RHSA-2024:5101: Red Hat Security Advisory: kernel security update
kernel: tracing: Restructure trace_clock_global() to never block kernel: ensure definition of the fixmap area is in a limit kernel: net: ieee802154: fix null deref in parse dev addr kernel: isdn: mISDN: netjet: Fix crash in nj_probe kernel: tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized kernel: irqchip/gic-v3-its: Fix potential VPE leak on error kernel: netfilter: conntrack: serialize hash resizes and cleanups kernel: userfaultfd: fix a race between writeprotect and exit_mmap() kernel: isdn: mISDN: Fix sleeping function called from invalid context kernel: mm: khugepaged: skip huge page collapse for special files kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() kernel: ovl: fix warning in ovl_create_real() kernel: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change kernel: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() kernel: net: amd-xgbe: Fix skb data length underflow kernel: block: Fix wrong offset in bio_truncate() kernel: net: fix information leakage in /proc/net/ptype kernel: cifs: Fix memory leak when build ntlmssp negotiate blob failed kernel: x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() kernel: Local information disclosure on Intel(R) Atom(R) processors kernel: powerpc: Fix access beyond end of drmem array kernel: efivarfs: force RO when remounting if SetVariable is not supported kernel: use-after-free in kv_parse_power_table kernel: null pointer dereference issues in ice_ptp.c kernel: drm: Don't unref the same fb many times by mistake due to deadlock handling kernel: wifi: mac80211: fix potential key use-after-free kernel: pstore/ram: Fix crash when setting number of cpus to an odd number kernel: ext4: avoid online resizing failures due to oversized flex bg kernel: SUNRPC: Fix a suspicious RCU usage warning kernel: drm/vmwgfx: Unmap the surface before resetting it on a plane state kernel: SUNRPC: fix a memleak in gss_import_v2_context kernel: Revert &#34;net/mlx5: Block entering switchdev mode with ns inconsistency&#34; kernel: drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node kernel: of: Fix double free in of_parse_phandle_with_args_map kernel: sched/psi: Fix use-after-free in ep_remove_wait_queue() kernel: mmc: sdio: fix possible resource leaks in some error paths kernel: pwm: Fix double shift bug kernel: virtio-blk: fix implicit overflow on virtio_max_dma_size kernel: media: gspca: cpia1: shift-out-of-bounds in set_flicker kernel: net/smc: avoid data corruption caused by decline kernel: wifi: ath11k: fix gtk offload status event locking kernel: bonding: stop the device in bond_setup_by_slave() kernel: i2c: core: Run atomic i2c xfer when !preemptible kernel: ipvlan: add ipvlan_route_v6_outbound() helper kernel: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries kernel: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool kernel: wifi: mac80211: don&#39;t return unset power in ieee80211_get_tx_power() kernel: atl1c: Work around the DMA RX overflow issue kernel: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING kernel: media: bttv: fix use after free error due to btv->timeout timer kernel: platform/x86: wmi: Fix opening of char device kernel: cifs: fix mid leak during reconnection after timeout threshold kernel: Linux kernel: Denial of Service due to incorrect network packet processing in NSH module hw: cpu: intel: Native Branch History Injection (BHI) kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application kernel: crash due to a missing check for leb_size kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption kernel: tcp: make sure init the accept_queue&#39;s spinlocks once kernel: tcp: add sanity checks to rx zerocopy kernel: drm/amd/display: Implement bounds check for stream encoder creation in DCN301 kernel: net/sched: flower: Fix chain template offload kernel: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats kernel: hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove kernel: ext4: fix double-free of blocks due to wrong extents moved_len kernel: arp: Prevent overflow in arp_req_get(). kernel: net/sched: act_mirred: use the backlog for mirred ingress kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() kernel: stmmac: Clear variable when destroying workqueue kernel: vfio/pci: Lock external INTx masking ops kernel: net: bridge: switchdev: Skip MDB replays of deferred events on offload kernel: cachefiles: fix memory leak in cachefiles_add_cache() kernel: efi: runtime: Fix potential overflow of soft-reserved region size kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() kernel: igc: avoid returning frame twice in XDP_REDIRECT kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 kernel: quota: Fix potential NULL pointer dereference kernel: inet: inet_defrag: prevent sk release while still in use kernel: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path kernel: scsi: qla2xxx: Fix double free of fcport kernel: scsi: qla2xxx: Fix command flush on cable pull kernel: drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed kernel: nfs: fix UAF in direct writes kernel: mm: swap: fix race between free_swap_and_cache() and swapoff() kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del kernel: net/sched: Fix mirred deadlock on device recursion kernel: netfilter: nf_tables: fix memleak in map from abort path kernel: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() kernel: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() kernel: nbd: null check for nla_nest_start kernel: netfilter: nf_tables: do not compare internal table flags on updates kernel: SUNRPC: fix some memleaks in gssx_dec_option_array kernel: net: openvswitch: Fix Use-After-Free in ovs_ct_exit kernel: wifi: iwlwifi: mvm: don&#39;t set the MFP flag for the GTK kernel: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline kernel: ipvlan: Dont Use skb-&gt;sk in ipvlan_process_v{4,6}_outbound kernel: usb: typec: altmodes/displayport: create sysfs nodes as driver&#39;s default device attribute group kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD kernel: ext4: fix corruption during on-line resize kernel: drm/vmwgfx: Fix the lifetime of the bo cursor memory kernel: swiotlb: Fix double-allocation of slots due to broken alignment handling kernel: vt: fix unicode buffer corruption when deleting characters kernel: misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume kernel: irqchip/gic-v3-its: Prevent double free on error kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() kernel: net/sched: act_skbmod: prevent kernel-infoleak kernel: netfilter: validate user input for expected length kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion kernel: netfilter: nf_tables: flush pending destroy work before exit_net release kernel: netfilter: nf_tables: reject new basechain after table flag update kernel: tcp: properly terminate timers for kernel sockets kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks kernel: usb: typec: ucsi: Limit read size on v1.2 kernel: block: prevent division by zero in blk_rq_stat_sum() kernel: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() kernel: wifi: cfg80211: check A-MSDU format more carefully kernel: wifi: ath11k: decrease MHI channel buffer length to 8KB kernel: wifi: rtw89: fix null pointer access when abort scan kernel: dyndbg: fix old BUG_ON in &gt;control parser kernel: drm/ast: Fix soft lockup kernel: netfilter: complete validation of user input kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage kernel: igb: Fix string truncation warnings in igb_set_fw_version kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() kernel: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation kernel: i40e: fix vf may be used uninitialized in this function warning kernel: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() kernel: netfilter: tproxy: bail out if IP has been disabled on the device kernel: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() kernel: tls: fix missing memory barrier in tls_init kernel: TIPC message reassembly use-after-free remote code execution vulnerability kernel: mptcp: ensure snd_nxt is properly initialized on connect kernel: USB: core: Fix access violation during port device removal kernel: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). kernel: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets kernel: block: fix overflow in blk_ioctl_discard() kernel: wifi: iwlwifi: mvm: guard against invalid STA ID on removal kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() kernel: ipv4: Fix uninit-value access in __ip_make_skb() kernel: s390/qeth: Fix kernel panic after setting hsuid kernel: net: core: reject skb_copy(_expand) for fraglist GSO skbs kernel: nsh: Restore skb-&gt;{protocol,data,mac_header} for outer header in nsh_gso_segment(). kernel: pinctrl: core: delete incorrect free in pinctrl_enable() kernel: wifi: nl80211: don&#39;t free NULL coalescing rule kernel: net/smc: fix neighbour and rtable leak in smc_ib_find_route() kernel: firewire: ohci: mask bus reset interrupts between ISR and bottom half kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up kernel: tipc: fix a possible memleak in tipc_buf_append kernel: drm/vmwgfx: Fix invalid reads in fence signaled events kernel: net: kernel: UAF in network route management kernel: net: sched: sch_multiq: fix possible OOB write in multiq_tune() kernel: net: bridge: mst: fix vlan use-after-free kernel: net: bridge: xmit: make sure we have at least eth header len bytes kernel: net/mlx5: Discard command completions in internal error kernel: cppc_cpufreq: Fix possible null pointer dereference kernel: wifi: brcmfmac: pcie: handle randbuf allocation failure kernel: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg kernel: md: fix resync softlockup when bitmap size is less than array size kernel: cpufreq: exit() callback is optional kernel: stm class: Fix a double free in stm_register_device() kernel: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup kernel: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING kernel: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() kernel: ionic: fix use after netif_napi_del() kernel: xhci: Handle TD clearing for multiple streams case kernel: powerpc/pseries: Enforce hcall result buffer validity and size
CVSS v3.1: 6.6