Red Hat issued a security advisory for kpatch live patch modules targeting kernel-4.18.0-305.120.1.el8_4 to address two denial of service vulnerabilities identified as CVE-2024-41090 and CVE-2024-41091. These vulnerabilities affect the virtio-net tap and tun drivers in conjunction with mlx5_core, potentially allowing short frame denial of service attacks. The advisory provides updated kpatch modules (kpatch-patch-4_18_0-305_120_1 and kpatch-patch-4_18_0-305_138_1) as fixes. The update requires a system reboot to activate the patch. The vulnerabilities are rated with an important security impact by Red Hat, and no CVSS score is provided in the advisory.

The vulnerabilities can cause denial of service conditions in the kernel's virtio-net tap and tun drivers when used with mlx5_core. This could disrupt network functionality on affected systems running the specified kernel version. No known exploits in the wild have been reported. The impact is limited to denial of service and does not indicate privilege escalation or code execution.

Red Hat has released updated kpatch live patch modules to address these vulnerabilities. Users should apply the kpatch-patch-4_18_0-305_120_1 and kpatch-patch-4_18_0-305_138_1 updates for Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. After applying the update, a system reboot is required for the patch to take effect. Refer to Red Hat's official update guide at https://access.redhat.com/articles/11258 for detailed instructions.