Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Important

A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation (TLBI) operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local attacker to gain kernel privileges or a guest VM to escape to the hypervisor, resulting in complete system compromise.

CWE-266 - Incorrect Privilege Assignment

A security vulnerability was found in the Linux kernel's IOMMU Shared Virtual Addressing (SVA) implementation on x86 architecture. When SVA is enabled, the IOMMU caches kernel page table entries. Since the kernel lacks a mechanism to notify the IOMMU when kernel page table pages are freed and reallocated, the IOMMU can retain stale entries pointing to reused memory. This can lead to use-after-free or write-after-free conditions, potentially enabling arbitrary physical memory DMA access or privilege escalation.

CWE-820 - Missing Synchronization

A use-after-free vulnerability was found in the Linux kernel's seqiv (Sequence IV) crypto module. After calling crypto_aead_encrypt(), the underlying request may be freed by asynchronous completion handlers. The code then incorrectly dereferences req->iv to compare against info, accessing potentially freed memory. This can cause memory corruption or crashes when using asynchronous AEAD encryption.

CWE-825 - Expired Pointer Dereference