Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202)
* kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)
* kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)
* kernel: perf/aux: Fix page UAF in map_range() (CVE-2026-64300)
Bug Fix(es) and Enhancement(s):
* netfilter: CVE backports for Rocky Linux 10.2.z (JIRA:Rocky Linux-185311)
* tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [rhel-10.2.z] (JIRA:Rocky Linux-214436)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | kernel | 0:6.12.0-211.47.1.el10_2 |
Vulnerabilities 4
-
Critical 9.8
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_…
-
High 7.8
accel/ivpu: Fix signed integer truncation in IPC receive
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied data_size is cast to signed int before being used in min_t(). Large unsigned val…
-
High 7.8CVE-2026-53264 Public exploit
net/sched: act_api: use RCU with deferred freeing for action lifecycle
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illu…
-
High 7.8
perf/aux: Fix page UAF in map_range()
In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are seri…