title: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
description: kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack kernel: ovl: fix warning in ovl_create_real() kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c kernel: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() kernel: Bluetooth: L2CAP: Fix u8 overflow kernel: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race kernel: cxgb4: use-after-free in ch_flower_stats_cb() kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() kernel: NVMe: info leak due to out-of-bounds read in nvmet_ctrl_find_get kernel: local dos vulnerability in scatterwalk_copychunks kernel: GC's deletion of an SKB races with unix_stream_read_generic()  leading to UAF kernel: GSM multiplexing race condition leads to privilege escalation kernel: null pointer dereference vulnerability in nft_dynset_init() kernel: Null Pointer Dereference vulnerability in ida_free in lib/idr.c kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size kernel: use-after-free in IPv4 IGMP kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses kernel: irdma: Improper access control Kernel: double free in hci_conn_cleanup of the bluetooth subsystem kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl kernel: usb: out-of-bounds read in read_descriptors kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one() kernel: netfilter: xtables sctp out-of-bounds read in match_flags() kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match() kernel: QXL: race condition leading to use-after-free in qxl_mode_dumb_create() kernel: ipv4: NULL pointer dereference in ipv4_send_dest_unreach() kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write kernel: NULL pointer dereference vulnerability in io_uring_show_fdinfo kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c kernel: bluetooth: bt_sock_ioctl race condition leads to use-after-free in bt_sock_recvmsg kernel: use-after-free in net/atm/ioctl.c kernel: smb: client: fix potential OOBs in smb2_parse_contexts() kernel: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump kernel: intel: Fix NULL pointer dereference issue in upi_fill_topology() kernel: use-after-free in kv_parse_power_table kernel: null-ptr-deref in alloc_workqueue kernel: perf/x86/lbr: Filter vsyscall addresses kernel: HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect kernel: drm: Don't unref the same fb many times by mistake due to deadlock handling kernel: mm/sparsemem: fix race in accessing memory_section->usage kernel: net: fix possible store tearing in neigh_periodic_work() kernel: HID: sony: Fix a potential memory leak in sony_probe() kernel: team: NULL pointer dereference when team device type is changed kernel: net: bridge: data races indata-races in br_handle_frame_finish() kernel: net/core: kernel crash in ETH_P_1588 flow dissector kernel: netfilter: nf_tables: memory leak when more than 255 elements expired kernel: KVM: s390: fix setting of fpc register kernel: net/sched: act_ct: fix skb leak and crash on ooo frags kernel: netfilter: nf_tables: disallow timeout for anonymous sets kernel: netfilter: nftables: exthdr: fix 4-byte stack OOB write kernel: drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL kernel: wifi: mac80211: don&#39;t return unset power in ieee80211_get_tx_power() kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number kernel: net: fix UaF in netns ops registration error path kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client kernel: hugetlbfs: Null pointer dereference in hugetlbfs_fill_super function kernel: nf_tables: use-after-free vulnerability in the nft_setelem_catchall_deactivate() function kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function kernel: untrusted VMM can trigger int80 syscall handling kernel: tls: use-after-free with partial reads and async decrypt kernel: tls: race between async notify and socket close kernel: tls: handle backlogging of crypto requests kernel: tls: race between tx work scheduling and socket close kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption kernel: i2c: i801: Fix block process call transactions kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() kernel: null pointer when load rlc firmware kernel: blk-mq: fix IO hang from sbitmap wakeup race kernel: i40e: Do not allow untrusted VF to remove administratively set MAC
cpes: cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb cpe:/a:redhat:enterprise_linux:9::nfv cpe:/a:redhat:enterprise_linux:9::realtime cpe:/o:redhat:enterprise_linux:9::baseos