Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Important

In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix ordering of iput() and watched_objects decrement Ensure the superblock is kept alive until we're done with iput(). Holding a reference to an inode is not allowed unless we ensure the superblock stays alive, which fsnotify does by keeping the watched_objects count elevated, so iput() must happen before the watched_objects decrement. This can lead to a UAF of something like sb->s_fs_info in tmpfs, but the UAF is hard to hit because race orderings that oops are more likely, thanks to the CHECK_DATA_CORRUPTION() block in generic_shutdown_super(). Also, ensure that fsnotify_put_sb_watched_objects() doesn't call fsnotify_sb_watched_objects() on a superblock that may have already been freed, which would cause a UAF read of sb->s_fsnotify_info.

A flaw was found in the Linux kernel's shmem (tmpfs) filesystem rename operation. Under severe memory pressure, the maple_tree insertion used during file rename can fail, and the error recovery path does not properly handle this failure. This can leave the filesystem directory offset tree in an inconsistent state.

CWE-390 - Detection of Error Condition Without Action

A flaw was found in the Linux kernel. A timing issue, known as a race condition, exists within the futex subsystem. This vulnerability could allow a local attacker to access memory after it has been freed, leading to a system crash (denial of service) or potentially the disclosure of sensitive information.

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition