Affected: AlmaLinux:10: kernel, AlmaLinux:10: kernel-64k, AlmaLinux:10: kernel-64k-core, AlmaLinux:10: kernel-64k-debug, AlmaLinux:10: kernel-64k-debug-core, AlmaLinux:10: kernel-64k-debug-devel, AlmaLinux:10: kernel-64k-debug-devel-matched, AlmaLinux:10: kernel-64k-debug-modules, AlmaLinux:10: kernel-64k-debug-modules-core, AlmaLinux:10: kernel-64k-debug-modules-extra and 65 more
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211) * kernel: isofs: validate Rock Ridge CE continuation extent against volume size (CVE-2026-46303) * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle ()
Bug Fix(es) and Enhancement(s):
* [DELL 10.2 FEAT] [LATE-ADD] - Include support for Ghostrider PTL mini config SKU with Realtek IC Solution [almalinux-10.2.z] (JIRA:AlmaLinux-185669) * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-10.2.z] (JIRA:AlmaLinux-212063)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts
In the Linux kernel, the following vulnerability has been resolved:
ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing ksmd to use large amount of cpu without deduplicating much pages.
This patch replaces the per-address lookup with a range walk using walk_page_range(). The range walker allows KSM to skip over entire unmapped holes in a VMA, avoiding unnecessary lookups. This problem was previously discussed in [1].
Consider the following test program which creates a 32 TiB mapping in the virtual address space but only populates a single page:
#include <unistd.h> #include <stdio.h> #include <sys/mman.h>
/* 32 TiB */ const size_t size = 32ul * 1024 * 1024 * 1024 * 1024;
int main() { char *area = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);
if (area == MAP_FAILED) { perror("mmap() failed\n"); return -1; }
/* Populate a single page such that we get an anon_vma. */ *area = 0;
/* Enable KSM. */ madvise(area, size, MADV_MERGEABLE); pause(); return 0; }
$ ./ksm-sparse & $ echo 1 > /sys/kernel/mm/ksm/run
Without this patch ksmd uses 100% of the cpu for a long…
In the Linux kernel, the following vulnerability has been resolved:
ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing ksmd to use large amount of cpu without deduplicating much pages.
This patch replaces the per-address lookup with a range walk using walk_page_range(). The range walker allows KSM to skip over entire unmapped holes in a VMA, avoiding unnecessary lookups. This problem was previously discussed in [1].
Consider the following test program which creates a 32 TiB mapping in the virtual address space but only populates a single page:
#include <unistd.h> #include <stdio.h> #include <sys/mman.h>
/* 32 TiB */ const size_t size = 32ul * 1024 * 1024 * 1024 * 1024;
int main() { char *area = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0);
if (area == MAP_FAILED) { perror("mmap() failed\n"); return -1; }
/* Populate a single page such that we get an anon_vma. */ *area = 0;
/* Enable KSM. */ madvise(area, size, MADV_MERGEABLE); pause(); return 0; }
$ ./ksm-sparse & $ echo 1 > /sys/kernel/mm/ksm/run
Without this patch ksmd uses 100% of the cpu for a long…
Affected: openEuler:24.03-LTS-SP1: kernel
The Linux Kernel, the operating system core itself. Security Fix(es):
In the Linux kernel, the following vulnerability has been resolved:
udp: Deal with race between UDP socket address change and rehash
If a UDP socket changes its local address while it's receiving datagrams, as a result of connect(), there is a period during which a lookup operation might fail to find it, after the address is changed but before the secondary hash (port and address) and the four-tuple hash (local and remote ports and addresses) are updated.
Secondary hash chains were introduced by commit 30fff9231fad ("udp: bind() optimisation") and, as a result, a rehash operation became needed to make a bound socket reachable again after a connect().
This operation was introduced by commit 719f835853a9 ("udp: add rehash on connect()") which isn't however a complete fix: the socket will be found once the rehashing completes, but not while it's pending.
This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a client sending datagrams to it. After the server receives the first datagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to the address of the sender, in order to set up a directed flow.
Now, if the client, running on a different CPU thread, happens to send a (subsequent) datagram while the server's socket changes its address, but is not rehashed yet, this will result in a failed lookup and a port unreachable error delivered to the…
Security update for the Linux Kernel
kernel: Squashfs: sanity check symbolic link size kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels kernel: RDMA/mana: Validate rx_hash_key_len kernel: ipv6: fix possible UAF in icmpv6_rcv() kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() kernel: crypto: qat - validate RSA CRT component lengths kernel: net: bridge: stop fast-leave after deleting a port group kernel: vhost: reset the vring metadata cache on vring reconfiguration
Affected: Rocky Linux:10: kernel
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211)
* kernel: isofs: validate Rock Ridge CE continuation extent against volume size (CVE-2026-46303)
* kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle ()
Bug Fix(es) and Enhancement(s):
* [DELL 10.2 FEAT] [LATE-ADD] - Include support for Ghostrider PTL mini config SKU with Realtek IC Solution [rhel-10.2.z] (JIRA:Rocky Linux-185669)
* dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [rhel-10.2.z] (JIRA:Rocky Linux-212063)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security update for the Linux Kernel
Affected: Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 229 more
In the Linux kernel, the following vulnerability has been resolved: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing ksmd to use large amount of cpu without deduplicating much pages. This patch replaces the per-address lookup with a range walk using walk_page_range(). The range walker allows KSM to skip over entire unmapped holes in a VMA, avoiding unnecessary lookups. This problem was previously discussed in [1]. Consider the following test program which creates a 32 TiB mapping in the virtual address space but only populates a single page: #include <unistd.h> #include <stdio.h> #include <sys/mman.h> /* 32 TiB */ const size_t size = 32ul * 1024 * 1024 * 1024 * 1024; int main() { char *area = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0); if (area == MAP_FAILED) { perror("mmap() failed\n"); return -1; } /* Populate a single page such that we get an anon_vma. */ *area = 0; /* Enable KSM. */ madvise(area, size, MADV_MERGEABLE); pause(); return 0; } $ ./ksm-sparse & $ echo 1 > /sys/kernel/mm/ksm/run Without this patch ksmd uses 100% of the cpu for a long time (more t…
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service- Bedingung führen oder eine Speicherbeschädigung verursachen können.