Affected: AlmaLinux:10: kernel, AlmaLinux:10: kernel-64k, AlmaLinux:10: kernel-64k-core, AlmaLinux:10: kernel-64k-debug, AlmaLinux:10: kernel-64k-debug-core, AlmaLinux:10: kernel-64k-debug-devel, AlmaLinux:10: kernel-64k-debug-devel-matched, AlmaLinux:10: kernel-64k-debug-modules, AlmaLinux:10: kernel-64k-debug-modules-core, AlmaLinux:10: kernel-64k-debug-modules-extra and 65 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834) * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003) * kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454) * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450) * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970) * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120) * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053) * kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189) * kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153) * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800) * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397) * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399) * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026…

Affected: Alpaquita:stream: linux-lts

In the Linux kernel, the following vulnerability has been resolved:

mm/list_lru: drain before clearing xarray entry on reparent

memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. This opens a window where a concurrent list_lru_del() arriving for the dying memcg sees xa_load() == NULL, walks to the parent in lock_list_lru_of_memcg(), takes the parent's per-node lock, and calls list_del_init() on an item still physically linked on the dying memcg's list.

If another in-flight thread holds the dying memcg's per-node lock at the same moment (another list_lru_del, or a list_lru_walk_one running an isolate callback), both threads modify ->next/->prev pointers on the same physical list under different locks. Adjacent items can corrupt each other's links.

Fix it by reversing the order: reparent each per-node list and mark the child's list lru dead and then clear the xarray entry. Any concurrent list_lru op that finds the still-set xarray entry either takes the dying memcg's per-node lock (synchronizing with the drain) or sees LONG_MIN and walks to the parent, where the items now live.

In the Linux kernel, the following vulnerability has been resolved:

mm/list_lru: drain before clearing xarray entry on reparent

memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. This opens a window where a concurrent list_lru_del() arriving for the dying memcg sees xa_load() == NULL, walks to the parent in lock_list_lru_of_memcg(), takes the parent's per-node lock, and calls list_del_init() on an item still physically linked on the dying memcg's list.

If another in-flight thread holds the dying memcg's per-node lock at the same moment (another list_lru_del, or a list_lru_walk_one running an isolate callback), both threads modify ->next/->prev pointers on the same physical list under different locks. Adjacent items can corrupt each other's links.

Fix it by reversing the order: reparent each per-node list and mark the child's list lru dead and then clear the xarray entry. Any concurrent list_lru op that finds the still-set xarray entry either takes the dying memcg's per-node lock (synchronizing with the drain) or sees LONG_MIN and walks to the parent, where the items now live.

kernel: seccomp: passthrough uretprobe systemcall without filtering kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg kernel: iommu/amd: Fix clone_alias() to use the original device's devid kernel: mm/list_lru: drain before clearing xarray entry on reparent kernel: zram: fix use-after-free in zram_bvec_write_partial() kernel: mm/huge_memory: update file PMD counter before folio_put() kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr kernel: NFSv4/flexfiles: reject zero filehandle version count kernel: nfsd: fix posix_acl leak on SETACL decode failure kernel: nfsd: release layout stid on setlease failure kernel: pNFS: Fix use-after-free in pnfs_update_layout() kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() kernel: netfilter: ipset: fix race between dump and ip_set_list resize kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count kernel: Input: synaptics-rmi4 - bound the F3A keymap to t…

Affected: Rocky Linux:10: kernel

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834)

* kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)

* kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454)

* kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

* kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

* kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)

* kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

* kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026)

* kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)

* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

* kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)

* kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153)

* kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

* kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

* kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)

* kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

* kernel: NF…

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 128 more

In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. This opens a window where a concurrent list_lru_del() arriving for the dying memcg sees xa_load() == NULL, walks to the parent in lock_list_lru_of_memcg(), takes the parent's per-node lock, and calls list_del_init() on an item still physically linked on the dying memcg's list. If another in-flight thread holds the dying memcg's per-node lock at the same moment (another list_lru_del, or a list_lru_walk_one running an isolate callback), both threads modify ->next/->prev pointers on the same physical list under different locks. Adjacent items can corrupt each other's links. Fix it by reversing the order: reparent each per-node list and mark the child's list lru dead and then clear the xarray entry. Any concurrent list_lru op that finds the still-set xarray entry either takes the dying memcg's per-node lock (synchronizing with the drain) or sees LONG_MIN and walks to the parent, where the items now live.

Ein entfernter Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen und weitere, nicht näher spezifizierte Auswirkungen zu erzielen.