Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
* kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
* kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)
* kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
* kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
* kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
* kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
* kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
* kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)
* kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
* kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
* kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
* kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
* kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
* kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)
Bug Fix(es) and Enhancement(s):
* Rocky Linux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-10.2.z] (JIRA:Rocky Linux-166047)
* Rocky Linux9.5 crash due to lpfc NULL ndlp->vport [rhel-10.2.z] (JIRA:Rocky Linux-171774)
* objtool static_call check blocks build of out-of-tree livepatch modules on Rocky Linux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:Rocky Linux-178495)
* ibmveth Adapter Freeze with Small MSS [rhel-10.2.z] (JIRA:Rocky Linux-179723)
* rbd: eliminate a race in lock_dwork draining on unmap [rhel-10.2.z] (JIRA:Rocky Linux-183127)
* Rocky Linux10.0 - s390/mm: Add missing secure storage access fixups [rhel-10.2.z] (JIRA:Rocky Linux-183319)
* [Rocky Linux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:Rocky Linux-182299)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | kernel | 0:6.12.0-211.26.1.el10_2 |
Vulnerabilities 15
-
Critical 9.8
mptcp: fix slab-use-after-free in __inet_lookup_established
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…
-
High 8.8
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), o…
-
High 8.8
wifi: mac80211: remove station if connection prep fails
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep …
-
High 8.8
wifi: mac80211: drop stray 'static' from fast-RX rx_result
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent ca…
-
High 8.8
wifi: mac80211: use safe list iteration in radar detect work
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to a…
-
High 7.8
can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access to so->tx.buf. isotp_release() waits for ISOTP_IDLE via wait_e…
-
High 7.8
rxrpc: Fix RxGK token loading to check bounds
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length from the XDR token as u32 values and passes each through round_up(x, 4) …
-
High 7.8
Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync hci_le_big_create_sync() uses DEFINE_FLEX to allocate a struct hci_cp_le_big_create_sync on the stack with room for 0x…
-
High 7.8
Buffer overflow in drivers/xen/sys-hypervisor.c
In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as …
-
High 7.8
net: mana: fix use-after-free in add_adev() error path
In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in add_adev() error path If auxiliary_device_add() fails, add_adev() jumps to add_fail and calls auxiliary_device_uninit(adev). The auxiliary device has its rele…
-
High 7.8
crypto: caam - fix overflow on long hmac keys
In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix overflow on long hmac keys When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be roun…
-
High 7.8
exit: prevent preemption of oopsing TASK_DEAD task
In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dea…
-
High 7.8CVE-2026-46331 Public exploit
net/sched: fix pedit partial COW leading to page cache corruption
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hi…
-
Unscored —CVE-2026-31787 Public exploit
xen/privcmd: fix double free via VMA splitting
In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, th…
-
Unscored —
bnxt_en: Fix RSS context delete logic
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the V…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2467083
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482634
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460646
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2479492
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464096
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2461548
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464502
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464449
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482645
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2461503
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2468061
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482181
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482563
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482608
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2464092