title: Red Hat Security Advisory: kernel security and bug fix update
description: kernel: swiotlb information leak with DMA_FROM_DEVICE kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges kernel: race condition in xfrm_probe_algs can lead to OOB read/write kernel: race condition in hugetlb_no_page() in mm/hugetlb.c kernel: data races around sk->sk_prot kernel: USB-accessible buffer overflow in brcmfmac kernel: l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference kernel: igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Report vmalloc UAF in dvb-core/dmxdev kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip kernel: memory corruption in usbmon driver kernel: NULL pointer dereference in traffic control subsystem kernel: NULL pointer dereference in rawv6_push_pending_frames kernel: HID: check empty report_list in hid_validate_values() kernel: hid: Use After Free in asus_remove() kernel: use-after-free in smb2_is_status_io_timeout() kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c kernel: denial of service in tipc_conn_close kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() kernel: use-after-free bug in remove function xgene_hwmon_remove kernel: Spectre v2 SMT mitigations problem kernel: UAF during login when accessing the shost ipaddress kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() kernel: ext4: use-after-free in ext4_xattr_set_entry() kernel: fbcon: shift-out-of-bounds in fbcon_set_font() kernel: out-of-bounds access in relay_file_read kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue overhead kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params() kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup() kernel: use after free in unix_stream_sendpage kernel: net/sched: sch_hfsc UAF kernel: Race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode BUG in include/linux/swapops.h kernel: use after free in nvmet_tcp_free_crypto in NVMe kernel: slab-out-of-bounds read vulnerabilities in cbq_classify kernel: mpls: double free on sysctl allocation failure kernel: out-of-bounds write in qfq_change_class function kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove() kernel: saa7134: race condition leading to use-after-free in saa7134_finidev() kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c() kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment kernel: netfilter: potential slab-out-of-bound access due to integer underflow kernel: IGB driver inadequate buffer size for frames larger than MTU kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c
cpes: cpe:/a:redhat:rhel_eus:8.6::crb cpe:/o:redhat:rhel_eus:8.6::baseos cpe:/o:redhat:rhev_hypervisor:4.4::el8