Linux Kernel Security Update Advisory

Jun 11 2024

Overview

An update has been released to address vulnerability in the Linux Kernel. Users of affected versions are advised to update to the latest version.

Affected Products

CVE-2021-47541

Linux Kernel Versions : 4.7 (inclusive) to 4.14.257 (excluded)
Linux Kernel Versions : 4.15 (inclusive) to 4.19.220 (excluded)
Linux Kernel Versions : 4.20 (inclusive) to 5.4.164 (excluded)
Linux Kernel Versions : 5.5 (inclusive) to 5.10.84 (excluded)
Linux Kernel Versions : 5.11 (inclusive) to 5.15.7 (excluded)

CVE-2021-47571

Linux Kernel Versions : 3.2 (inclusive) to 4.4.294 (excluded)
Linux Kernel Versions: 4.5 (inclusive) to 4.9.292 (excluded)
Linux Kernel Versions : 4.10 (inclusive) to 4.14.257 (excluded)
Linux Kernel Versions : 4.15 (inclusive) to 4.19.219 (excluded)
Linux Kernel Versions : 4.20 (inclusive) to 5.4.163 (excluded)
Linux Kernel Versions : 5.5 (inclusive) to 5.10.83 (excluded)
Linux Kernel Versions : 5.11 (inclusive) to 5.15.6 (excluded)

CVE-2021-47521

Linux Kernel Versions : 3.2 (inclusive) to 4.4.295 (excluded)
Linux Kernel Versions : 4.5 (inclusive) to 4.9.293 (excluded)
Linux Kernel Versions : 4.10 (inclusive) to 4.14.258 (excluded)
Linux Kernel Versions : 4.15 (inclusive) to 4.19.221 (excluded)
Linux Kernel Versions : 4.20 (inclusive) to 5.4.165 (excluded)
Linux Kernel Versions : 5.5 (inclusive) to 5.10.85 (excluded)
Linux Kernel Versions : 5.11 (inclusive) to 5.15.8 (excluded)

CVE-2021-47525

Linux Kernel Versions : 5.11 (inclusive) to 5.15.7 (excluded)

CVE-2021-47520

Linux Kernel Versions : 2.6.37 (inclusive) to 4.4.295 (excluded)
Linux Kernel Versions : 4.5 (inclusive) to 4.9.293 (excluded)
Linux Kernel Version : 4.10 (inclusive) to 4.14.258 (excluded)
Linux Kernel Versions : 4.15 (inclusive) to 4.19.221 (excluded)
Linux Kernel Versions : 4.20 (inclusive) to 5.4.165 (excluded)
Linux Kernel Versions : 5.5 (inclusive) to 5.10.85 (excluded)
Linux Kernel Versions : 5.11 (inclusive) to 5.15.8 (excluded)

CVE-2024-36971

Linux Kernel Versions : 4.6 (inclusive) to 6.9.4 (excluded)
Linux Kernel Version : 6.10.0 rc1

CVE-2024-26594

Linux Kernel Versions : ~ 5.15.149 (excluded)
Linux Kernel Versions : 5.16.0 (inclusive) to 6.1.75 (excluded)
Linux Kernel Versions : 6.2.0 (inclusive) to 6.6.14 (excluded)
Linux Kernel Versions : 6.7.0 (inclusive) to 6.7.2 (excluded)

CVE-2024-36477

Linux Kernel Versions : ~ 6.6.0 (excluded)
Linux Kernel Versions : 6.6.1 (inclusive) to 6.6.33 (excluded)
Linux Kernel Versions : 6.9 (inclusive) to 6.9.4 (excluded)
Linux Kernel Version : 6.10.0-rc1

CVE-2024-39277

Linux Kernel Version : ~5.11 (excluded)
Linux Kernel Versions : 5.15 (inclusive) to 5.15.161 (excluded)
Linux Kernel Versions : 6.1 (inclusive) to 6.1.93 (excluded)
Linux Kernel Versions : 6.6 (inclusive) to 6.6.33 (excluded)
Linux Kernel Versions : 6.9 (inclusive) to 6.9.4 (excluded)
Linux Kernel Version : 6.10.0-rc1

Resolved Vulnerabilities

CVE-2021-47541 : Use after free vulnerability in mlx4_en_try_alloc_resources() function in mlx4_en_copy_priv() failure(7.8 High, CVSS V3.1 Date Added : 2024.06.10)
CVE-2021-47571: use after free vulnerability in the free_rtllib() function when it frees the dev pointer and then uses that pointer in the next line(7.8 High, CVSS V3.1 Date Added: 2024.06.10)
CVE-2021-47521: use after free vulnerability in the ems_pcmcia_add_card() function due to the last channel being unavailable and being used again after dev is freed(7.8 High, CVSS V3.1 Date Added: 2024.06.10)
CVE-2021-47525: use after free vulnerability due to failure to unregister ports when unbinding a driver, resulting in the use of freed driver data(7.8 High, CVSS V3.1 Date Added: 2024.06.10)
CVE-2021-47520 : Use-after-free vulnerability due to a reference to skb after calling netif_receive_skb(skb)(7.8 High, CVSS V3.1, Date Added: 2024.06.10)
CVE-2024-36971: Use-after-free vulnerability due to the __dst_negative_advice() function not enforcing the correct RCU rules, which could allow a call to dst_release(old_dst) without properly initializing sk->dst_cache, resulting in a memory access after use (7.8 High, CVSS V3.1 Date Added: 2024.06.12)
CVE-2024-26594: A vulnerability in ksmbd when it receives an invalid mechanism token in a client’s session establishment request, it does not validate it and throws an error if it is invalid (7.1 High, CVSS V3.1 Date Added: 2024.04.19)
CVE-2024-36477: Buffer overflow vulnerability in tpm_tis_spi in the Linux Kernel due to allocation of the TPM SPI transfer buffer without considering the size of the SPI header, resulting in failure to include the header when calculating the maximum transfer length and buffer size (7.8 High, CVSS V3.1 Date Added: 2024.06.24)
CVE-2024-39277: Array index above the limit due to an out-of-bounds index when calling cpumask_of_node() due to incorrect handling of NUMA_NO_NODE values in the Linux Kernel (7.8 High, CVSS V3.1, Date Added: 2024.06.24)

Vulnerability Patches

Vulnerability patches have been made available in the latest update. Please follow the instructions on the Referenced Sites to update to the latest vulnerability patches version.

CVE-2021-47541