Affected: AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233) * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878) * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120) * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991) * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143) * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136) * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189) * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329) * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356) * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374) * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884) * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007) * kernel: memfd: deny…

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

In the Linux kernel, the following vulnerability has been resolved:

smb: client: validate DFS referral PathConsumed

parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a PathConsumed value that is later used for DFS path parsing.

If a malformed response provides a PathConsumed value larger than the search name, later DFS parsing can advance beyond the end of the path.

Validate PathConsumed against the search name length before storing it in the parsed referral.

In the Linux kernel, the following vulnerability has been resolved:

smb: client: validate DFS referral PathConsumed

parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a PathConsumed value that is later used for DFS path parsing.

If a malformed response provides a PathConsumed value larger than the search name, later DFS parsing can advance beyond the end of the path.

Validate PathConsumed against the search name length before storing it in the parsed referral.

kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 kernel: udf: fix partition descriptor append bookkeeping kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() kernel: sched/psi: fix race between file release and pressure write kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 kernel: mm/huge_memory: update file PMD counter before folio_put() kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset kernel: drm/amdgpu: zero-initialize GART table on allocation kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages kernel: drm/i915: Fix potential UAF in TTM object purge kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() kernel: memfd: deny writeable mappings when implying SEAL_WRITE kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async kernel: smb: client: mask server-provided mode to 07777 in modefromsi…

curl: curl: Insecure connection establishment due to TLS configuration mismatch curl: curl: Man-in-the-middle attack via SSH host key bypass bind: bind9: Incorrect acceptance of NSEC3 records bind9: bind: Potential wildcard CNAME RPZ policy bypass dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option kernel: smb: client: validate DFS referral PathConsumed kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Affected: Rocky Linux:9: kernel

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)

* kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

* kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)

* kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)

* kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)

* kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)

* kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)

* kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)

* kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

* kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)

* kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

* kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)

* kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

* kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)

* kernel: memfd: deny writeable mappings wh…

Security update for the Linux Kernel

Affected: Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:Pro:16.04:LTS: linux-oracle, Ubuntu:Pro:18.04:LTS: linux, Ubuntu:Pro:18.04:LTS: linux-aws, Ubuntu:18.04:LTS: linux-aws-5.0 and 239 more

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a PathConsumed value that is later used for DFS path parsing. If a malformed response provides a PathConsumed value larger than the search name, later DFS parsing can advance beyond the end of the path. Validate PathConsumed against the search name length before storing it in the parsed referral.

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Ausweitung von Berechtigungen, die Offenlegung von Informationen, die Manipulation von Daten oder Denial-of-Service-Zustände.