Most recent entries from all

ALSA-2026:66180 — Important: kernel security, bug fix, and enhancement update

2026-10-03T03:40:04.812250+00:00

Affected: AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133) * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339) * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493) * kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015) * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266) * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306) * kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330) * kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002) * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223) * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275) * kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366) * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563) * kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597) * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129) * kernel: net: bridge: stop fast-leave after delet…

BELL-CVE-2026-64034

2026-10-03T03:40:04.812433+00:00

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

certfr-2026-avi-0926 — De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Certaines d'entre elles permettent à un a…

2026-10-03T03:40:04.812464+00:00

certfr-2026-avi-0926

EUVD-2026-348364

2026-10-03T03:40:04.812482+00:00

EUVD-2026-348364

fkie_cve-2026-64034

2026-10-03T03:40:04.812495+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic.

DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation.

Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().

GHSA-r5hj-4chx-57cx

2026-10-03T03:40:04.812526+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().

openSUSE-SU-2026:21555-1 — Security update for the Linux Kernel

2026-10-03T03:40:04.812547+00:00

Security update for the Linux Kernel

RHSA-2026:72467 — Red Hat Security Advisory: kernel-rt security update

2026-10-03T03:40:04.813061+00:00

kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released kernel: ext4: fix e4b bitmap inconsistency reports kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg kernel: arm64: tlb: Flush walk cache when unsharing PMD tables kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer kernel: perf/core: Detach event groups during remove_on_exec kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap kernel: drm/amdgpu: Fix context pstate override handling kernel: perf: Reject exited events as group leaders

RLSA-2026:66180 — Important: kernel security, bug fix, and enhancement update

2026-10-03T03:40:04.813100+00:00

Affected: Rocky Linux:9: kernel

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)

* kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)

* kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

* kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)

* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)

* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

* kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366)

* kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)

* kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)

* kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)

* kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)

* kernel: net: bridge: stop fast-leave after deleting a port group (CVE-…

SUSE-SU-2026:23066-1 — Security update for the Linux Kernel

2026-10-03T03:40:04.813147+00:00

Security update for the Linux Kernel

UBUNTU-CVE-2026-64034

2026-10-03T03:40:04.813617+00:00

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15 and 194 more

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic. DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation. Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().

WID-SEC-W-2026-2403 — Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

2026-10-03T03:40:04.813885+00:00

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.