Red Hat Security Advisory: kernel security update

Important

A vulnerability was found in the Linux kernel’s act_skbmod module, where the tcf_skbmod_act() function mistakenly assumes all packets use Ethernet as their protocol. This issue can lead to the corruption of non-Ethernet packets, such as those from CAN devices, if skbmod actions are incorrectly applied. This misinterpretation results in unexpected packet manipulation and data corruption.

CWE-20 - Improper Input Validation

A vulnerability was found in the Linux kernel's TI TLAN driver, where the tlan_remove_one function can lead to a use-after-free issue when the driver attempts to access private data after the network device has already been freed, potentially causing system instability or crash.

CWE-416 - Use After Free

A flaw was found in KVM. With shadow paging enabled if INVPCID is executed with CR0.PG=0, the invlpg callback is not set, and the result is a NULL pointer dereference. This flaw allows a guest user to cause a kernel oops condition on the host, resulting in a denial of service.

CWE-476 - NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Malformed user input to debugfs results in buffer overflow crashes. Adapt input string lengths to fit within internal buffers, leaving space for NULL terminators.

CWE-787 - Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID An error case exit from lpfc_cmpl_ct_cmd_gft_id() results in a call to lpfc_nlp_put() with a null pointer to a nodelist structure. Changed lpfc_cmpl_ct_cmd_gft_id() to initialize nodelist pointer upon entry.

CWE-476 - NULL Pointer Dereference