Fixed packages 92
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-debug | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-debug-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-debug-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-debug-devel | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-debug-devel-matched | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-debug-modules | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-debug-modules-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-debug-modules-extra | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-devel | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-devel-matched | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-modules | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-modules-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-64k-modules-extra | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-abi-stablelists | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debug | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debug-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debug-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debug-devel | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debug-devel-matched | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debug-modules | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debug-modules-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debug-modules-extra | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debug-uki-virt | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debuginfo-common-aarch64 | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debuginfo-common-ppc64le | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debuginfo-common-s390x | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-debuginfo-common-x86_64 | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-devel | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-devel-matched | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-doc | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-modules | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-modules-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-modules-extra | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-modules-extra-matched | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-debug | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-debug-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-debug-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-debug-devel | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-debug-modules | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-debug-modules-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-debug-modules-extra | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-devel | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-modules | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-modules-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-64k-modules-extra | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-debug | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-debug-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-debug-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-debug-devel | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-debug-modules | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-debug-modules-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-debug-modules-extra | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-devel | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-modules | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-modules-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-rt-modules-extra | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-tools | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-tools-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-tools-libs | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-tools-libs-devel | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-uki-virt | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-uki-virt-addons | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-zfcpdump | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-zfcpdump-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-zfcpdump-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-zfcpdump-devel | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-zfcpdump-devel-matched | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-zfcpdump-modules | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-zfcpdump-modules-core | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | kernel-zfcpdump-modules-extra | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | libperf | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | libperf-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | perf | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | perf-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | python3-perf | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | python3-perf-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | rtla | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | rtla-debuginfo | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | rv | 0:6.12.0-264.14.1.el10_3 |
| Red Hat · RHEL 10 enterprise_linux:10.3 | rv-debuginfo | 0:6.12.0-264.14.1.el10_3 |
Vulnerabilities 90
-
Critical 10.0
udp: fix potential use-after-free in tunnel segmentation
In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation __skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head…
-
Critical 9.8
NFSD: Fix SECINFO_NO_NAME decode error cleanup
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfser…
-
Critical 9.8
idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() In idpf_ptp_init(), read_dev_clk_lock is initialized after ptp_schedule_worker() had already been called (and after idpf_ptp_setti…
-
Critical 9.8
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengine_prep_slave_sg() fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX cha…
-
Critical 9.8
openvswitch: fix GSO userspace truncation underflow
In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments …
-
Critical 9.8
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() …
-
Critical 9.8
SUNRPC: pin upper rpc_clnt across the TLS connect_worker
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc_clnt across the TLS connect_worker The TLS connect path has a use-after-free: nothing pins the upper rpc_clnt across the delayed connect_worker. xs_connect() stores task…
-
Critical 9.8
netfilter: flowtable: publish GC-visible tuple last
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe an…
-
Critical 9.8
svcrdma: Validate Read chunk positions before reconstruction
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdr_count_re…
-
Critical 9.8
svcrdma: Reject inline replies that overflow the pull-up buffer
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to ca…
-
Critical 9.8
nfsd: initialize copy-notify stateid before publishing it
In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already linked it into the s2s_cp_s…
-
Critical 9.8
nfsd: fix UAF in async copy cancel and shutdown
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced th…
-
Critical 9.8
nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids IDR was pointed at &u->…
-
Critical 9.8
nfsd: don't free session slots that are still in use
In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4_sequence() can free the very slot it is currently processing. When the session shrinker has reduced se_target_maxslots below se_fcha…
-
Critical 9.8
nvmet-auth: Synchronize timeout work during SQ teardown
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait …
-
Critical 9.8
nvme: add missing SRCU grace period in error path
In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wa…
-
Critical 9.8
NFSD: Prevent client use-after-free during blocked-lock reaping
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn->blocked_locks_lru -- holds a raw pointer to its nfs4_cl…
-
Critical 9.8
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry svcauth_gss_decode_credbody() writes the caller's rpc_gss_wire_cred field by field and assigns gc_ctx.len only on the suc…
-
Critical 9.8CVE-2026-98432 Public exploit
ipv4: free inet_opt and ireq_opt after an RCU grace period
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu…
-
Critical 9.3
virt: tdx-guest: Just leak decrypted memory on unrecoverable errors
In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors In CoCo VMs it is possible for the untrusted host to cause set_memory_decrypted() to fail such that an error is returned an…
-
Critical 9.3
KVM: arm64: vgic: Check the interrupt is still ours before migrating it
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating an interrupt to another vCPU. After reacquiri…
-
Critical 9.3
KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappin…
-
Critical 9.1
smb: client: reject a tree connect response whose byte count is too small
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 …
-
Critical 9.1
scsi: target: iscsi: Reserve a terminator byte for the login payload
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test i…
-
Critical 9.1
svcrdma: Reject Write/Reply chunks with segcount 0
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdr_check_write_chunk() only rejects segcount > rc_maxpages, so zero pa…
-
High 8.8
vfio/pci: Check BAR resources before exporting a DMABUF
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved …
-
High 8.8
vsock/vmci: fix UAF when peer resets connection during handshake
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRA…
-
High 8.8
drm/amdgpu/vce: fix integer overflow in image size
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions (e.g. 65536×65536) cause 32-bit integer overflow,…
-
High 8.8
Bluetooth: hci_sync: Fix advertising data UAFs
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix advertising data UAFs hci_find_adv_instance() returns an adv_info pointer that is valid only while hdev->lock is held. The advertising command-sync paths perform inst…
-
High 8.8
KVM: s390: vsie: zero stale crypto bits
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and…
-
High 8.8
nfsd: revoke copy-notify stateids before dropping their reference
In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2s_cp_stateids IDR and on their parent stid's sc_cp_list, pinned by a single membership ref…
-
High 8.8
vfio/pci: clear vdev->msi_perm after freeing it on init failure
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KER…
-
High 8.8
drm/amdkfd: Add TLB flush after MES queue eviction/suspension
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES (Micro Engine Scheduler) does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this au…
-
High 8.4
xfs: bounds-check buffer log item's dirty bitmap
In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpy(xfs_…
-
High 8.4CVE-2026-89603 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
High 8.4
virtio-fs: avoid double-free on failed queue setup
In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees bo…
-
High 8.2
KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a sep…
-
High 8.1
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucv_hs_rcv() by ingress device afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte name fields in the transport header alone. No check is …
-
High 7.9
KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nested_svm_l2_tlb_flush_enabl…
-
High 7.8
openvswitch: defer tunnel netdev_put to RCU release
In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race …
-
High 7.8
vhost: move vdpa group bound check to vhost_vdpa
In the Linux kernel, the following vulnerability has been resolved: vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in v…
-
High 7.8
RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() mlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When ib_create_srq() fails for s1, the error branch destroys s0 …
-
High 7.8
net/sched: act_ct: Only release RCU read lock after ct_ft
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read c…
-
High 7.8
net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch In advance_sched(), when should_change_schedules() returns true, switch_schedules() is called to promote the admin …
-
High 7.8CVE-2026-53264 Public exploit
net/sched: act_api: use RCU with deferred freeing for action lifecycle
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illu…
-
High 7.8CVE-2026-53365 Public exploit
vsock/virtio: fix zerocopy completion for multi-skb sends
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. …
-
High 7.8
fuse: re-lock request before replacing page cache folio
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end th…
-
High 7.8
vsock/virtio: bind uarg before filling zerocopy skb
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: bind uarg before filling zerocopy skb virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg before entering the send loop, but virtio_transport_alloc_skb() stil…
-
High 7.8
i2c: stub: Reject I2C block transfers with invalid length
In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…
-
High 7.8
fuse: re-lock request before returning from fuse_ref_folio()
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async…
-
High 7.8
ALSA: hda/cs35l41: Fix firmware load work teardown
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41_hda creates ALSA controls whose private data points at the cs35l41_hda object. The firmware load control can also queue fw_load_work…
-
High 7.8
net: slip: serialize receive against buffer reallocation
In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through…
-
High 7.8
ALSA: seq: close a re-opened queue timer in the destructor
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains…
-
High 7.8
drm/amd/display: set new_stream to NULL after release
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a l…
-
High 7.8
drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_i…
-
High 7.8
net/sched: act_tunnel_key: Defer dst_release to RCU callback
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_tunnel_key: Defer dst_release to RCU callback Fix a race-condition use-after-free in tunnel_key_release_params(). The function releases the metadata_dst of the old params synch…
-
High 7.8
tipc: require net admin for TIPCv2 netlink mutators
In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAP_NET_ADMIN when an oper…
-
High 7.8
Bluetooth: mgmt: fix UAF in pair command cancellation
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending…
-
High 7.8
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() The failed_dev_add and failed_dev_name paths drop the file-device reference while wq->wq_lock is still held. If put_device(…
-
High 7.8
ALSA: usx2y: bound the hwdep mmap fault offset
In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf->pgoff << PAGE_SHIFT; vadd…
-
High 7.8CVE-2026-80521 Public exploit
af_unix: Unlink scc_entry in unix_del_edge().
In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the followin…
-
High 7.8CVE-2026-81000 Public exploit
net: tun: bound receive headroom
In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request fro…
-
High 7.8
nfsd: defer vfree of compound ops to fix rpc_status UAF
In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_status netlink dumpit walks every in-flight svc_rqst under rcu_read_lock and, for NFSv4 requests, reads opnums out of args->ops…
-
High 7.8
perf: Fix use-after-free when perf mmap() revival races with the last munmap()
In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap() revival races with the last munmap() perf_mmap_close() drops rb->mmap_count *without* holding event->mmap_mutex (the refcount_dec_and_test() right be…
-
High 7.8
media: cx231xx: reject geometry changes while the VBI queue is busy
In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide dev->width / dev->norm but only refuse the change when the…
-
High 7.8
scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame, a DMA pool buffer of instance->max_chain_frame_sz byte…
-
High 7.8
nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition devic…
-
High 7.8
md/raid5-ppl: fix use-after-free in ppl_do_flush()
In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppl_do_flush() The loop in ppl_do_flush() continues iterating after calling ppl_io_unit_finished(), touching io->pending_flushes and leading to a use-after…
-
High 7.8
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grac…
-
High 7.8
perf: Fix addr_filter_ranges lifetime
In the Linux kernel, the following vulnerability has been resolved: perf: Fix addr_filter_ranges lifetime Lee Jia Jie reported that since event::addr_filter_ranges is used under RCU, it should be RCU freed.
-
High 7.8CVE-2026-98256 Public exploit
signal: Prevent exec() race
In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec() race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in __send_signal_locked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by tas…
-
High 7.8CVE-2026-98260 Public exploit
exec: Cleanup POSIX timers right after de_thread()
In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after de_thread() A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that threa…
-
High 7.8
netfilter: flowtable: hold reference on ct until flow is released
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from…
-
High 7.8
xfrm: hold net_device reference under RCU in bundle creation
In the Linux kernel, the following vulnerability has been resolved: xfrm: hold net_device reference under RCU in bundle creation xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into a local pointer without taking a device reference, then pas…
-
High 7.8
xfs: fix exchange-range-to-eof file size exchange
In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag. The bug tricks exchange-…
-
High 7.3
OPP: add index check to assert to avoid buffer overflow in _read_freq()
In the Linux kernel, the following vulnerability has been resolved: OPP: add index check to assert to avoid buffer overflow in _read_freq() Pass the freq index to the assert function to make sure we do not read a freq out of the opp->rates[] table when called…
-
High 7.3
can: bcm: add locking for bcm_op runtime updates
In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be chan…
-
High 7.1CVE-2026-53361 Public exploit
af_unix: Set gc_in_progress to true in unix_gc().
In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thre…
-
Unscored —
calipso: Don't call calipso functions for AF_INET sk.
In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6…
-
Unscored —
KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the d…
-
Unscored —
USB: serial: mxuport: fix memory corruption with small endpoint
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mxuport: fix memory corruption with small endpoint Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a …
-
Unscored —
usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() svdm_consume_modes() checks pmdata->altmodes against the array size once before the loop over the count, but forgo…
-
Unscored —CVE-2026-64507 Public exploit
x86/bugs: Enable IBPB flush on BPF JIT allocation
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip…
-
Unscored —
bpf: Support for hardening against JIT spraying
In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are lo…
-
Unscored —
drm/dp/mst: fix buffer overflows in sideband chunk accumulation
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length cur…
-
Unscored —
ovl: check access to copy_file_range source with src mounter creds
In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_…
-
Unscored —
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usb_device in usbdev_release() usbdev_release() drops its reference to the struct usb_device before draining the list of completed async URBs, but that drain…
-
Unscored —
drm/vmwgfx: use check_add_overflow for shader size+offset bound
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64…
-
Unscored —
KEYS: encrypted: fix integer overflow of datablob_len
In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of datablob_len encrypted_key_alloc() stores datablob_len in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16_MA…
-
Unscored —
nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output buffer as a void pointer. sizeof(*d) therefore evaluates to one with GCC and undercoun…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2337112
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348578
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2370992
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2376106
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2461761
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2467084
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2481992
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482594
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486979
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492286
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492851
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2497035
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2499742
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502222
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502241
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502255
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502325
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502356
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502411
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502521
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502547
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502593
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502872
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507038
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507098
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507153
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507218
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507222
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513148
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513218
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513245
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513277
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513287
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513361
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513430
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513451
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2514462
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2516579