Most recent entries from all

ALSA-2026:55764 — Important: kernel security, bug fix, and enhancement update

Affected: AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902) * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136) * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329) * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374) * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884) * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879) * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219) * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

Bug Fix(es) and Enhancement(s):

* Backport "sched/deadline: Fix bandwidth reclaim equation in GRUB" to AlmaLinux 8.10 (JIRA:AlmaLinux-189997) * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-8.10.z] (JIRA:AlmaLinux-224556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-15669

BELL-CVE-2025-39902

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

certfr-2025-avi-0894 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Certaines d'entre elles permettent à…

certfr-2025-avi-0894

EUVD-2026-347246

fkie_cve-2025-39902

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: avoid accessing metadata when pointer is invalid in object_err()

object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object.

One known path to the crash is when alloc_consistency_checks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls object_err() to report it. The debug code should report and handle the corruption gracefully and not crash in the process.

In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata.

GHSA-27rc-rcpv-8mr7

In the Linux kernel, the following vulnerability has been resolved:

mm/slub: avoid accessing metadata when pointer is invalid in object_err()

In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata.

msrc_CVE-2025-39902 — mm/slub: avoid accessing metadata when pointer is invalid in object_err()

msrc_CVE-2025-39902

OESA-2026-1566 — kernel security update

Affected: openEuler:24.03-LTS-SP1: kernel

The Linux Kernel, the operating system core itself. Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

udp: Deal with race between UDP socket address change and rehash

If a UDP socket changes its local address while it's receiving datagrams, as a result of connect(), there is a period during which a lookup operation might fail to find it, after the address is changed but before the secondary hash (port and address) and the four-tuple hash (local and remote ports and addresses) are updated.

Secondary hash chains were introduced by commit 30fff9231fad ("udp: bind() optimisation") and, as a result, a rehash operation became needed to make a bound socket reachable again after a connect().

This operation was introduced by commit 719f835853a9 ("udp: add rehash on connect()") which isn't however a complete fix: the socket will be found once the rehashing completes, but not while it's pending.

This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a client sending datagrams to it. After the server receives the first datagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to the address of the sender, in order to set up a directed flow.

Now, if the client, running on a different CPU thread, happens to send a (subsequent) datagram while the server's socket changes its address, but is not rehashed yet, this will result in a failed lookup and a port unreachable error delivered to the…

openSUSE-SU-2025:20081-1 — Security update for the Linux Kernel

Security update for the Linux Kernel

RHSA-2026:55764 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update

kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() kernel: crypto: ccp - copy IV using skcipher ivsize kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() kernel: drm/amdgpu: zero-initialize GART table on allocation kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages kernel: drm/i915: Fix potential UAF in TTM object purge kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

RLSA-2026:55764 — Important: kernel security, bug fix, and enhancement update

Affected: Rocky Linux:8: kernel

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)

* kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)

* kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

* kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)

* kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)

* kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)

* kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)

* kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)

* kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)

* kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)

Bug Fix(es) and Enhancement(s):

* Backport "sched/deadline: Fix bandwidth reclaim equation in GRUB" to Rocky Linux 8.10 (JIRA:Rocky Linux-189997)

* vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:Rocky Linux-224556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2025:21040-1 — Security update for the Linux Kernel

Security update for the Linux Kernel

UBUNTU-CVE-2025-39902

Affected: Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 215 more

In the Linux kernel, the following vulnerability has been resolved: mm/slub: avoid accessing metadata when pointer is invalid in object_err() object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object. One known path to the crash is when alloc_consistency_checks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls object_err() to report it. The debug code should report and handle the corruption gracefully and not crash in the process. In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata.

WID-SEC-W-2025-2170 — Linux Kernel: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen und andere nicht näher spezifizierte Angriffe durchzuführen, möglicherweise um beliebigen Code auszuführen oder eine Speicherbeschädigung zu verursachen.