title: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
description: kernel: off-path attacker may inject data or terminate victim's TCP session kernel: use-after-free vulnerability in function sco_sock_sendmsg() kernel: veth: ensure skb entering GRO are not cloned. kernel: inet: fully convert sk->sk_rx_dst to RCU rules kernel: irqchip/gic-v3-its: Fix potential VPE leak on error kernel: ptp: Fix possible memory leak in ptp_clock_register() kernel: ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce() kernel: net: nexthop: fix null pointer dereference when IPv6 is not enabled kernel: scsi: scsi_debug: Fix type in min_t to avoid stack OOB kernel: drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() kernel: smb2_ioctl_query_info NULL pointer dereference kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback kernel: swiotlb information leak with DMA_FROM_DEVICE kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM kernel: race condition in snd_pcm_hw_free leading to use-after-free kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region kernel: use-after-free and memory errors in ext4 when mounting and operating on a corrupted image kernel: KVM: NULL pointer dereference in kvm_dirty_ring_push in virt/kvm/dirty_ring.c kernel: concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources kernel: kernel info leak issue in pfkey_register kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges kernel: NULL pointer dereference in x86_emulate_insn may lead to DoS kernel: fanotify misuses fd_install() which could lead to use-after-free kernel: KVM: NULL pointer dereference in kvm_irq_delivery_to_apic_fast() kernel: LoadPin bypass via dm-verity table reload kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() kernel: hv_netvsc: NULL pointer dereference in netvsc_get_ethtool_stats() kernel: drm/amdkfd: NULL pointer dereference in kfd_parse_subtype_iolink() kernel: media: em28xx: initialize refcount before kref_get kernel: net/packet: slab-out-of-bounds access in packet_recvmsg() kernel: missing DM_TARGET_IMMUTABLE feature flag in verity_target in drivers/md/dm-verity-target.c hw: cpu: incomplete clean-up of multi-core shared buffers (aka SBDR) hw: cpu: incomplete clean-up of microarchitectural fill buffers (aka SBDS) hw: cpu: incomplete clean-up in specific special register write operations (aka DRPW) kernel: possible to use the debugger to write zero into a location of choice hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions hw: cpu: AMD: Branch Type Confusion (non-retbleed) kernel: nfs_atomic_open() returns uninitialized data instead of ENOTDIR hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c hw: cpu: Intel: information disclosure via local access kernel: use after free in SUNRPC subsystem kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c kernel: nf_tables disallow binding to already bound chain kernel: netfilter: nfnetlink_osf: uninitialized variable information disclosure vulnerability kernel: ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() kernel: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC kernel: vsock: remove vsock from connected table when connect is interrupted by a signal kernel: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts kernel: ibmvnic: free reset-work-item when flushing kernel: netfilter: fix use-after-free in __nf_register_net_hook() kernel: iwlwifi: mvm: check debugfs_dir ptr before use kernel: sched/fair: Fix fault in reweight_entity kernel: gso: do not skip outer ip header in case of ipip and net_failover kernel: KVM: x86/mmu: make apf token non-zero to fix bug kernel: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() kernel: skbuff: fix coalescing for page_pool fragment recycling kernel: ceph: fix memory leak in ceph_readdir when note_last_dentry returns error kernel: ath11k: Fix frames flush failure caused by deadlock kernel: ath11k: mhi: use mhi_sync_power_up() kernel: XArray: Fix xas_create_range() when multi-order entry present kernel: wireguard: socket: free skb in send6 when ipv6 is disabled kernel: RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit() kernel: xsk: Fix race at socket teardown kernel: ath9k_htc: fix uninit value bugs kernel: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls kernel: scsi: lpfc: Address NULL pointer dereference after starget_to_rport() kernel: mm/huge_memory: Fix xarray node memory leak kernel: firmware: arm_scmi: Fix list protocols enumeration in the base protocol kernel: loop: implement ->free_disk kernel: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT kernel: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock kernel: ALSA: jack: Access input_dev under mutex kernel: ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error kernel: tipc: move bc link creation back to tipc_node_create kernel: RDMA/cm: Fix memory leak in ib_cm_insert_listen kernel: igb: fix a use-after-free issue in igb_clean_tx_ring kernel: netfilter: use get_random_u32 instead of prandom kernel: ext4: add reserved GDT blocks check kernel: netfilter: NULL pointer dereference in nf_tables due to zeroed list head kernel: udmabuf: improper validation of array index leading to local privilege escalation kernel: vmxnet3: use-after-free in vmxnet3_rq_alloc_rx_buf() hw: Intel: Improper restriction in memory buffer in graphics drivers cause escalation of privilege
cpes: cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb cpe:/o:redhat:enterprise_linux:9::baseos