARNING in ip6_route_net_exit_late() kernel: Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()" kernel: writeback: avoid use-after-free after removing device kernel: ice: xsk: prohibit usage of non-balanced queue id kernel: net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change() kernel: net: atlantic: fix aq_vec index out of range error kernel: kernfs: fix potential NULL dereference in __kernfs_remove kernel: usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() kernel: usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq kernel: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() kernel: drm/vkms: Fix memory leak in vkms_init() kernel: drm/radeon: Add the missed acpi_put_table() to fix memory leak kernel: wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() kernel: drm/i915/bios: fix a memory leak in generate_lfp_data_ptrs kernel: wifi: mac80211: fix memory leak in ieee80211_if_add() kernel: wifi: ath9k: verify the expected usb_endpoints are present kernel: drm/amdkfd: Fix double release compute pasid kernel: drm/bridge: megachips: Fix a null pointer dereference bug kernel: perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() kernel: nfsd: Fix a memory leak in an error handling path kernel: Linux kernel: NULL pointer dereference in drm/amdkfd leads to Denial of Service kernel: net: sched: sfb: fix null pointer access issue when sfb_init() fails kernel: Linux kernel: Local denial of service in skbuff due to improper network buffer handling kernel: drm/vkms: Fix null-ptr-deref in vkms_release() kernel: NFS: Fix an Oops in nfs_d_automount() kernel: nvme: fix multipath crash caused by flush request when blktrace is enabled kernel: tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak kernel: Linux kernel: Denial of Service and information disclosure via undefined bit shift in drm/ttm kernel: drm/amdgpu: SDMA update use unlocked iterator kernel: net: sched: fix memory leak in tcindex_set_parms kernel: net/tunnel: wait until all sk_user_data reader finish before releasing the sock kernel: iomap: iomap: fix memory corruption when recording errors during writeback kernel: drm: bridge: adv7511: unregister cec i2c device after cec adapter kernel: Linux kernel: Denial of Service in vmwgfx due to invalid DMA surface copies kernel: net: sched: cake: fix null pointer access issue when cake_init() fails kernel: mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2() kernel: xhci: Remove device endpoints from bandwidth list when freeing the device kernel: IB/mad: Don't call to function that might sleep while in atomic context kernel: cpufreq: Init completion before kobject_init_and_add() kernel: RDMA/core: Make sure "ib_port" is valid when access sysfs node kernel: drm/amd: fix potential memory leak kernel: drm/mipi-dsi: Detach devices when removing the host kernel: drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue() kernel: drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() kernel: drm/amdgpu: Fix size validation for non-exclusive domains (v4) kernel: drm/amdkfd: Fix memory leakage kernel: scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() kernel: drm/amd/display: Fix potential null-deref in dm_resume kernel: usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() kernel: tipc: fix a null-ptr-deref in tipc_topsrv_accept kernel: drm: Fix potential null-ptr-deref due to drmm_mode_config_init() kernel: tpm: acpi: Call acpi_put_table() to fix memory leak kernel: Linux kernel: Memory leak in __class_register() kernel: drm/amdgpu/powerplay/psm: Fix memory leak in power state init kernel: drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr() kernel: media: dvb-usb: fix memory leak in dvb_usb_adapter_init() kernel: wifi: ath11k: fix monitor mode bringup crash kernel: drm/gud: Fix UBSAN warning kernel: drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl() kernel: ipmi: fix use after free in _ipmi_destroy_user() kernel: selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() kernel: wifi: ath10k: Delay the unmapping of the buffer kernel: wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host kernel: Linux kernel: Denial of Service in ice driver via uninitialized transmit rings kernel: nvmet-tcp: add bounds check on Transfer Tag kernel: Linux kernel: Denial of Service due to PCI device reference count leak kernel: Linux kernel: Denial of Service in s390/lcs network driver due to incompatible function pointer type kernel: usb: idmouse: fix an uninit-value in idmouse_open kernel: wifi: mt76: do not run mt76u_status_worker if the device is not running kernel: Linux kernel: Denial of Service in ath9k Wi-Fi driver due to URB memory leak kernel: drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure kernel: Linux kernel: Resource exhaustion in amdgpu due to PCI device reference count leak kernel: fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL kernel: amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() kernel: wifi: fix potential NULL-ptr deref after clone kernel: Linux kernel xHCI DbC: Denial of Service via memory leak kernel: ipv6: ensure sane device mtu in tunnels kernel: udmabuf: Set ubuf->sg = NULL if the creation of sg table fails kernel: Linux kernel: Memory leak in RDMA restrack leads to Denial of Service kernel: tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak kernel: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() kernel: drm/virtio: Check whether transferred 2D BO is shmem kernel: drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback kernel: drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe kernel: NFSD: Finish converting the NFSv2 GETACL result encoder kernel: Linux kernel: Denial of service in lontium-lt9611 GPU driver due to NULL pointer dereference kernel: wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() kernel: media: uvcvideo: Fix memory leak in uvc_gpio_parse kernel: drm: Prevent drm_copy_field() to attempt copying a NULL pointer kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c kernel: use-after-free due to race condition in qdisc_graft() kernel: x86/mm: Randomize per-cpu entry area kernel: HID: check empty report_list in hid_validate_values() kernel: sctp: fail if no bound addresses can be used for a given scope kernel: net/tls: tls_is_tx_ready() checked list_entry kernel: hid: Use After Free in asus_remove() kernel: use-after-free in drivers/media/rc/ene_ir.c due to race condition kernel: hash collisions in the IPv6 connection lookup table kernel: ovl: fix use after free in struct ovl_aio_req kernel: denial of service in tipc_conn_close kernel: use-after-free bug in remove function xgene_hwmon_remove kernel: Use after free bug in btsdio_remove due to race condition kernel: Spectre v2 SMT mitigations problem kernel: A possible deadlock in dm_get_inactive_table in dm- ioctl.c leads to dos kernel: ext4: use-after-free in ext4_xattr_set_entry() kernel: Use after free bug in r592_remove kernel: fbcon: shift-out-of-bounds in fbcon_set_font() kernel: gfs2: NULL pointer dereference in gfs2_evict_inode() kernel: out-of-bounds access in relay_file_read kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue overhead kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params() kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route kernel: smsusb: use-after-free caused by do_submit_urb() kernel: KVM: SEV-ES / SEV-SNP VMGEXIT double fetch vulnerability kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route kernel: Race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode BUG in include/linux/swapops.h Kernel: denial of service in atm_tc_enqueue in net/sched/sch_atm.c due to type confusion kernel: mpls: double free on sysctl allocation failure kernel: Denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow kernel: KVM: nVMX: missing consistency checks for CR0 and CR4 kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible kernel: out-of-bounds write in qfq_change_class function kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove() kernel: vmwgfx: race condition leading to information disclosure vulnerability kernel: vmwgfx: double free within the handling of vmw_buffer_object objects kernel: saa7134: race condition leading to use-after-free in saa7134_finidev() kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c() kernel: r592: race condition leading to use-after-free in r592_remove() kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c kernel: drm/i915: Avoid potential vm use-after-free kernel: HV: hv_balloon: fix memory leak with using debugfs_lookup() kernel: usb: typec: ucsi: Don't attempt to resume the ports before they exist kernel: net: openvswitch: fix flow memory leak in ovs_flow_cmd_new kernel: drm/i915: Fix request ref counting during error capture & debugfs dump kernel: net: fix NULL pointer in skb_segment_list kernel: ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() kernel: drm/i915: Fix a memory leak with reused mmap_offset kernel: drm/amdkfd: Add sync after creating vram bo kernel: bnxt: Do not read past the end of test names kernel: ptdma: pt_core_execute_cmd() should use spinlock kernel: HID: betop: check shape of output reports kernel: net/sched: sch_taprio: fix possible use-after-free kernel: RDMA/core: Fix ib block iterator counter overflow kernel: Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()" kernel: drm/amdgpu: Fix call trace warning and hang when removing amdgpu device kernel: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function kernel: drm/amd/display: Do not set DRR on pipe Commit kernel: dm stats: check for and propagate alloc_percpu failure kernel: thunderbolt: Fix memory leak in margining kernel: dm crypt: add cond_resched() to dmcrypt_write() kernel: scsi: qla2xxx: Synchronize the IOCB count to be in order kernel: net/mlx5: E-Switch, Fix an Oops in error handling code kernel: igb: revert rtnl_lock() that causes deadlock kernel: wifi: mt76: do not run mt76_unregister_device() on unregistered hw kernel: drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes kernel: scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() kernel: net/mlx5: Fix steering rules cleanup kernel: drm/shmem-helper: Remove another errant put in error path kernel: drm/edid: fix info leak when failing to get panel id kernel: wifi: mt76: connac: do not check WED status for non-mmio devices kernel: drm/i915/active: Fix misuse of non-idle barriers as fence trackers kernel: drm/amdkfd: Fix an illegal memory access kernel: drm/ttm: Fix a NULL pointer dereference kernel: ice: xsk: disable txq irq before flushing hw kernel: net/mlx5e: Fix cleanup null-ptr deref on encap lock kernel: net/iucv: Fix size of interrupt data kernel: net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() kernel: drm/i915/sseu: fix max_subslices array-index-out-of-bounds access kernel: wifi: nl80211: fix NULL-ptr deref in offchan check kernel: scsi: mpi3mr: Fix config page DMA memory leak kernel: scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() kernel: scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove() kernel: scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() kernel: xfrm: add NULL check in xfrm_update_ae_params kernel: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes kernel: net: openvswitch: fix race on port output kernel: USB: uhci: fix memory leak with using debugfs_lookup() kernel: Linux kernel: Memory leak in driver core location can lead to denial of service kernel: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() kernel: wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta kernel: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data kernel: Linux kernel: Denial of Service via deadlock in net/smc kernel: nfsd: call op_release, even when op_func returns an error kernel: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts kernel: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels kernel: drm/client: Fix memory leak in drm_client_modeset_probe kernel: sctp: check send stream number after wait_for_sndbuf kernel: md/raid10: fix leak of 'r10bio->remaining' for recovery kernel: scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() kernel: USB: fix memory leak with using debugfs_lookup() kernel: sctp: fix a potential overflow in sctp_ifwdtsn_skip kernel: scsi: mpi3mr: Use number of bits to manage bitmap sizes kernel: drivers: base: dd: fix memory leak with using debugfs_lookup() kernel: mlx5: fix possible ptp queue fifo use-after-free kernel: Linux kernel: ALSA HDA denial of service via array overflow kernel: drivers: base: component: fix memory leak with using debugfs_lookup() kernel: USB: ULPI: fix memory leak with using debugfs_lookup() kernel: blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() kernel: wifi: iwlwifi: fw: fix memory leak in debugfs kernel: wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup kernel: Linux kernel: Denial of Service in scsi_ses due to enclosure with no components kernel: media: uvcvideo: Handle cameras with invalid descriptors kernel: mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak kernel: drm/radeon: free iio for atombios when driver shutdown kernel: wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit kernel: scsi: mpt3sas: Fix a memory leak kernel: Linux kernel: Denial of Service via malicious MTU negotiation in TIPC kernel: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() kernel: Linux kernel: Integer overflow in iwlwifi debugfs function kernel: wifi: ath11k: fix deinitialization of firmware resources kernel: HID: hyperv: avoid struct memcpy overrun warning kernel: Linux kernel iavf driver: Denial of Service via use-after-free vulnerability kernel: wifi: iwlwifi: mvm: fix potential array out of bounds access kernel: net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() kernel: wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds kernel: net/mlx5e: Fix deadlock in tc route query code kernel: driver core: fix resource leak in device_add() kernel: bus: mhi: host: Range check CHDBOFF and ERDBOFF kernel: wifi: ath11k: fix memory leak in WMI firmware stats kernel: drm: amd: display: Fix memory leakage kernel: ALSA: ymfpci: Fix BUG_ON in probe function kernel: md: fix soft lockup in status_resync kernel: net/sched: sch_fq: fix integer overflow of "credit" kernel: drm/i915/gvt: fix vgpu debugfs clean in remove kernel: wifi: ath6kl: reduce WARN to dev_dbg() in callback kernel: wifi: ath9k: hif_usb: fix memory leak of remain_skbs kernel: drm/i915/perf: add sentinel to xehp_oa_b_counters kernel: scsi: ses: Fix possible desc_ptr out-of-bounds accesses kernel: drm/i915: Fix memory leaks in i915 selftests kernel: drm/i915: Fix system suspend without fbdev being initialized kernel: wifi: mt7601u: fix an integer underflow kernel: wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read kernel: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() kernel: drm/amd/display: fix mapping to non-allocated address kernel: dmaengine: ptdma: check for null desc before calling pt_cmd_callback kernel: wifi: ath12k: Handle lock during peer_id find kernel: dm cache: free background tracker's queued work in btracker_destroy kernel: Linux kernel: Denial of Service via memory leak in ath12k Wi-Fi driver kernel: virt/coco/sev-guest: Double-buffer messages kernel: drm/amd/display: fix FCLK pstate change underflow kernel: dm flakey: fix a crash with invalid table line kernel: perf tool x86: Fix perf_env memory leak kernel: scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() kernel: drm/amdkfd: fix potential kgd_mem UAFs kernel: md/raid10: fix null-ptr-deref in raid10_sync_request kernel: drm/ttm: Don't leak a resource on swapout move error kernel: ASoC: soc-compress: Reposition and add pcm_mutex kernel: scsi: mpi3mr: Fix an issue found by KASAN kernel: net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device kernel: wifi: iwlwifi: fix iwl_mvm_max_amsdu_size() for MLO kernel: Linux kernel: Denial of Service due to memory leak in rtl8xxxu Wi-Fi driver kernel: Linux kernel: Denial of Service in ice driver via ethtool reload kernel: Linux kernel: Denial of Service due to incorrect FDIR filter fallback logic kernel: Linux kernel: Denial of Service in iwlwifi due to NULL pointer dereference kernel: Linux kernel: Memory leak in RDMA/irdma subsystem leads to Denial of Service kernel: wifi: rtw88: use work to update rate to avoid RCU warning kernel: Linux kernel: Denial of Service in mlx5e due to incorrect encap attribute handling kernel: Linux kernel: Denial of Service due to memory leak in drm_client_target_cloned function kernel: Kernel: NULL pointer dereference in Intel GVT-g debugfs during device removal kernel: scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow kernel: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests kernel: Kernel: Denial of Service due to memory leak in RAID10 functionality kernel: Linux kernel rt2x00 Wi-Fi driver: Denial of Service via memory leak during device removal kernel: drm/amdkfd: Fix kernel warning during topology setup kernel: Linux kernel: Memory leak in mt76 Wi-Fi driver leads to Denial of Service kernel: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl kernel: net/sched: flower: fix filter idr initialization kernel: net/mlx5e: TC, Fix using eswitch mapping in nic mode kernel: ASoC: SOF: avoid a NULL dereference with unsupported widgets kernel: scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization kernel: Linux kernel: Denial of Service in mlx5 driver due to memory leaks kernel: soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow kernel: net/mlx5e: Don't clone flow post action attributes second time kernel: ipv6: Fix an uninit variable access bug in __ip6_make_skb() kernel: media: usb: siano: Fix use after free bugs caused by do_submit_urb kernel: Linux kernel: Memory leak in ath11k Wi-Fi driver leads to Denial of Service kernel: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace kernel: md/raid10: fix memleak of md thread kernel: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx kernel: ALSA: ymfpci: Create card with device-managed snd_devm_card_new() kernel: dm flakey: don't corrupt the zero page kernel: driver core: fix potential null-ptr-deref in device_add() kernel: crypto: qat - fix out-of-bounds read kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline. kernel: drm/dp_mst: Fix resetting msg rx state after topology removal kernel: NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
CVSS v3.1 score: 4.7
CVSS v3.0 score: 5.6