title: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
description: hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch kernel: ext4: kernel bug in ext4_write_inline_data_end() kernel: malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory kernel: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs kernel: mlxsw: thermal: Fix out-of-bounds memory accesses kernel: mlxsw: spectrum: Protect driver from buggy firmware kernel: net: stmmac: fix tc flower deletion for VLAN priority Rx steering kernel: possible race condition in drivers/tty/tty_buffers.c kernel: KVM: NULL pointer dereference in kvm_mmu_invpcid_gva kernel: use-after-free in free_pipe_info() could lead to privilege escalation kernel: KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks kernel: netfilter: nf_conntrack_irc message handling issue kernel: race condition in xfrm_probe_algs can lead to OOB read/write kernel: out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c kernel: race condition in hugetlb_no_page() in mm/hugetlb.c kernel: memory leak in ipv6_renew_options() kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt kernel: data races around sk->sk_prot kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c kernel: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry kernel: use-after-free after failed devlink reload in devlink_param_get kernel: USB-accessible buffer overflow in brcmfmac kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c kernel: Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed kernel: mptcp: NULL pointer dereference in subflow traversal at disconnect time kernel: l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference kernel: Recursive locking violation in usb-storage that can cause the kernel to deadlock kernel: igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets kernel: lockdown bypass using IMA kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c kernel: network backend may cause Linux netfront to use freed SKBs (XSA-405) kernel: vmwgfx: out-of-bounds write in vmw_kms_cursor_snoop kernel: xfrm_expand_policies() in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry kernel: TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning kernel: u8 overflow problem in cfg80211_update_notlisted_nontrans() kernel: use-after-free related to leaf anon_vma double reuse kernel: use-after-free in bss_ref_get in net/wireless/scan.c kernel: BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c kernel: Denial of service in beacon protection for P2P-device kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c kernel: memory corruption in usbmon driver kernel: NULL pointer dereference in traffic control subsystem kernel: scsi: mpt3sas: Fix use-after-free warning kernel: regmap: spi: Reserve space for register address/padding kernel: net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent kernel: net/mlx5: Fix command stats access after free kernel: ice: Fix potential memory leak in ice_gnss_tty_write() kernel: thermal: core: Fix TZ_GET_TRIP NULL pointer dereference kernel: nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() kernel: bpf: Add schedule points in batch ops kernel: hwmon: Handle failure to register sensor with thermal zone correctly kernel: netfilter: conntrack: fix using __this_cpu_add in preemptible kernel: netfilter: flowtable_offload: fix using __this_cpu_add in preemptible kernel: HID: core: fix shift-out-of-bounds in hid_report_raw_event kernel: ASoC: soc-pcm: Add NULL check in BE reparenting kernel: hwmon: (coretemp) Check for null before removing sysfs attrs kernel: wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration kernel: fbdev: Fix unregistering of framebuffers without device kernel: Bluetooth: use memset avoid memory leaks kernel: bpf, sockmap: Fix memleak in sk_psock_queue_msg kernel: iommu/arm-smmu-v3: check return value after calling platform_get_resource() kernel: iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() kernel: mm/page_owner: use strscpy() instead of strlcpy() kernel: firmware: arm_scmi: Fix list protocols enumeration in the base protocol kernel: rtw89: cfo: check mac_id to avoid out-of-bounds kernel: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags kernel: cifs: fix potential double free during failed mount kernel: bpf: Fix potential array overflow in bpf_trampoline_get_progs() kernel: tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. kernel: tcp: Fix a data-race around sysctl_tcp_early_retrans. kernel: tcp: Fix data-races around sysctl_tcp_recovery. kernel: tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. kernel: udp: Fix a data-race around sysctl_udp_l3mdev_accept. kernel: ip: Fix data-races around sysctl_ip_prot_sock. kernel: ipv4: Fix data-races around sysctl_fib_multipath_hash_policy. kernel: ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh. kernel: iavf: Fix handling of dummy receive descriptors kernel: tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout. kernel: tcp: Fix data-races around sysctl_tcp_fastopen. kernel: tcp: Fix a data-race around sysctl_tcp_notsent_lowat. kernel: tcp: Fix data-races around sysctl_tcp_migrate_req. kernel: igmp: Fix data-races around sysctl_igmp_qrv. kernel: igmp: Fix data-races around sysctl_igmp_llm_reports. kernel: tcp: Fix a data-race around sysctl_tcp_probe_interval. kernel: tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor. kernel: tcp: Fix a data-race around sysctl_tcp_probe_threshold. kernel: tcp: Fix data-races around sysctl_tcp_min_snd_mss. kernel: tcp: Fix data-races around sysctl_tcp_mtu_probing. kernel: tcp: Fix data-races around sysctl_tcp_l3mdev_accept. kernel: ip: Fix a data-race around sysctl_ip_autobind_reuse. kernel: tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. kernel: ip: Fix a data-race around sysctl_fwmark_reflect. kernel: ip: Fix data-races around sysctl_ip_fwd_update_priority. kernel: ip: Fix data-races around sysctl_ip_fwd_use_pmtu. kernel: nexthop: Fix data-races around nexthop_compat_mode. kernel: tcp: Fix a data-race around sysctl_tcp_ecn_fallback. kernel: raw: Fix a data-race around sysctl_raw_l3mdev_accept. kernel: icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr. kernel: sysctl: Fix data-races in proc_dou8vec_minmax(). kernel: vlan: fix memory leak in vlan_newlink() kernel: ipv4: Fix a data-race around sysctl_fib_sync_mem. kernel: icmp: Fix data-races around sysctl. kernel: cipso: Fix data-races around sysctl. kernel: sysctl: Fix data races in proc_douintvec(). kernel: drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() kernel: fscache: Fix invalidation/lookup race kernel: NULL pointer dereference in rawv6_push_pending_frames kernel: net/ulp: use-after-free in listening ULP sockets kernel: use-after-free due to race condition in qdisc_graft() kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c kernel: denial of service in tipc_conn_close Kernel: NULL pointer dereference problem in sctp_sched_dequeue_common kernel: ext4: use-after-free in ext4_xattr_set_entry() kernel: drm/virtio: improper return value check in virtio_gpu_object_shmem_init() kernel: ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU kernel: octeontx2-pf: Fix resource leakage in VF driver unbind
cpes: cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb cpe:/o:redhat:enterprise_linux:9::baseos