Red Hat Security Advisory: kernel security update

Important

A double-free vulnerability was found in the Linux kernel RDMA RXE (soft-RoCE) driver's memory region handling. A local user with access to RDMA userspace verbs can register a memory region with parameters that cause initialization to fail, triggering error handling code that frees the mr->map structure twice, which leads to memory corruption and can result in denial of service via kernel crash or potentially privilege escalation through heap manipulation.

CWE-1341 - Multiple Releases of Same Resource or Handle

A flaw was found in the Linux kernel’s SCSI driver component qla2xxx (used with FCP-2 devices). When the terminate_rport_io() function is invoked , the driver may exit cleanup before all outstanding I/O operations have returned. This can lead to a use-after-free condition when resources are freed while I/Os are still pending.

CWE-416 - Use After Free

A null pointer dereference exists in the linux kernel such that in obj_stock_flush_required():stock->cached_objcg can be reset between the check and dereference, resulting in damage to the availability of the system.

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

A flaw has been found in the Linux kernel’s NBD drivers.The issue stems from incomplete validation of IOCTL arguments passed to the NBD driver. Specifically, oversized or unchecked arguments may lead to a signed integer overflow in __block_write_full_page() and misuse of argument values cast to int in nbd_add_socket().

CWE-190 - Integer Overflow or Wraparound

A bounds-checking flaw was found in the Linux kernel Small Computer System Interface Enclosure Services driver in the way descriptor pointers are validated while processing enclosure data. Missing checks could allow an out-of-bounds access during parsing. A local user could use this flaw to crash the system while enclosure data is processed, resulting in a denial of service.