RHSA-2024:8614 — Security Advisory

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252)

• hw: cpu: intel: Native Branch History Injection (BHI) (CVE-2024-2201)

• kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)

• kernel: blk-mq: fix IO hang from sbitmap wakeup race (CVE-2024-26671)

• kernel: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (CVE-2024-26686)

• kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826)

• kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del (CVE-2024-26961)

• kernel: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (CVE-2021-47384)

• kernel: mptcp: ensure snd_nxt is properly initialized on connect (CVE-2024-36889)

• kernel: ipv6: prevent possible NULL dereference in rt6_probe() (CVE-2024-40960)

• kernel: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (CVE-2024-40998)

• kernel: filelock: fix potential use-after-free in posix_lock_inode (CVE-2024-41049)

• kernel: mm: prevent derefencing NULL ptr in pfn_section_valid() (CVE-2024-41055)

• kernel: nvmet: fix a possible leak when destroy a ctrl during qp establishment (CVE-2024-42152)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.