Most recent entries from all

ALSA-2026:68532 — Important: kernel-rt security update

2026-10-02T13:58:32.719745+00:00

Affected: AlmaLinux:8: kernel-rt, AlmaLinux:8: kernel-rt-core, AlmaLinux:8: kernel-rt-debug, AlmaLinux:8: kernel-rt-debug-core, AlmaLinux:8: kernel-rt-debug-devel, AlmaLinux:8: kernel-rt-debug-modules, AlmaLinux:8: kernel-rt-debug-modules-extra, AlmaLinux:8: kernel-rt-devel, AlmaLinux:8: kernel-rt-modules, AlmaLinux:8: kernel-rt-modules-extra

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233) * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339) * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266) * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306) * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920) * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075) * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228) * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176) * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131) * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192) * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223) * kernel: ipv6: mcast: Fix use-after-f…

BELL-CVE-2026-72298

2026-10-02T13:58:32.719833+00:00

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

certfr-2026-avi-1204 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un…

2026-10-02T13:58:32.719859+00:00

certfr-2026-avi-1204

EUVD-2026-354012

2026-10-02T13:58:32.719877+00:00

EUVD-2026-354012

fkie_cve-2026-72298

2026-10-02T13:58:32.719889+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

qrtr_endpoint_post() validates an incoming packet with

if (!size || len != ALIGN(size, 4) + hdrlen) goto err;

where size comes from the wire. On 32-bit, size_t is 32 bits and ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check passes and skb_put_data(skb, data + hdrlen, size) writes past the hdrlen-sized skb and oopses the kernel. 64-bit is unaffected.

This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB Read in qrtr_endpoint_post"), which fixed only the 64-bit case.

Reject any size that cannot fit the buffer before the ALIGN.

GHSA-3c34-q5w8-c59m

2026-10-02T13:58:32.719920+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()

qrtr_endpoint_post() validates an incoming packet with

if (!size || len != ALIGN(size, 4) + hdrlen) goto err;

This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB Read in qrtr_endpoint_post"), which fixed only the 64-bit case.

Reject any size that cannot fit the buffer before the ALIGN.

RHSA-2026:68532 — Red Hat Security Advisory: kernel-rt security update

2026-10-02T13:58:32.719944+00:00

kernel: ipvlan: Make the addrs_lock be per port kernel: xfrm: hold dev ref until after transport_finish NF_HOOK kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP kernel: flow_dissector: do not dissect PPPoE PFC frames kernel: netfilter: xt_policy: fix strict mode inbound policy matching kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls kernel: netfilter: require Ethernet MAC header before using eth_hdr() kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN kernel: ALSA: timer: Fix UAF at snd_timer_user_params() kernel: net: guard timestamp cmsgs to real error queue skbs kernel: ipv6: sit: reload inner IPv6 header after GSO offloads kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() kernel: netfilter: conntrack_irc: fix possible out-of-bounds read kernel: ipv6: mcast: Fix use-after-free when processing MLD queries kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() kernel: xfrm: input: hold netns during deferred transport reinjection kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment kernel: net: qrt…

RHSA-2026:68570 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update

2026-10-02T13:58:32.720001+00:00

kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow kernel: xfrm: hold dev ref until after transport_finish NF_HOOK kernel: RDMA/rxe: Fix race condition in QP timer handlers kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN kernel: ALSA: timer: Fix UAF at snd_timer_user_params() kernel: ALSA: timer: Forcibly close timer instances at closing kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() kernel: xfrm: input: hold netns during deferred transport reinjection kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() kernel: ALSA: seq: Serialize UMP output teardown with event_input kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() kernel: wifi: iwlwifi: mld: stop TX during firmware restart kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap kernel: Linux k…

RLSA-2026:68532 — Important: kernel-rt security update

2026-10-02T13:58:32.720084+00:00

Affected: Rocky Linux:8: kernel-rt

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

* kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)

* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

* kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)

* kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

* kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

* kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

* kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)

* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

* kernel: ipv6: mcast: Fix use-after-free when processing M…

UBUNTU-CVE-2026-72298

2026-10-02T13:58:32.720131+00:00

Affected: Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:Pro:16.04:LTS: linux-oracle, Ubuntu:Pro:18.04:LTS: linux, Ubuntu:Pro:18.04:LTS: linux-aws, Ubuntu:18.04:LTS: linux-aws-5.0 and 231 more

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() qrtr_endpoint_post() validates an incoming packet with if (!size || len != ALIGN(size, 4) + hdrlen) goto err; where size comes from the wire. On 32-bit, size_t is 32 bits and ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check passes and skb_put_data(skb, data + hdrlen, size) writes past the hdrlen-sized skb and oopses the kernel. 64-bit is unaffected. This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB Read in qrtr_endpoint_post"), which fixed only the 64-bit case. Reject any size that cannot fit the buffer before the ALIGN.

WID-SEC-W-2026-2852 — Linux Kernel: Mehrere Schwachstellen

2026-10-02T13:58:32.720481+00:00

Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um root Rechte zu erlangen, um einen Denial of Service herbeizuführen oder einen nicht näher spezifizierten Angriff durchzuführen.