https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:51:39.354873+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:70459 ALSA-2026:70459 — Important: kernel security, bug fix, and enhancement update 2026-10-03T19:51:40.198458+00:00

Affected: AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964) * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894) * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823) * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293) * kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157) * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188) * kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156) * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155) * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391) * kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072) * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

Bug Fix(es) and Enhancement(s):

* [Intel 9.8 FEAT] ice: Driver Update [almalinux-9.8.z] (JIRA:AlmaLinux-213003) * AlmaLinux 9.8…

 https://cve.radiocsirt.org/vuln/bell-cve-2026-74518 BELL-CVE-2026-74518 2026-10-03T19:51:40.198739+00:00

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1090 certfr-2026-avi-1090 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provo… 2026-10-03T19:51:40.198792+00:00 certfr-2026-avi-1090 https://cve.radiocsirt.org/vuln/euvd-2026-356409 EUVD-2026-356409 2026-10-03T19:51:40.198822+00:00 EUVD-2026-356409 https://cve.radiocsirt.org/vuln/fkie_cve-2026-74518 fkie_cve-2026-74518 2026-10-03T19:51:40.198852+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix list corruption in allocate_file_region_entries()

allocate_file_region_entries() tops up resv->region_cache with freshly allocated file_region descriptors. The allocation uses GFP_KERNEL, so resv->lock is dropped around it: the new entries are gathered on a stack-local list head, allocated_regions, and spliced into resv->region_cache once the lock is re-acquired.

The splice used list_splice(), which moves the entries but does not re-initialize the source head, so allocated_regions is left pointing at an entry that now lives on resv->region_cache. The top-up runs in a while loop that re-checks the cache deficit after re-acquiring the lock. For a shared mapping the resv_map is shared by every mapper of the hugetlbfs inode, so a concurrent region_chg()/region_add()/region_del() on the same resv_map can consume cache entries during the unlocked window and force a second iteration. That iteration calls list_add() on the stale head and corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check trips:

list_add corruption. next->prev should be prev (ffffc900011ff7f8), but was ffff88814c281460. (next=ffff88814c545640). kernel BUG at lib/list_debug.c:31! allocate_file_region_entries+0x191/0x420 region_chg+0x267/0x300 hugetlb_reserve_pages+0x387/0xc80 hugetlbfs_file_mmap+0x2ce/0x3f0 mmap_region+0x1348/0x1a80 do_mmap+0x85e/0xb90 vm_mmap_pgoff+0x18c/0x330…

 https://cve.radiocsirt.org/vuln/ghsa-9v2f-674j-mrjw GHSA-9v2f-674j-mrjw 2026-10-03T19:51:40.198948+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix list corruption in allocate_file_region_entries()

allocate_file_region_entries() tops up resv->region_cache with freshly allocated file_region descriptors. The allocation uses GFP_KERNEL, so resv->lock is dropped around it: the new entries are gathered on a stack-local list head, allocated_regions, and spliced into resv->region_cache once the lock is re-acquired.

The splice used list_splice(), which moves the entries but does not re-initialize the source head, so allocated_regions is left pointing at an entry that now lives on resv->region_cache. The top-up runs in a while loop that re-checks the cache deficit after re-acquiring the lock. For a shared mapping the resv_map is shared by every mapper of the hugetlbfs inode, so a concurrent region_chg()/region_add()/region_del() on the same resv_map can consume cache entries during the unlocked window and force a second iteration. That iteration calls list_add() on the stale head and corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check trips:

list_add corruption. next->prev should be prev (ffffc900011ff7f8), but was ffff88814c281460. (next=ffff88814c545640). kernel BUG at lib/list_debug.c:31! allocate_file_region_entries+0x191/0x420 region_chg+0x267/0x300 hugetlb_reserve_pages+0x387/0xc80 hugetlbfs_file_mmap+0x2ce/0x3f0 mmap_region+0x1348/0x1a80 do_mmap+0x85e/0xb90 vm_mmap_pgoff+0x18c/0x330…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-74518 msrc_CVE-2026-74518 — mm/hugetlb: fix list corruption in allocate_file_region_entries() 2026-10-03T19:51:40.198985+00:00 msrc_CVE-2026-74518 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21910-1 openSUSE-SU-2026:21910-1 — Security update for the Linux Kernel 2026-10-03T19:51:40.199004+00:00

Security update for the Linux Kernel

 https://cve.radiocsirt.org/vuln/rhsa-2026:70498 RHSA-2026:70498 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update 2026-10-03T19:51:40.199566+00:00

kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree kernel: dm cache policy smq: fix missing locks in invalidating cache blocks kernel: keys: Pin request_key_auth payload in instantiate paths kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries()

 https://cve.radiocsirt.org/vuln/rlsa-2026:70459 RLSA-2026:70459 — Important: kernel security, bug fix, and enhancement update 2026-10-03T19:51:40.199604+00:00

Affected: Rocky Linux:9: kernel

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

* kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

* kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)

* kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

* kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

* kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

* kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157)

* kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

* kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)

* kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)

* kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)

* kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)

* kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

Bug Fix(es) and Enhancement(s):

* [Intel 9.8 FEAT] ice: Driver Update [rhel-9.8.z] (JIRA:Rocky Linux-213003)

* Rocky Linux 9.8: Multiuser Kerberized DF…

 https://cve.radiocsirt.org/vuln/suse-su-2026:23477-1 SUSE-SU-2026:23477-1 — Security update for the Linux Kernel 2026-10-03T19:51:40.199652+00:00

Security update for the Linux Kernel

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-74518 UBUNTU-CVE-2026-74518 2026-10-03T19:51:40.199973+00:00

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 193 more

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocate_file_region_entries() allocate_file_region_entries() tops up resv->region_cache with freshly allocated file_region descriptors. The allocation uses GFP_KERNEL, so resv->lock is dropped around it: the new entries are gathered on a stack-local list head, allocated_regions, and spliced into resv->region_cache once the lock is re-acquired. The splice used list_splice(), which moves the entries but does not re-initialize the source head, so allocated_regions is left pointing at an entry that now lives on resv->region_cache. The top-up runs in a while loop that re-checks the cache deficit after re-acquiring the lock. For a shared mapping the resv_map is shared by every mapper of the hugetlbfs inode, so a concurrent region_chg()/region_add()/region_del() on the same resv_map can consume cache entries during the unlocked window and force a second iteration. That iteration calls list_add() on the stale head and corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check trips: list_add corruption. next->prev should be prev (ffffc900011ff7f8), but was ffff88814c281460. (next=ffff88814c545640). kernel BUG at lib/list_debug.c:31! allocate_file_region_entries+0x191/0x420 region_chg+0x267/0x300 hugetlb_reserve_pages+0x387/0xc80 hugetlbfs_file_mmap+0x2ce/0x3f0 mmap_region+0x1348/0x1a80 do_mmap+0x85e/0xb90 vm_mmap_pgoff+0x18c/0x330 ksys…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2852 WID-SEC-W-2026-2852 — Linux Kernel: Mehrere Schwachstellen 2026-10-03T19:51:40.200200+00:00

Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um root Rechte zu erlangen, um einen Denial of Service herbeizuführen oder einen nicht näher spezifizierten Angriff durchzuführen.