Red Hat Security Advisory: kernel security update

Important

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface (HCI) Universal Asynchronous Receiver/Transmitter (UART) driver. When the `hci_register_dev()` function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be processed by the protocol-specific receive handler after its associated resources have been released, potentially leading to a null pointer dereference. This vulnerability could result in a system crash, causing a Denial of Service (DoS).

CWE-825 - Expired Pointer Dereference

A flaw was found in the Linux kernel's exFAT filesystem driver. A local attacker could exploit a use-after-free vulnerability in the `exfat_find_dir_entry()` function. This occurs because a buffer is prematurely released while still being referenced, which can be triggered by processing a specially crafted exFAT image. Successful exploitation leads to a system crash, resulting in a Denial of Service (DoS).

CWE-825 - Expired Pointer Dereference

A flaw was found in the Linux kernel's `keyctl_pkey_params_get_2()` function within the KEYS subsystem. The vulnerability arises from an incorrect calculation of the internal output buffer's length, which can lead to a buffer overflow when a user-provided buffer is too small. This flaw could allow a local attacker to corrupt memory, potentially leading to a denial of service or other unspecified impacts.

CWE-787 - Out-of-bounds Write