https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T18:39:11.420148+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-46116 CVE-2026-46116 — xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete 2026-10-07T18:39:11.578899+00:00

Affected: Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service and 9 more

In the Linux kernel, the following vulnerability has been resolved:

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on 6.12.47, also reachable via the same code path on torvalds/master and on the ipsec tree). Nine unique signatures cluster in the xfrm_state lifecycle, the load-bearing one being:

BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline] BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline] BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435

Workqueue: netns cleanup_net Call Trace: __hlist_del / hlist_del_rcu __xfrm_state_delete xfrm_state_delete xfrm_state_flush xfrm_state_fini ops_exit_list cleanup_net

The other observed signatures hit the same slab object from __xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB write variant of __xfrm_state_delete, all on the byseq/byspi hash chains.

__xfrm_state_delete() guards its byseq and byspi unhashes with value-based predicates:

if (x->km.seq) hlist_del_rcu(&x->byseq); if (x->id.spi) hlist_del_rcu(&x->byspi);

while everywhere else in the file (e.g. state_cache, state_cache_input) the safer hlist_unhashed() check is used. xfrm_alloc_spi() sets x->id.spi = n…

 https://cve.radiocsirt.org/vuln/rhsa-2026:36018 RHSA-2026:36018 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update 2026-10-07T18:39:11.579045+00:00

kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete kernel: smb/client: fix out-of-bounds read in smb2_compound_op() kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs

 https://cve.radiocsirt.org/vuln/rhsa-2026:39180 RHSA-2026:39180 — Red Hat Security Advisory: kernel-rt security update 2026-10-07T18:39:11.579087+00:00

kernel: net: bridge: use a stable FDB dst snapshot in RCU readers kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete kernel: XFS data corruption using reflink