{"id":"MGASA-2022-0308","summary":"Updated kernel-linus packages fix security vulnerabilities","details":"This kernel update is based on upstream 5.15.62 and fixes at least the\nfollowing security issues:\n\nA use-after-free flaw was found in the Linux kernel Atheros wireless adapter\ndriver in the way a user forces the ath9k_htc_wait_for_target function to\nfail with some input messages. This flaw allows a local user to crash or\npotentially escalate their privileges on the system (CVE-2022-1679).\n\nA use-after-free flaw was found in the Linux kernel’s POSIX CPU timers\nfunctionality in the way a user creates and then deletes the timer in the\nnon-leader thread of the program. This flaw allows a local user to crash\nor potentially escalate their privileges on the system (CVE-2022-2585).\n\nA use-after-free flaw was found in nf_tables cross-table in the\nnet/netfilter/nf_tables_api.c function in the Linux kernel. This flaw allows\na local, privileged attacker to cause a use-after-free problem at the time\nof table deletion, possibly leading to local privilege escalation\n(CVE-2022-2586).\n\nA use-after-free flaw was found in route4_change in the net/sched/cls_route.c\nfilter implementation in the Linux kernel. This flaw allows a local,\nprivileged attacker to crash the system, possibly leading to a local\nprivilege escalation issue (CVE-2022-2588).\n\nA flaw was found in hw. In certain processors with Intel's Enhanced Indirect\nBranch Restricted Speculation (eIBRS) capabilities, soon after VM exit or\nIBPB command event, the linear address following the most recent near CALL\ninstruction prior to a VM exit may be used as the Return Stack Buffer (RSB)\nprediction (CVE-2022-26373).\n\nnfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through\n5.18.14 allows remote attackers to cause a denial of service  (panic) because,\nin the case of an nf_queue verdict with a one-byte nfta_payload attribute,\nan skb_pull can encounter a negative skb-\u003elen (CVE-2022-36946).\n\nx86/bugs: Enable STIBP for IBPB mitigated RETBleed.\n\nOther fixes in this update:\n- add support for more tcp congestion control algos (mga #30725)\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","modified":"2026-02-01T17:03:23.840024Z","published":"2022-08-25T21:21:07Z","related":["CVE-2022-1679","CVE-2022-2585","CVE-2022-2586","CVE-2022-2588","CVE-2022-26373","CVE-2022-36946"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2022-0308.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=30762"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=30725"},{"type":"REPORT","url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.59"},{"type":"REPORT","url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.60"},{"type":"REPORT","url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.61"},{"type":"REPORT","url":"https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.62"}],"affected":[{"package":{"name":"kernel-linus","ecosystem":"Mageia:8","purl":"pkg:rpm/mageia/kernel-linus?arch=source&distro=mageia-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.62-1.mga8"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2022-0308.json"}}],"schema_version":"1.7.3","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}