Red Hat Security Advisory: kernel security update

Important

An incorrect state restoration flaw was found in the Linux kernel's RDMA rxe (soft-RoCE) driver in the requester packet transmission logic. A local user with access to RDMA devices can trigger this issue when network layer packet drops occur during RDMA send operations, causing the work queue element state to be incompletely saved and restored. This results in data corruption in resent packets, leading to denial of service or potential data integrity issues.

A use-after-free vulnerability was found in the Linux kernel Intel i915 graphics driver's GuC virtual engine request handling. A local user with access to GPU rendering can create requests on GuC virtual engines and trap references via sync_file or dmabuf, causing fence release operations to access freed engine structures when validating whether rq->engine points to a valid hardware engine, which results in memory corruption and potential privilege escalation or denial of service.

CWE-825 - Expired Pointer Dereference

A race condition was found in the Linux kernel Mellanox mlx5 network driver's traffic control offload flow management. A local user with privileges to configure traffic control flower filters can trigger concurrent flow deletion operations where the NOT_READY flag is checked before acquiring the necessary lock, allowing a workqueue task to concurrently remove the flow from the unready_flows list, which causes double-removal from the linked list and results in list corruption leading to denial of service via kernel crash or potentially memory corruption.

A use-after-free flaw was found in cifs_fill_dirent in fs/cifs/readdir.c in smb client in the Linux Kernel. This flaw could allow an attacker to crash the system due to race problem. This vulnerability could even lead to a kernel information leak problem.

CWE-825 - Expired Pointer Dereference

A heap‑overflow vulnerability was discovered in the linux kernel e1000e driver’s e1000_set_eeprom() function, insufficient validation of the requested length for an EEPROM change could allow a local, low‑privilege user to trigger memory corruption (heap overflow). A local unprivileged user with access to the driver could exploit this flaw to cause memory corruption, potentially leading to confidentiality, integrity, and availability damage.

CWE-122 - Heap-based Buffer Overflow

A flaw was found in the Linux kernel in the Intel i40e network driver such that in the function i40e_vc_config_queues_msg(), when iterating over vf->ch[idx], the idx value is not properly validated against the range of active/initialized traffic classes (TCs). An attacker with local privileges could supply a malformed value causing an out-of-bounds access, potentially leading to memory corruption, system crash, or possible arbitrary code execution.

CWE-787 - Out-of-bounds Write

A flaw was identified in the Intel “i40e” Ethernet driver in the Linux Kernel where the ring_len parameter supplied by a VF (virtual function) is passed unchecked to the hardware memory context. If a malicious Virtual function provides a too-large or misaligned ring_len, it may allow the device to configure excessive Tx/Rx queue length leading to memory corruption or other undefined behaviour in the driver context.

CWE-131 - Incorrect Calculation of Buffer Size

A use-after-free flaw exists in the Linux kernel’s media/rc subsystem. When the device is disconnected via imon_disconnect(), the driver may unconditionally release a usb_device reference (via usb_put_dev) even while other operations (such as vfd_write, send_packet, display_open, lcd_write) are still in progress. Because the pointers usbdev_intf0/usbdev_intf1 are not properly protected by a users-counter or locking, this situation can lead to a use-after-free of the usb_device pointer and therefore memory corruption or kernel stability issues

CWE-416 - Use After Free

A flaw was found in the Linux kernel's `vsock` component. This vulnerability occurs when a `connect()` operation on an already established socket is interrupted by a signal or timeout, causing the system to mishandle the socket's state. This incorrect handling can lead to a race condition, potentially resulting in memory corruption, such as a use-after-free or null-pointer dereference. A local attacker could exploit this to cause a denial of service or potentially escalate privileges.

CWE-364 - Signal Handler Race Condition