Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
* kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)
* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
* kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
* kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)
* kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)
* kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)
* kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)
* kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
* kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
* kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)
* kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
* kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
* kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
* kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)
* kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)
* kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
* kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)
* kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
* kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)
* kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
* kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
* kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)
Bug Fix(es) and Enhancement(s):
* CLONE - Rocky Linux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:Rocky Linux-223954)
* vhost: reset the vring metadata cache on vring reconfiguration [rhel-10.2.z] (JIRA:Rocky Linux-224545)
* cifs: periodic IO errors when rename races with lease break [rhel-10.2.z] (JIRA:Rocky Linux-235459)
* cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10.2.z] (JIRA:Rocky Linux-235812)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | kernel | 0:6.12.0-211.49.1.el10_2 |
Vulnerabilities 24
-
Critical 9.8
crypto: pcrypt - Fix handling of MAY_BACKLOG requests
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.
-
Critical 9.8
scsi: target: iscsi: Validate CHAP_R length before base64 decode
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passe…
-
Critical 9.8
scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce…
-
Critical 9.8
smb: client: fix query_info() replay double-free
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, c…
-
Critical 9.8
smb/client: handle overlapping allocated ranges in fallocate
In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current fallocate of…
-
Critical 9.1
smb/client: fix out-of-bounds read in symlink_data()
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlink_data() Since smb2_check_message() returns success without length validation for the symlink error response, in symlink_data() it is possible for …
-
High 8.8
drm/amdgpu: zero-initialize GART table on allocation
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a sin…
-
High 8.8
smb: client: fix double-free in SMB2_open() replay
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, clean…
-
High 8.4
memfd: deny writeable mappings when implying SEAL_WRITE
In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_EXEC is added, SEAL_WRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can n…
-
High 7.8
drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. Th…
-
High 7.8
drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 This commit simplifies the amdgpu_gem_va_ioctl function, key updates include: - Moved the lo…
-
High 7.8
drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 The address watch clear code receives watch_id as an unsigned value (u32), but some helper functions were using a signed int…
-
High 7.8
udf: fix partition descriptor append bookkeeping
In the Linux kernel, the following vulnerability has been resolved: udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in part_descs_loc[]. handle_partition_…
-
High 7.8
sched/psi: fix race between file release and pressure write
In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_fi…
-
High 7.8
drm/i915/gem: Fix phys BO pread/pwrite with offset
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be access…
-
High 7.8
drm/amdgpu: fix amdgpu_hmm_range_get_pages
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre…
-
High 7.8
drm/i915: Fix potential UAF in TTM object purge
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right po…
-
High 7.8
blk-mq: pop cached request if it is usable
In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_f…
-
High 7.8CVE-2026-64560 Public exploit
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() po…
-
High 7.1
smb: client: mask server-provided mode to 07777 in modefromsid
In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without …
-
High 7.0
drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA …
-
High 7.0
drm/amd/display: Use krealloc_array() in dal_vector_reserve()
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, whic…
-
High 7.0
drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack …
-
Unscored —
drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size [Why & How] The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and Hdmi6GRegNum fields that are used a…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482124
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502329
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2495950
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502422
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2479812
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2467202
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507135
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482113
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2467156
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492719
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2506790
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513470
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482558
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502443
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502188
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492403
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502321
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2508504
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507042
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507216
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502463
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492768
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2495941
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502449
-
advisory
https://access.redhat.com/errata/RHSA-2026:57251