RHSA-2024:6567MediumCVSS 7.1

Red Hat Security Advisory: kernel security update

Published
September 11, 2024
Last Modified
August 28, 2026

🔗 CVE IDs covered (27)

CVE-2024-42131 →CVE-2024-26720 · pendingCVE-2024-35791 →CVE-2024-36019 →CVE-2024-38619 →CVE-2024-41096 →CVE-2024-42102 →CVE-2023-52801 →CVE-2024-26629 →CVE-2024-26630 →CVE-2024-26886 →CVE-2024-35797 →CVE-2024-36000 →CVE-2024-36883 →CVE-2024-38559 →CVE-2023-52463 →CVE-2024-35875 →CVE-2024-40927 →CVE-2024-41040 →CVE-2024-41044 →CVE-2024-41055 →CVE-2024-42096 →CVE-2024-26946 →CVE-2024-36979 →CVE-2024-40936 →CVE-2024-41073 →CVE-2024-42082 →

📋 Description

CVE-2023-52463 — kernel: efivarfs: force RO when remounting if SetVariable is not supported CVE-2023-52801 — kernel: iommufd: Fix missing update of domains_itree after splitting iopt_area CVE-2024-26629 — kernel: nfsd: fix RELEASE_LOCKOWNER CVE-2024-26630 — kernel: mm: cachestat: fix folio read-after-free in cache walk CVE-2024-26720 — kernel: mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again CVE-2024-26886 — kernel: Bluetooth: af_bluetooth: Fix deadlock CVE-2024-26946 — kernel: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address CVE-2024-35791 — kernel: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() CVE-2024-35797 — kernel: mm: cachestat: fix two shmem bugs CVE-2024-35875 — kernel: x86/coco: Require seeding RNG with RDRAND on CoCo systems CVE-2024-36000 — kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge CVE-2024-36019 — kernel: regmap: maple: Fix cache corruption in regcache_maple_drop() CVE-2024-36883 — kernel: net: fix out-of-bounds access in ops_init CVE-2024-36979 — kernel: net: bridge: mst: fix vlan use-after-free CVE-2024-38559 — kernel: scsi: qedf: Ensure the copied buf is NUL terminated CVE-2024-38619 — kernel: usb-storage: alauda: Check whether the media is initialized CVE-2024-40927 — kernel: xhci: Handle TD clearing for multiple streams case CVE-2024-40936 — kernel: cxl/region: Fix memregion leaks in devm_cxl_add_region() CVE-2024-41040 — kernel: net/sched: Fix UAF when resolving a clash CVE-2024-41044 — kernel: ppp: reject claimed-as-LCP but actually malformed packets CVE-2024-41055 — kernel: mm: prevent derefencing NULL ptr in pfn_section_valid() CVE-2024-41073 — kernel: nvme: avoid double free special payload CVE-2024-41096 — kernel: PCI/MSI: Fix UAF in msi_capability_init CVE-2024-42082 — kernel: xdp: Remove WARN() from __xdp_reg_mem_model() CVE-2024-42096 — kernel: x86: stop playing stack games in profile_pc() CVE-2024-42102 — kernel: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" CVE-2024-42131 — kernel: mm: avoid overflows in dirty throttling logic

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • Red Hat Enterprise Linux CRB (v. 9)
  • Red Hat Enterprise Linux NFV (v. 9)
  • Red Hat Enterprise Linux RT (v. 9)
  • bpftool-0:7.3.0-427.35.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-0:7.3.0-427.35.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-0:7.3.0-427.35.1.el9_4.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-0:7.3.0-427.35.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.s390x as a component of Red Hat Enterprise Linux CRB (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 9)
  • bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux RT (v. 9)
  • kernel-0:5.14.0-427.35.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-427.35.1.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-427.35.1.el9_4.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-427.35.1.el9_4.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-0:5.14.0-427.35.1.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-0:5.14.0-427.35.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • kernel-64k-core-0:5.14.0-427.35.1.el9_4.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: No mitigation is currently available for this vulnerability. Make sure to perform the updates as they become available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (30)