Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)
* kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)
* kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)
* kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)
* kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
* kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
* kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)
* kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)
* kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)
* kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)
* kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)
* kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()
Bug Fix(es) and Enhancement(s):
* nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running bz1477872 testcase (JIRA:Rocky Linux-173103)
* tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [rhel-10.2.z] (JIRA:Rocky Linux-183975)
* [Rocky Linux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [rhel-10.2.z] (JIRA:Rocky Linux-186311)
* ice: driver update 2026-06, part 1 [rhel-10.2.z] (JIRA:Rocky Linux-191324)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | kernel | 0:6.12.0-211.37.1.el10_2 |
Vulnerabilities 11
-
High 8.8
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the…
-
High 7.8
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y sta…
-
High 7.8CVE-2026-46215 Public exploit
drm: Set old handle to NULL before prime swap in change_handle
In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent …
-
High 7.8
drm/xe/dma-buf: fix UAF with retry loop
In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: fix UAF with retry loop Retry doesn't work here, since bo will be freed on error, leading to UAF. However, now that we do the alloc & init before the attach, we can now combin…
-
High 7.8
drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Two error handling issues exist in xe_exec_queue_create_ioctl(): 1. When xe_hw_engine_group_add_exec_queue() fails, the error path ju…
-
High 7.8
ice: fix double-free of tx_buf skb
In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid …
-
High 7.1
fanotify: fix false positive on permission events
In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping …
-
Unscored —
crypto: af_alg - zero initialize memory allocated via sock_kmalloc
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, relying on callers to s…
-
Unscored —
KEYS: trusted: Fix a memory leak in tpm2_load_cmd
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix a memory leak in tpm2_load_cmd 'tpm2_load_cmd' allocates a tempoary blob indirectly via 'tpm2_key_decode' but it is not freed in the failure paths. Address this by wrapping…
-
Unscored —
flex_proportions: make fprop_new_period() hardirq safe
In the Linux kernel, the following vulnerability has been resolved: flex_proportions: make fprop_new_period() hardirq safe Bernd has reported a lockdep splat from flexible proportions code that is essentially complaining about the following race: <timer fires…
-
Unscored —
cxl/port: Fix use after free of parent_port in cxl_detach_ep()
In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2460644
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2439941
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492284
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2429611
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492390
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482523
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492458
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2432366
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492318
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482612
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482615