The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
- use-after-free in l2capconnect and l2capleconnectreq in net/bluetooth/l2cap_core.c (CVE-2022-42896)
- net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)
- cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)
- malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)
- possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)
- KVM: NULL pointer dereference in kvmmmuinvpcid_gva (CVE-2022-1789)
- use-after-free in freepipeinfo() could lead to privilege escalation (CVE-2022-1882)
- KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)
- netfilter: nfconntrackirc message handling issue (CVE-2022-2663)
- race condition in xfrmprobealgs can lead to OOB read/write (CVE-2022-3028)
- out-of-bounds read in fibnhmatch of the file net/ipv4/fib_semantics.c (CVE-2022-3435)
- race condition in hugetlbnopage() in mm/hugetlb.c (CVE-2022-3522)
- memory leak in ipv6renewoptions() (CVE-2022-3524)
- data races around icsk->icskafops in doipv6setsockopt (CVE-2022-3566)
- data races around sk->sk_prot (CVE-2022-3567)
- memory leak in l2caprecvacldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)
- denial of service in followpagepte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)
- use-after-free after failed devlink reload in devlinkparamget (CVE-2022-3625)
- USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)
- use after free flaw in l2capconndel in net/bluetooth/l2cap_core.c (CVE-2022-3640)
- Double-free in split2MBgttentry when function intelgvtdmamapguestpage failed (CVE-2022-3707)
- mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128)
- l2tp: missing lock when clearing skuserdata can lead to NULL pointer dereference (CVE-2022-4129)
- igmp: use-after-free in ipcheckmc_rcu when opening and closing inet sockets (CVE-2022-20141)
- lockdown bypass using IMA (CVE-2022-21505)
- double free in usb8devstartxmit in drivers/net/can/usb/usb8dev.c (CVE-2022-28388)
- network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743)
- unmapmappingrange() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)
- TLB flush operations are mishandled in certain KVMVCPUPREEMPTED leading to guest malfunctioning (CVE-2022-39189)
- u8 overflow problem in cfg80211updatenotlisted_nontrans() (CVE-2022-41674)
- use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)
- use-after-free in bssrefget in net/wireless/scan.c (CVE-2022-42720)
- BSS list corruption in cfg80211addnontrans_list in net/wireless/scan.c (CVE-2022-42721)
- Denial of service in beacon protection for P2P-device (CVE-2022-42722)
- memory corruption in usbmon driver (CVE-2022-43750)
- NULL pointer dereference in traffic control subsystem (CVE-2022-47929)
- NULL pointer dereference in rawv6pushpending_frames (CVE-2023-0394)
- use-after-free due to race condition in qdisc_graft() (CVE-2023-0590)
- use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)
- denial of service in tipcconnclose (CVE-2023-1382)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.