Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
* kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
* kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
* kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
* kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
* kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
* kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
* kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
* kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
* kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | kernel | 0:4.18.0-553.164.1.el8_10 |
Vulnerabilities 22
-
Critical 9.8
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus I…
-
Critical 9.8
ipv6: sit: reload inner IPv6 header after GSO offloads
In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For …
-
Critical 9.8
xfrm: fix stale skb->prev after async crypto steals a GSO segment
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…
-
Critical 9.4
netfilter: require Ethernet MAC header before using eth_hdr()
In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`…
-
Critical 9.1
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255);…
-
High 8.8CVE-2026-53075 Public exploit
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
In the Linux kernel, the following vulnerability has been resolved: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls /dev/ppp open is currently authorized against file->f_cred->user_ns, while unattached administrative ioctls operate on current…
-
High 8.8
ipv6: mcast: Fix use-after-free when processing MLD queries
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer…
-
High 8.8
ip6: vti: Use ip6_tnl.net in vti6_changelink().
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -…
-
High 8.8
xfrm: input: hold netns during deferred transport reinjection
In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must…
-
High 8.8
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) …
-
High 8.3
netfilter: xt_policy: fix strict mode inbound policy matching
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume in…
-
High 8.2
netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`, which is still 0 from its initialization at the …
-
High 8.2
netfilter: conntrack_irc: fix possible out-of-bounds read
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This hel…
-
High 7.8
ipvlan: Make the addrs_lock be per port
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrs_lock be per port Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL.…
-
High 7.8
xfrm: hold dev ref until after transport_finish NF_HOOK
In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …
-
High 7.8
ipv6: prevent possible UaF in addrconf_permanent_addr()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 aft…
-
High 7.8
ALSA: timer: Fix UAF at snd_timer_user_params()
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the…
-
High 7.8
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_…
-
High 7.8
ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
In the Linux kernel, the following vulnerability has been resolved: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports too soon. Only after unr…
-
High 7.8
net: slip: serialize receive against buffer reallocation
In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through…
-
High 7.5
flow_dissector: do not dissect PPPoE PFC frames
In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PF…
-
High 7.1
net: guard timestamp cmsgs to real error queue skbs
In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sock…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2436771
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2461462
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2467135
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2468102
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2484456
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2486463
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492112
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492295
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492733
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492741
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492747
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492770
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492779
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492792
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492811
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2492841
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502363
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502368
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502412
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502434
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513218
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2513477
-
advisory
https://access.redhat.com/errata/RHSA-2026:68531