Red Hat Security Advisory: kernel security update

Moderate

A use-after-free vulnerability was found in the ext4 filesystem's orphan inode cleanup routine in the Linux kernel. When ext4_inode_attach_jinode() fails with -ENOMEM during orphan cleanup at mount time, the error is not properly propagated. The inode is freed via iput(), but the orphan list still references the same inode number. On the next loop iteration, the freed inode structure is reused, triggering a use-after-free when adding it to the orphan list.

CWE-825 - Expired Pointer Dereference

A flaw was found in the Linux kernel’s TCP implementation in the function tcp_add_backlog(). When calculating the maximum acceptable backlog for TCP sockets, the sum of the receive buffer (sk_rcvbuf), the send buffer (sk_sndbuf), and a fixed constant may exceed the maximum value of a signed integer due to both buffer values being of type int. This can result in a signed integer overflow, potentially leading to incorrect backlog limits and unexpected TCP behavior under certain workloads.

CWE-190 - Integer Overflow or Wraparound

A race condition was found in the Linux kernel Mellanox mlx5 network driver's traffic control offload flow management. A local user with privileges to configure traffic control flower filters can trigger concurrent flow deletion operations where the NOT_READY flag is checked before acquiring the necessary lock, allowing a workqueue task to concurrently remove the flow from the unready_flows list, which causes double-removal from the linked list and results in list corruption leading to denial of service via kernel crash or potentially memory corruption.

A flaw was found in the Linux kernel in which a callback is not called when a Bluetooth peripheral is disconnected. This flaw leads to a use-after-free, which an attacker could use to escalate their privileges, corrupt system memory, or otherwise cause a denial of service.

CWE-416 - Use After Free

A flaw was found in the Linux kernel's Common Internet File System (CIFS) component. This use-after-free vulnerability occurs due to improper handling of server hostname information during connection re-establishment. An attacker on an adjacent network could exploit this, potentially leading to a compromise of data integrity or a denial of service.

CWE-825 - Expired Pointer Dereference