https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:31:37.747102+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:68570 ALSA-2026:68570 — Important: kernel security, bug fix, and enhancement update 2026-10-02T17:31:38.894448+00:00

Affected: AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114) * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971) * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176) * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192) * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869) * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinje…

 https://cve.radiocsirt.org/vuln/bell-cve-2026-68159 BELL-CVE-2026-68159 2026-10-02T17:31:38.894739+00:00

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1090 certfr-2026-avi-1090 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provo… 2026-10-02T17:31:38.894780+00:00 certfr-2026-avi-1090 https://cve.radiocsirt.org/vuln/euvd-2026-357842 EUVD-2026-357842 2026-10-02T17:31:38.894806+00:00 EUVD-2026-357842 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68159 fkie_cve-2026-68159 2026-10-02T17:31:38.894824+00:00

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

__decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack out-of-bounds write.

An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer entries at decode time. The bound is well below the old overflow threshold, so it also covers the allocation-size overflow the previous check guarded against.

BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds Write of size 4 ... by task exploit kasan_report (mm/kasan/report.c:595) ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833) calc_target (net/ceph/osd_client.c:1638) __submit_request (net/ceph/osd_client.c:2394) ceph_osdc_start_request (net/ceph/osd_client.c:2490) ceph_osdc_call (net/ceph/osd_client.c:5164) rbd_dev_image_probe (drivers/block/rbd.c:6899) do_rbd_add (drivers/block/rbd.c:7138) ... kernel BUG at net/ceph/osdmap.c:2670!

[ idryomov: do the same in __decode_pg_upmap_items() ]

 https://cve.radiocsirt.org/vuln/ghsa-83x9-86wr-8vh2 GHSA-83x9-86wr-8vh2 2026-10-02T17:31:38.894875+00:00

In the Linux kernel, the following vulnerability has been resolved:

libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

__decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack out-of-bounds write.

An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer entries at decode time. The bound is well below the old overflow threshold, so it also covers the allocation-size overflow the previous check guarded against.

BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds Write of size 4 ... by task exploit kasan_report (mm/kasan/report.c:595) ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833) calc_target (net/ceph/osd_client.c:1638) __submit_request (net/ceph/osd_client.c:2394) ceph_osdc_start_request (net/ceph/osd_client.c:2490) ceph_osdc_call (net/ceph/osd_client.c:5164) rbd_dev_image_probe (drivers/block/rbd.c:6899) do_rbd_add (drivers/block/rbd.c:7138) ... kernel BUG at net/ceph/osdmap.c:2670!

[ idryomov: do the same in __decode_pg_upmap_items() ]

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-68159 msrc_CVE-2026-68159 — libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE 2026-10-02T17:31:38.894918+00:00 msrc_CVE-2026-68159 https://cve.radiocsirt.org/vuln/oesa-2026-3453 OESA-2026-3453 — kernel security update 2026-10-02T17:31:38.894943+00:00

Affected: openEuler:22.03-LTS-SP4: kernel

The Linux Kernel, the operating system core itself. Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()

There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller:

BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220 Read of size 8 at addr ffff888112a78d98 by task kworker/0:5/5326 CPU: 0 UID: 0 PID: 5326 Comm: kworker/0:5 Not tainted 6.19.0-rc2 #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events cfg80211_rfkill_block_work Call Trace: <TASK> dump_stack_lvl+0x116/0x1f0 print_report+0xcd/0x630 kasan_report+0xe0/0x110 cfg80211_shutdown_all_interfaces+0x213/0x220 cfg80211_rfkill_block_work+0x1e/0x30 process_one_work+0x9cf/0x1b70 worker_thread+0x6c8/0xf10 kthread+0x3c5/0x780 ret_from_fork+0x56d/0x700 ret_from_fork_asm+0x1a/0x30 </TASK>

The problem arises due to the rfkill_block work is not cancelled when wiphy is being unregistered. In order to fix the issue cancel the corresponding work in wiphy_unregister().

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2026-23336)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()

l2cap_ecred_reconf_rsp() casts the incoming data to struct l2cap_ecred_conn_rsp (the ECRED *connection* respons…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21910-1 openSUSE-SU-2026:21910-1 — Security update for the Linux Kernel 2026-10-02T17:31:38.895156+00:00

Security update for the Linux Kernel

 https://cve.radiocsirt.org/vuln/rhsa-2026:70498 RHSA-2026:70498 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update 2026-10-02T17:31:38.895923+00:00

kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree kernel: dm cache policy smq: fix missing locks in invalidating cache blocks kernel: keys: Pin request_key_auth payload in instantiate paths kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries()

 https://cve.radiocsirt.org/vuln/rlsa-2026:68570 RLSA-2026:68570 — Important: kernel security, bug fix, and enhancement update 2026-10-02T17:31:38.895983+00:00

Affected: Rocky Linux:9: kernel

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)

* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

* kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)

* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

* kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)

* kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)

* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

* kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)

* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

* kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)

* kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)

* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919…

 https://cve.radiocsirt.org/vuln/suse-su-2026:23477-1 SUSE-SU-2026:23477-1 — Security update for the Linux Kernel 2026-10-02T17:31:38.896074+00:00

Security update for the Linux Kernel

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68159 UBUNTU-CVE-2026-68159 2026-10-02T17:31:38.896494+00:00

Affected: Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:Pro:16.04:LTS: linux-oracle, Ubuntu:Pro:18.04:LTS: linux, Ubuntu:Pro:18.04:LTS: linux-aws, Ubuntu:18.04:LTS: linux-aws-5.0 and 239 more

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack out-of-bounds write. An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer entries at decode time. The bound is well below the old overflow threshold, so it also covers the allocation-size overflow the previous check guarded against. BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds Write of size 4 ... by task exploit kasan_report (mm/kasan/report.c:595) ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833) calc_target (net/ceph/osd_client.c:1638) __submit_request (net/ceph/osd_client.c:2394) ceph_osdc_start_request (net/ceph/osd_client.c:2490) ceph_osdc_call (net/ceph/osd_client.c:5164) rbd_dev_image_probe (drivers/block/rbd.c:6899) do_rbd_add (drivers/block/rbd.c:7138) ... kernel BUG at net/ceph/osdmap.c:2670! [ idryomov: do the same in __decode_pg_upmap_items() ]

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2730 WID-SEC-W-2026-2730 — Linux Kernel: Mehrere Schwachstellen 2026-10-02T17:31:38.897012+00:00

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Ausweitung von Berechtigungen, die Offenlegung von Informationen, die Manipulation von Daten oder Denial-of-Service-Zustände.