Summary
[5.15.0-321.202.5.2]
- net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Muhammad Alifa Ramdhan) [Orabug: 39543209] {CVE-2026-31533}
- net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich) [Orabug: 39543208] {CVE-2026-31504}
- net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru) [Orabug: 39543201] {CVE-2022-50073}
- mptcp: fix slab-use-after-free in __inet_lookup_established (Jiayuan Chen) [Orabug: 39543200] {CVE-2026-31669}
- batman-adv: hold claim backbone gateways by reference (Haoze Xie) [Orabug: 39543197] {CVE-2026-31657}
- arm64: dts: pensando: drop elba penfw firmware node (Tom Saeger) [Orabug: 39543196]
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek-container | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek-container-debug | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek-core | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek-debug | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-core | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-devel | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-modules | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-modules-extra | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek-devel | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek-doc | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek-modules | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek-modules-extra | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek64k | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek64k-core | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek64k-devel | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek64k-modules | 0:5.15.0-321.202.5.2.el9uek |
| Oracle Linux · 8 | kernel-uek64k-modules-extra | 0:5.15.0-321.202.5.2.el9uek |
Vulnerabilities 5
-
Critical 9.8
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption The -EBUSY handling in tls_do_encryption(), introduced by commit 859054147318 ("net: tls: handle backlogging of crypto re…
-
Critical 9.8
batman-adv: hold claim backbone gateways by reference
In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by reference batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway's last reference while readers still follow the pointer. T…
-
Critical 9.8
mptcp: fix slab-use-after-free in __inet_lookup_established
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…
-
High 7.8
net: fix fanout UAF in packet_release() via NETDEV_UP race
In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registra…
-
Unscored —
net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null
In the Linux kernel, the following vulnerability has been resolved: net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null Fixes a NULL pointer derefence bug triggered from tap driver. When tap_get_user calls virtio_net_hdr_to_skb…