Red Hat Security Advisory: kernel security update

Moderate

A use-after-free vulnerability was found in the ext4 filesystem's orphan inode cleanup routine in the Linux kernel. When ext4_inode_attach_jinode() fails with -ENOMEM during orphan cleanup at mount time, the error is not properly propagated. The inode is freed via iput(), but the orphan list still references the same inode number. On the next loop iteration, the freed inode structure is reused, triggering a use-after-free when adding it to the orphan list.

CWE-825 - Expired Pointer Dereference

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) implementation. An attacker with elevated privileges (CAP_NET_ADMIN) can exploit this vulnerability by configuring the system to accept and forward VXLAN packets. The issue arises from an incorrect nexthop hash size, where a 32-bit hash is used instead of the expected 31-bit hash, leading to negative hash values. This can cause an out-of-bounds write in the nexthop group selection, resulting in a kernel panic and a denial of service (DoS).

CWE-190 - Integer Overflow or Wraparound

A flaw was found in the Linux kernel's Bluetooth subsystem. A use-after-free (UAF) vulnerability exists in the `hci_disconnect_all_sync` function. This can occur if a Bluetooth connection is deleted while a controller event is being processed concurrently. A local attacker could potentially exploit this flaw to trigger a system crash, leading to a Denial of Service.

CWE-825 - Expired Pointer Dereference