Red Hat Enterprise Linux 9 update for kernel
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 12 |
| CVE-ID | CVE-2024-26638 CVE-2023-52623 CVE-2024-26669 CVE-2024-26939 CVE-2024-35838 CVE-2024-35847 CVE-2023-52662 CVE-2024-36917 CVE-2024-41042 CVE-2024-56615 CVE-2025-21764 CVE-2024-58099 |
| CWE-ID | CWE-908 CWE-667 CWE-401 CWE-416 CWE-200 CWE-415 CWE-119 CWE-20 CWE-125 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
Red Hat Enterprise Linux for x86_64 - Extended Update Support Operating systems & Components / Operating system Red Hat Enterprise Linux Server - AUS Operating systems & Components / Operating system Red Hat Enterprise Linux for IBM z Systems - Extended Update Support Operating systems & Components / Operating system Red Hat Enterprise Linux for Power, little endian - Extended Update Support Operating systems & Components / Operating system Red Hat Enterprise Linux for ARM 64 - Extended Update Support Operating systems & Components / Operating system Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions Operating systems & Components / Operating system package or component kernel (Red Hat package) Operating systems & Components / Operating system package or component |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 12 vulnerabilities.
1) Use of uninitialized resource
EUVDB-ID: #VU90881
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-26638
CWE-ID:
CWE-908 - Use of Uninitialized Resource
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to use of uninitialized resource within the __sock_xmit() function in drivers/block/nbd.c. A local user can perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server - AUS: 9.4
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 9.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 9.4
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 9.4
kernel (Red Hat package): before 5.14.0-427.74.1.el9_4
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_enterprise_linux_server_for_ibm_power_le_-_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:kernel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:9584
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper locking
EUVDB-ID: #VU92046
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-52623
CWE-ID:
CWE-667 - Improper Locking
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper locking within the xprt_iter_current_entry() and rpc_xprt_switch_has_addr() functions in net/sunrpc/xprtmultipath.c. A local user can perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server - AUS: 9.4
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 9.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 9.4
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 9.4
kernel (Red Hat package): before 5.14.0-427.74.1.el9_4
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_enterprise_linux_server_for_ibm_power_le_-_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:kernel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:9584
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Memory leak
EUVDB-ID: #VU90010
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-26669
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the fl_tmplt_destroy() function in net/sched/cls_flower.c, within the tcf_block_playback_offloads() and tc_chain_tmplt_add() functions in net/sched/cls_api.c, within the void() function in include/net/sch_generic.h. A local user can perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server - AUS: 9.4
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 9.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 9.4
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 9.4
kernel (Red Hat package): before 5.14.0-427.74.1.el9_4
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_enterprise_linux_server_for_ibm_power_le_-_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:kernel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:9584
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Use-after-free
EUVDB-ID: #VU90181
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-26939
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the active_to_vma() and i915_vma_pin_ww() functions in drivers/gpu/drm/i915/i915_vma.c. A local user can escalate privileges on the system.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server - AUS: 9.4
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 9.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 9.4
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 9.4
kernel (Red Hat package): before 5.14.0-427.74.1.el9_4
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_enterprise_linux_server_for_ibm_power_le_-_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:kernel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:9584
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Information disclosure
EUVDB-ID: #VU91346
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-35838
CWE-ID:
CWE-200 - Exposure of sensitive information to an unauthorized actor
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to information disclosure within the sta_info_free() function in net/mac80211/sta_info.c. A local user can gain access to sensitive information.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server - AUS: 9.4
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 9.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 9.4
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 9.4
kernel (Red Hat package): before 5.14.0-427.74.1.el9_4
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_enterprise_linux_server_for_ibm_power_le_-_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:kernel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:9584
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Double free
EUVDB-ID: #VU90891
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-35847
CWE-ID:
CWE-415 - Double Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a double free error within the its_vpe_irq_domain_alloc() function in drivers/irqchip/irq-gic-v3-its.c. A local user can perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server - AUS: 9.4
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 9.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 9.4
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 9.4
kernel (Red Hat package): before 5.14.0-427.74.1.el9_4
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_enterprise_linux_server_for_ibm_power_le_-_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:kernel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:9584
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Memory leak
EUVDB-ID: #VU90444
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-52662
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the vmw_gmrid_man_get_node() function in drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c. A local user can perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server - AUS: 9.4
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 9.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 9.4
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 9.4
kernel (Red Hat package): before 5.14.0-427.74.1.el9_4
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_enterprise_linux_server_for_ibm_power_le_-_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:kernel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:9584
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Buffer overflow
EUVDB-ID: #VU92094
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-36917
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to memory corruption within the blk_ioctl_discard() function in block/ioctl.c. A local user can escalate privileges on the system.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server - AUS: 9.4
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 9.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 9.4
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 9.4
kernel (Red Hat package): before 5.14.0-427.74.1.el9_4
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_enterprise_linux_server_for_ibm_power_le_-_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:kernel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:9584
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Input validation error
EUVDB-ID: #VU95003
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-41042
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the nf_tables_rule_release(), nft_chain_validate(), nft_chain_validate_hooks() and nft_validate_register_store() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server - AUS: 9.4
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 9.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 9.4
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 9.4
kernel (Red Hat package): before 5.14.0-427.74.1.el9_4
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_enterprise_linux_server_for_ibm_power_le_-_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:kernel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:9584
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Out-of-bounds read
EUVDB-ID: #VU102083
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-56615
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds read error within the dev_map_alloc(), dev_map_delete_elem() and dev_map_hash_delete_elem() functions in kernel/bpf/devmap.c. A local user can perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server - AUS: 9.4
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 9.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 9.4
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 9.4
kernel (Red Hat package): before 5.14.0-427.74.1.el9_4
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_enterprise_linux_server_for_ibm_power_le_-_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:kernel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:9584
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Use-after-free
EUVDB-ID: #VU104950
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2025-21764
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the ndisc_alloc_skb() function in net/ipv6/ndisc.c. A local user can escalate privileges on the system.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server - AUS: 9.4
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 9.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 9.4
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 9.4
kernel (Red Hat package): before 5.14.0-427.74.1.el9_4
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_enterprise_linux_server_for_ibm_power_le_-_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:kernel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:9584
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Input validation error
EUVDB-ID: #VU108057
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-58099
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the vmxnet3_xdp_xmit_frame() function in drivers/net/vmxnet3/vmxnet3_xdp.c. A local user can perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for x86_64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server - AUS: 9.4
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 9.4
Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 9.4
Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 9.4
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 9.4
kernel (Red Hat package): before 5.14.0-427.74.1.el9_4
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_x86_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_-_aus:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64_-_extended_update_support:9.4:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:red_hat_enterprise_linux_server_for_ibm_power_le_-_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:kernel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2025:9584
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
