(RHSA-2024:0724) Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

• kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

• kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (CVE-2024-0646)

• kernel: use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

• kernel: improper input validation may lead to privilege escalation (CVE-2021-4204)

• kernel: memory leak for large arguments in video_usercopy function in drivers/media/v4l2-core/v4l2-ioctl.c (CVE-2021-30002)

• kernel: eBPF verification flaw (CVE-2021-34866)

• kernel: smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

• kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges (CVE-2022-0500)

• kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

• kernel: possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

• kernel: buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

• kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586)

• kernel: netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

• kernel: memory leak in ipv6_renew_options() (CVE-2022-3524)

• kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

• kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

• kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594)

• kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

• kernel: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

• kernel: Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

• kernel: possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

• kernel: local privileges escalation in kernel/bpf/verifier.c (CVE-2022-23222)

• kernel: Executable Space Protection Bypass (CVE-2022-25265)

• kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388)

• kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)