Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007)
* kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)
* kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)
* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
* kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)
* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
* kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)
* kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)
* kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923)
* kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)
* kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)
* kernel: netfilter: handle unreadable frags (CVE-2026-64414)
* kernel: hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456)
* kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)
* kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
* kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)
* kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
* kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)
* kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)
Bug Fix(es) and Enhancement(s):
* nouveau vga_switcheroo binding holds Realtek ALC245 converter stream open ? analog output (device 0) returns EBUSY [rhel-10.2.z] (JIRA:Rocky Linux-239776)
* Rocky Linux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-10.2.z] (JIRA:Rocky Linux-254105)
* RHIVOS - [backport] S32G Fix STM driver linking failing modpost (JIRA:Rocky Linux-255225)
* RHIVOS - [backport] S32G Driver Enablement - OCOTP (JIRA:Rocky Linux-255516)
* RHIVOS - [backport] S32G Driver Enablement - INA231 (JIRA:Rocky Linux-255518)
* RHIVOS - [backport] S32G Driver Enablement - PIT (JIRA:Rocky Linux-255519)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | kernel | 0:6.12.0-211.56.1.el10_2.0.1 |
Vulnerabilities 19
-
Critical 9.8
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus I…
-
High 8.8
octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled…
-
High 8.8
ice: reject out-of-range ptype in ice_parser_profile_init
In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF fr…
-
High 8.8
net: qrtr: restrict socket creation to the initial network namespace
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…
-
High 8.4
net: wwan: t7xx: fix potential skb->frags overflow in RX path
In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: fix potential skb->frags overflow in RX path When receiving data in the DPMAIF RX path, the t7xx_dpmaif_set_frag_to_skb() function adds page fragments to an skb without check…
-
High 8.1
wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but r…
-
High 7.8
net: ena: PHC: Fix potential use-after-free in get_timestamp
In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Fix potential use-after-free in get_timestamp Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked withou…
-
High 7.8
ALSA: timer: Fix UAF at snd_timer_user_params()
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the…
-
High 7.8
ALSA: timer: Forcibly close timer instances at closing
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tr…
-
High 7.8
ALSA: seq: Serialize UMP output teardown with event_input
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_u…
-
High 7.8
net: slip: serialize receive against buffer reallocation
In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through…
-
High 7.8
ALSA: timer: don't re-enter an instance callback that is still running
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two thr…
-
High 7.8
dm_early_create: fix freeing used table on dm_resume failure
In the Linux kernel, the following vulnerability has been resolved: dm_early_create: fix freeing used table on dm_resume failure If dm_resume fails, the kernel attempts to free table with dm_table_destroy, but the table was already instantiated with dm_swap_t…
-
High 7.7
hwrng: virtio: clamp device-reported used.len at copy_data()
In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi-…
-
High 7.6
wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_AN…
-
High 7.5
wifi: iwlwifi: mld: stop TX during firmware restart
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart t…
-
High 7.5
netfilter: handle unreadable frags
In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments (such as from devmem TCP, where skb_frags_readable(skb) returns false) is processed by the u32 module…
-
Unscored —
soc: qcom: socinfo: Avoid out of bounds read of serial number
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: socinfo: Avoid out of bounds read of serial number On MSM8916 devices, the serial number exposed in sysfs is constant and does not change across individual devices. It's always: db…
-
Unscored —
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348565
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2439924
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492436
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492741
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492742
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492792
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502295
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502347
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502418
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502575
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502596
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507102
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2507255
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513171
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513218
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513271
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513286
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513353
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2516490
-
advisory
https://access.redhat.com/errata/RHSA-2026:68507