RHSA-2022:7683: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: off-path attacker may inject data or terminate victim's TCP session kernel: race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference kernel: use-after-free vulnerability in function sco_sock_sendmsg() kernel: memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c kernel: veth: ensure skb entering GRO are not cloned. kernel: inet: fully convert sk->sk_rx_dst to RCU rules kernel: NFSD: Fix READDIR buffer overflow kernel: nvme-rdma: destroy cm id before destroy qp to avoid use after free kernel: scsi: scsi_debug: Fix type in min_t to avoid stack OOB kernel: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU kernel: udmabuf: validate ubuf->pagecount kernel: drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() kernel: smb2_ioctl_query_info NULL pointer dereference kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback kernel: swiotlb information leak with DMA_FROM_DEVICE kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM kernel: race condition in snd_pcm_hw_free leading to use-after-free kernel: use-after-free in tc_new_tfilter() in net/sched/cls_api.c kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region kernel: use-after-free and memory errors in ext4 when mounting and operating on a corrupted image kernel: KVM: NULL pointer dereference in kvm_dirty_ring_push in virt/kvm/dirty_ring.c kernel: concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources kernel: NULL pointer dereference in x86_emulate_insn may lead to DoS kernel: buffer overflow in nft_set_desc_concat_parse() kernel: KVM: NULL pointer dereference in kvm_irq_delivery_to_apic_fast() kernel: LoadPin bypass via dm-verity table reload kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() kernel: use-after-free when psi trigger is destroyed while being polled kernel: hv_netvsc: NULL pointer dereference in netvsc_get_ethtool_stats() kernel: net/packet: slab-out-of-bounds access in packet_recvmsg() kernel: missing DM_TARGET_IMMUTABLE feature flag in verity_target in drivers/md/dm-verity-target.c kernel: possible to use the debugger to write zero into a location of choice hw: cpu: arm64: Spectre-BHB kernel: nfs_atomic_open() returns uninitialized data instead of ENOTDIR hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions kernel: memory leak in drivers/hid/hid-elo.c kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c kernel: use after free in SUNRPC subsystem kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c kernel: ALSA: hda: Fix UAF of leds class devs at unbinding kernel: ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() kernel: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC kernel: vsock: remove vsock from connected table when connect is interrupted by a signal kernel: netfilter: fix use-after-free in __nf_register_net_hook() kernel: thermal: core: Fix TZ_GET_TRIP NULL pointer dereference kernel: iwlwifi: mvm: check debugfs_dir ptr before use kernel: KVM: x86/mmu: make apf token non-zero to fix bug kernel: dm integrity: fix memory corruption when tag_size is less than digest size kernel: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() kernel: ice: arfs: fix use-after-free when freeing @rx_cpu_rmap kernel: veth: Ensure eth header is in skb's linear part kernel: net: openvswitch: fix leak of nested actions kernel: Drivers: hv: vmbus: Fix potential crash on module unload kernel: dm ioctl: prevent potential spectre v1 gadget kernel: ath11k: Fix frames flush failure caused by deadlock kernel: mt76: mt7921: fix crash when startup fails. kernel: ath11k: mhi: use mhi_sync_power_up() kernel: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data kernel: scsi: qla2xxx: Fix scheduling while atomic kernel: scsi: qla2xxx: Fix warning message due to adisc being flushed kernel: scsi: qla2xxx: Fix crash during module load unload test kernel: PM: core: keep irq flags in device_pm_check_callbacks() kernel: RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit() kernel: ath9k_htc: fix uninit value bugs kernel: ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 kernel: block: don't delete queue kobject before its children kernel: brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path kernel: PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove() kernel: ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM kernel: ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock kernel: ALSA: pcm: Fix races among concurrent prealloc proc writes kernel: mac80211: fix potential double free on mesh join kernel: ALSA: oss: Fix PCM OSS buffer allocation overflow kernel: ext4: avoid cycles in directory h-tree kernel: ext4: fix bug_on in ext4_writepages kernel: ext4: fix use-after-free in ext4_rename_dir_prepare kernel: tipc: check attribute length for bearer name kernel: sfc: fix considering that all channels have TX queues kernel: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback kernel: RDMA/hfi1: Fix potential integer multiplication overflow errors kernel: ext4: fix bug_on in __es_tree_search kernel: NFSv4: Fix free of uninitialized nfs4_label on referral lookup. kernel: iommu/arm-smmu-v3-sva: Fix mm use-after-free kernel: RDMA/hfi1: Prevent use of lock before it is initialized kernel: ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t kernel: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT kernel: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock kernel: scsi: lpfc: Fix call trace observed during I/O with CMF enabled kernel: ALSA: jack: Access input_dev under mutex kernel: cifs: fix potential double free during failed mount kernel: ath11k: fix the warning of dev_wake in mhi_pm_disable_transition() kernel: KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2 kernel: netfilter: conntrack: re-fetch conntrack after insertion kernel: ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero kernel: igc: Reinstate IGC_REMOVED logic and implement it properly kernel: RDMA/irdma: Fix sleep from invalid context BUG kernel: KVM: VMX: Prevent RSB underflow before vmenter kernel: x86/speculation: Fill RSB on vmexit for IBRS kernel: ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error kernel: ASoC: rt7*-sdw: harden jack_detect_handler kernel: sfc: fix kernel panic when creating VF kernel: sfc: fix use after free when disabling sriov kernel: tipc: move bc link creation back to tipc_node_create kernel: mptcp: fix race on unaccepted mptcp sockets kernel: RDMA/cm: Fix memory leak in ib_cm_insert_listen kernel: dm raid: fix KASAN warning in raid5_add_disks kernel: Linux kernel: Device Mapper RAID out-of-bounds access kernel: igb: fix a use-after-free issue in igb_clean_tx_ring kernel: bpf: Fix request_sock leak in sk lookup helpers kernel: netfilter: use get_random_u32 instead of prandom kernel: ext4: add reserved GDT blocks check kernel: ext4: fix bug_on ext4_mb_use_inode_pa kernel: dm mirror log: round up region bitmap size to BITS_PER_LONG kernel: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE kernel: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input kernel: iavf: Fix reset error handling kernel: iavf: Fix NULL pointer dereference in iavf_get_link_ksettings kernel: iavf: Fix adminq error handling kernel: BPF: Fix potential bad pointer dereference in bpf_sys_bpf() kernel: KVM: Unconditionally get a ref to /dev/kvm module when creating a VM kernel: dm raid: fix address sanitizer warning in raid_status kernel: dm raid: fix address sanitizer warning in raid_resume kernel: dm thin: fix use-after-free crash in dm_sm_register_threshold_callback kernel: watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource kernel: ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes kernel: rcutorture: Fix ksoftirqd boosting timing and iteration kernel: wifi: rtw89: 8852a: rfk: fix div 0 exception kernel: ath11k: fix netdev open race kernel: netfilter: nf_tables: do not allow SET_ID to refer to another table kernel: vmxnet3: use-after-free in vmxnet3_rq_alloc_rx_buf() kernel: dma-buf/dma-resv: Stop leaking on krealloc() failure
CVSS v3.1: 5.5