title: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
description: kernel: seg6: fix the iif in the IPv6 socket control block Kernel: race when faulting a device private page in memory manager kernel: use-after-free in l1oip timer handlers kernel: Rate limit overflow messages in r8152 in intr_callback kernel: vmwgfx: use-after-free in vmw_cmd_res_check kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c kernel: gpiolib: fix memory leak in gpiochip_setup_dev() kernel: memcg: fix possible use-after-free in memcg_write_event_control() kernel: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths kernel: char: tpm: Protect tpm_pm_suspend with locks kernel: ixgbevf: Fix resource leak in ixgbevf_init_module() kernel: watch_queue: Actually free the watch kernel: NFSv4: Don't hold the layoutget locks across multiple RPC calls kernel: xprtrdma: treat all calls not a bcall when bc_serv is NULL kernel: af_unix: Fix a data-race in unix_dgram_peer_wake_me(). kernel: regulator: scmi: Fix refcount leak in scmi_regulator_probe kernel: mm/mempolicy: fix uninit-value in mpol_rebind_policy() kernel: i2c: piix4: Fix a memory leak in the EFCH MMIO support kernel: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions kernel: irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions kernel: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() kernel: cpufreq: CPPC: Add u64 casts to avoid overflowing kernel: VMCI: Use threaded irqs instead of tasklets kernel: x86/mm: Randomize per-cpu entry area kernel: HID: check empty report_list in hid_validate_values() kernel: sctp: fail if no bound addresses can be used for a given scope kernel: net/tls: tls_is_tx_ready() checked list_entry kernel: tap: tap_open(): correctly initialize socket uid kernel: Type confusion in pick_next_rt_entity() kernel: hid: Use After Free in asus_remove() kernel: hash collisions in the IPv6 connection lookup table kernel: missing mmap_lock in file_files_note that could possibly lead to a use after free in the coredump code kernel: ovl: fix use after free in struct ovl_aio_req Kernel: a USB-accessible slab-out-of-bounds read in brcmfmac Kernel: use-after-free in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() kernel: use-after-free bug in remove function xgene_hwmon_remove kernel: Use after free bug in btsdio_remove due to race condition kernel: net: IPv6 RPL protocol reachable assertion leads to DoS kernel: A possible deadlock in dm_get_inactive_table in dm- ioctl.c leads to dos kernel: Use after free bug in r592_remove kernel: fbcon: shift-out-of-bounds in fbcon_set_font() kernel: gfs2: NULL pointer dereference in gfs2_evict_inode() kernel: out-of-bounds access in relay_file_read kernel: NULL pointer dereference due to missing kalloc() return value check in shtp_cl_get_dma_send_buf() kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user space kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params() kernel: xfrm: out-of-bounds read of XFRMA_MTIMER_THRESH nlattr kernel: KVM: SEV-ES / SEV-SNP VMGEXIT double fetch vulnerability kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route kernel: exFAT: stack overflow in exfat_get_uniname_from_ext_entry kernel: mpls: double free on sysctl allocation failure kernel: KVM: nVMX: missing consistency checks for CR0 and CR4 kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove() kernel: vmwgfx: race condition leading to information disclosure vulnerability kernel: vmwgfx: double free within the handling of vmw_buffer_object objects kernel: r592: race condition leading to use-after-free in r592_remove() kernel: eBPF: insufficient stack type checks in dynptr kernel: sched/psi: Fix use-after-free in ep_remove_wait_queue() kernel: net: sched: sch: Bounds check priority kernel: net: openvswitch: fix flow memory leak in ovs_flow_cmd_new kernel: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() kernel: ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() kernel: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline. kernel: null pointer when load rlc firmware kernel: drm/dp_mst: Fix resetting msg rx state after topology removal
cpes: cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb cpe:/a:redhat:enterprise_linux:9::nfv cpe:/a:redhat:enterprise_linux:9::realtime cpe:/o:redhat:enterprise_linux:9::baseos