An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2
 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of
 Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables
 fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: ktls overwrites readonly memory pages when using function splice with
 a ktls socket as destination (CVE-2024-0646)

* kernel: sctp: fail if no bound addresses can be used for a given scope
 (CVE-2023-1074)

* kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)

* kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)

* kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)

* kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

* kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)

* kernel: use-after-free in IPv4 IGMP (CVE-2023-6932)

* kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

* kernel: drivers/usb/storage/ene_ub6250.c (CVE-2023-45862)

For more details about the security issue(s), including the impact, a CVSS
 score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-1074: Missing Release of Memory after Effective Lifetime (CWE-401)
CVE-2023-6356: NULL Pointer Dereference (CWE-476)
CVE-2023-6535: NULL Pointer Dereference (CWE-476)
CVE-2023-6536: NULL Pointer Dereference (CWE-476)
CVE-2023-6606: Out-of-bounds Read (CWE-125)
CVE-2023-6610: Out-of-bounds Read (CWE-125)
CVE-2023-6932: Use After Free (CWE-416)
CVE-2023-7192: Missing Release of Memory after Effective Lifetime (CWE-401)
CVE-2023-45862
CVE-2024-0646