[LU-18262] kernel update [RHEL 9.4 5.14.0-427.37.1.el9_4]

• Type: Task
• Resolution: Won't Fix
• Priority: Minor
• Affects Version/s: Lustre 2.16.0, Lustre 2.15.6
• Severity: 3
• Assignee: Jian Yu
• Reporter: Jian Yu

Description

Security Fix(es):

• kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439)
• kernel: net/sched: act_mirred: don't override retval if we already lost the skb (CVE-2024-26739)
• kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (CVE-2024-26947)
• kernel: scsi: qla2xxx: Fix command flush on cable pull (CVE-2024-26931)
• kernel: scsi: qla2xxx: Fix double free of the ha->vp_map pointer (CVE-2024-26930)
• kernel: scsi: qla2xxx: Fix double free of fcport (CVE-2024-26929)
• kernel: fork: defer linking file vma until vma is fully initialized (CVE-2024-27022)
• kernel: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes (CVE-2024-26991)
• kernel: bpf, sockmap: Prevent lock inversion deadlock in map delete elem (CVE-2024-35895)
• kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016)
• kernel: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (CVE-2024-36899)
• kernel: cpufreq: exit() callback is optional (CVE-2024-38615)
• kernel: ring-buffer: Fix a race between readers and resize checks (CVE-2024-38601)
• kernel: cppc_cpufreq: Fix possible null pointer dereference (CVE-2024-38573)
• kernel: gfs2: Fix potential glock use-after-free on unmount (CVE-2024-38570)
• kernel: wifi: nl80211: Avoid address calculations via out of bounds array indexing (CVE-2024-38562)
• kernel: Input: cyapa - add missing input core locking to suspend/resume functions (CVE-2023-52884)
• kernel: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CVE-2024-40984)
• kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing (CVE-2024-41071)
• kernel: wifi: mt76: replace skb_put with skb_put_zero (CVE-2024-42225)
• kernel: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CVE-2024-42246)

https://access.redhat.com/errata/RHSA-2024:6997?sc_cid=701600000006NHXAA2

Issue Links

• is related to: LU-18373 kernel update [RHEL 9.4 5.14.0-427.40.1.el9_4]
• is related to: LU-18219 kernel update [RHEL 9.4 5.14.0-427.35.1.el9_4]

Comments

[Jian Yu]

A newer version is available in LU-18373.

[Gerrit Updater]

"Jian Yu <[e-mail]>" uploaded a new patch: https://review.whamcloud.com/c/fs/lustre-release/+/56508
Subject: LU-18262 kernel: update RHEL 9.4 [5.14.0-427.37.1.el9_4]
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 0f2eb3b422d97a18cf21ce2e5184aa54e6ca7a53