Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: off-path attacker may inject data or terminate victim's TCP session kernel: race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference kernel: use-after-free vulnerability in function sco_sock_sendmsg() kernel: memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c kernel: veth: ensure skb entering GRO are not cloned. kernel: scsi: scsi_debug: Fix type in min_t to avoid stack OOB kernel: smb2_ioctl_query_info NULL pointer dereference kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback kernel: swiotlb information leak with DMA_FROM_DEVICE kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM kernel: race condition in snd_pcm_hw_free leading to use-after-free kernel: use-after-free in tc_new_tfilter() in net/sched/cls_api.c kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region kernel: use-after-free and memory errors in ext4 when mounting and operating on a corrupted image kernel: KVM: NULL pointer dereference in kvm_dirty_ring_push in virt/kvm/dirty_ring.c kernel: concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources kernel: NULL pointer dereference in x86_emulate_insn may lead to DoS kernel: buffer overflow in nft_set_desc_concat_parse() kernel: KVM: NULL pointer dereference in kvm_irq_delivery_to_apic_fast() kernel: LoadPin bypass via dm-verity table reload kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() kernel: use-after-free when psi trigger is destroyed while being polled kernel: hv_netvsc: NULL pointer dereference in netvsc_get_ethtool_stats() kernel: net/packet: slab-out-of-bounds access in packet_recvmsg() kernel: missing DM_TARGET_IMMUTABLE feature flag in verity_target in drivers/md/dm-verity-target.c kernel: possible to use the debugger to write zero into a location of choice hw: cpu: arm64: Spectre-BHB kernel: nfs_atomic_open() returns uninitialized data instead of ENOTDIR hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions kernel: memory leak in drivers/hid/hid-elo.c kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c kernel: use after free in SUNRPC subsystem kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c kernel: ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() kernel: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC kernel: vsock: remove vsock from connected table when connect is interrupted by a signal kernel: netfilter: fix use-after-free in __nf_register_net_hook() kernel: thermal: core: Fix TZ_GET_TRIP NULL pointer dereference kernel: iwlwifi: mvm: check debugfs_dir ptr before use kernel: KVM: x86/mmu: make apf token non-zero to fix bug
cpe:/a:redhat:enterprise_linux:8::crb cpe:/o:redhat:enterprise_linux:8::baseos