title: Red Hat Security Advisory: kernel security and bug fix update
description: kernel: use-after-free vulnerability in function sco_sock_sendmsg() kernel: improper input validation may lead to privilege escalation kernel: memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c kernel: eBPF verification flaw kernel: smb2_ioctl_query_info NULL pointer dereference kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback kernel: possible race condition in drivers/tty/tty_buffers.c kernel: buffer overflow in nft_set_desc_concat_parse() kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation kernel: netfilter: nf_conntrack_irc message handling issue kernel: memory leak in ipv6_renew_options() kernel: nfp: use-after-free in area_cache_get() kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt kernel: Rate limit overflow messages in r8152 in intr_callback kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c kernel: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry kernel: Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed kernel: possible to use the debugger to write zero into a location of choice kernel: local privileges escalation in kernel/bpf/verifier.c kernel: nfs_atomic_open() returns uninitialized data instead of ENOTDIR kernel: Executable Space Protection Bypass kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c kernel: use after free in SUNRPC subsystem kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c kernel: TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning kernel: memory leak in ttusb_dec_exit_dvb() in media/usb/ttusb-dec/ttusb_dec.c kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c kernel: net/tls: tls_is_tx_ready() checked list_entry kernel: ovl: fix use after free in struct ovl_aio_req kernel: Use after free bug in btsdio_remove due to race condition kernel: NULL pointer dereference in can_rcv_filter kernel: Slab-out-of-bound read in compare_netdev_and_ip kernel: Use after free bug in r592_remove kernel: smsusb: use-after-free caused by do_submit_urb() kernel: use-after-free in sch_qfq network scheduler kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list kernel: NULL pointer dereference in nvmet_tcp_build_iovec kernel: NULL pointer dereference in nvmet_tcp_execute_request kernel: NULL pointer dereference in __nvmet_req_complete kernel: OOB Access in smb2_dump_detail kernel: inactive elements in nft_pipapo_walk kernel: use-after-free in IPv4 IGMP amd: Return Address Predictor vulnerability leading to information disclosure Kernel: denial of service in atm_tc_enqueue in net/sched/sch_atm.c due to type confusion kernel: Denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow kernel: r592: race condition leading to use-after-free in r592_remove() kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c kernel: drivers/usb/storage/ene_ub6250.c kernel: SEV-ES local priv escalation kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination
cpes: cpe:/a:redhat:rhel_eus:8.6::crb cpe:/o:redhat:rhel_eus:8.6::baseos cpe:/o:redhat:rhev_hypervisor:4.4::el8