Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
* kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)
* kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
* kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)
* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
* kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366)
* kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)
* kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
* kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)
* kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
* kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)
Bug Fix(es) and Enhancement(s):
* KSM to deduplicate only zero pages [rhel-9.8.z] (JIRA:Rocky Linux-249161)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | kernel | 0:5.14.0-687.46.1.el9_8 |
Vulnerabilities 17
-
Critical 9.8
crypto: pcrypt - Fix handling of MAY_BACKLOG requests
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.
-
Critical 9.8
netfilter: conntrack: remove sprintf usage
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer…
-
Critical 9.8
smb: client: fix double-free in SMB2_close() replay
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cle…
-
Critical 9.8
nvmet-rdma: handle inline data with a nonzero offset
In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits an…
-
Critical 9.8
net: bridge: stop fast-leave after deleting a port group
In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group br_multicast_leave_group() iterates mp->ports with pp = &p->next in its fast-leave path. After br_multicast_del_pg() removes p, contin…
-
Critical 9.3
net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_h…
-
Critical 9.1
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255);…
-
High 8.8
ipv6: mcast: Fix use-after-free when processing MLD queries
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer…
-
High 7.9
KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload of guest state") made KVM always use vmcb01 for the fields cont…
-
High 7.8
ipv6: prevent possible UaF in addrconf_permanent_addr()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 aft…
-
High 7.8
tcp: call sk_data_ready() after listener migration
In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, t…
-
High 7.8
Revert "net/smc: Introduce TCP ULP support"
In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The impl…
-
High 7.8
ipv4: account for fraggap on the paged allocation path
In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + trans…
-
High 7.8CVE-2026-64563 Public exploit
rhashtable: clear stale iter->p on table restart
In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-validates iter->p against the …
-
High 7.5
flow_dissector: do not dissect PPPoE PFC frames
In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PF…
-
High 7.1
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cu…
-
High 7.1
net: guard timestamp cmsgs to real error queue skbs
In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sock…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2467065
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2468102
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2479812
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2481936
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2482566
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2484456
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486463
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486999
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492329
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492811
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492841
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2501252
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502394
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2510892
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2511932
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2516731
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2517046
-
advisory
https://access.redhat.com/errata/RHSA-2026:66180