Red Hat Security Advisory: kernel security update

This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel packages for Red Hat Enterprise Linux 9. The fixes include resolving null pointer dereferences in Bluetooth l2cap and hci components (CVE-2024-27399, CVE-2024-50255), use-after-free bugs in Bluetooth SCO and ISO sockets (CVE-2024-50125, CVE-2024-50124), enforcement of BPF program attach types (CVE-2024-38564), kernel verifier crash fixes (CVE-2024-45020), zeroing out context in NFS daemon attributes (CVE-2024-46697), use-after-free in BPF uprobe multi-link attach (CVE-2024-47675), signed division overflow in BPF (CVE-2024-49888), removal of broken arm64 uprobe support (CVE-2024-50099), kernel info leak fixes in xfrm (CVE-2024-50110), validation of security association prefix lengths (CVE-2024-50142), fixes for wild memory access in Bluetooth bnep (CVE-2024-50148), and other kernel subsystem issues. The advisory applies to multiple architectures and variants of Red Hat Enterprise Linux 9. The update requires a reboot to take effect.

The vulnerabilities addressed include memory corruption issues such as null pointer dereferences and use-after-free conditions, which could potentially lead to kernel crashes or information leaks. The enforcement improvements and validation fixes help prevent misuse or misconfiguration of kernel features. The overall security impact is rated as moderate by Red Hat, indicating these issues could affect system stability or security but are not classified as critical.

A security update for the Linux kernel packages is available from Red Hat for affected versions of Red Hat Enterprise Linux 9. Users should apply the update promptly and reboot their systems to ensure the fixes take effect. Refer to Red Hat's official advisory and update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps.