https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:05:21 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:1690 <p><strong>Affected:</strong> AlmaLinux:10: kernel-abi-stablelists, AlmaLinux:10: kernel-doc</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819) * kernel: RDMA/core: Fix &#34;KASAN: slab-use-after-free Read in ib_register_device&#34; problem (CVE-2025-38022) * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349) * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453) * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568) * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731) * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154) * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170) * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135) * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158) * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248) * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258) * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251) * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. (CVE-2025-40271) * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service (CVE-2025-40294) * kernel: Linux kernel: Information disclosure a…</p> <p><strong>Affected:</strong> AlmaLinux:10: kernel-abi-stablelists, AlmaLinux:10: kernel-doc</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819) * kernel: RDMA/core: Fix &#34;KASAN: slab-use-after-free Read in ib_register_device&#34; problem (CVE-2025-38022) * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349) * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453) * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568) * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731) * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154) * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170) * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135) * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158) * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248) * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258) * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251) * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. (CVE-2025-40271) * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service (CVE-2025-40294) * kernel: Linux kernel: Information disclosure a…</p> https://cve.radiocsirt.org/vuln/alsa-2026:1690 https://cve.radiocsirt.org/vuln/bdu:2026-02833 bdu:2026-02833 https://cve.radiocsirt.org/vuln/bdu:2026-02833 https://cve.radiocsirt.org/vuln/bell-cve-2025-40318 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-40318 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0057 certfr-2026-avi-0057 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0057 https://cve.radiocsirt.org/vuln/euvd-2026-347423 EUVD-2026-347423 https://cve.radiocsirt.org/vuln/euvd-2026-347423 https://cve.radiocsirt.org/vuln/fkie_cve-2025-40318 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once</p> <p>hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and &#34;UAF&#34;.</p> <p>Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once</p> <p>hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and &#34;UAF&#34;.</p> <p>Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-40318 https://cve.radiocsirt.org/vuln/ghsa-m8vr-v3r8-7vqf <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once</p> <p>hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and &#34;UAF&#34;.</p> <p>Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once</p> <p>hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and &#34;UAF&#34;.</p> <p>Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.</p> https://cve.radiocsirt.org/vuln/ghsa-m8vr-v3r8-7vqf https://cve.radiocsirt.org/vuln/oesa-2026-1759 <p><strong>Affected:</strong> openEuler:24.03-LTS: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iommu/s390: Implement blocking domain</p> <p>This fixes a crash when surprise hot-unplugging a PCI device. This crash happens because during hot-unplug __iommu_group_set_domain_nofail() attaching the default domain fails when the platform no longer recognizes the device as it has already been removed and we end up with a NULL domain pointer and UAF. This is exactly the case referred to in the second comment in __iommu_device_set_domain() and just as stated there if we can instead attach the blocking domain the UAF is prevented as this can handle the already removed device. Implement the blocking domain to use this handling. With this change, the crash is fixed but we still hit a warning attempting to change DMA ownership on a blocked device.(CVE-2024-53232)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iommu: Fix two issues in iommu_copy_struct_from_user()</p> <p>In the review for iommu_copy_struct_to_user() helper, Matt pointed out that a NULL pointer should be rejected prior to dereferencing it: https://lore.kernel.org/all/(CVE-2025-37900)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: Avoid race in open_cached_dir with lease breaks</p> <p>A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn&amp;apos;t consider it valid,…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iommu/s390: Implement blocking domain</p> <p>This fixes a crash when surprise hot-unplugging a PCI device. This crash happens because during hot-unplug __iommu_group_set_domain_nofail() attaching the default domain fails when the platform no longer recognizes the device as it has already been removed and we end up with a NULL domain pointer and UAF. This is exactly the case referred to in the second comment in __iommu_device_set_domain() and just as stated there if we can instead attach the blocking domain the UAF is prevented as this can handle the already removed device. Implement the blocking domain to use this handling. With this change, the crash is fixed but we still hit a warning attempting to change DMA ownership on a blocked device.(CVE-2024-53232)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iommu: Fix two issues in iommu_copy_struct_from_user()</p> <p>In the review for iommu_copy_struct_to_user() helper, Matt pointed out that a NULL pointer should be rejected prior to dereferencing it: https://lore.kernel.org/all/(CVE-2025-37900)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>smb: client: Avoid race in open_cached_dir with lease breaks</p> <p>A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn&amp;apos;t consider it valid,…</p> https://cve.radiocsirt.org/vuln/oesa-2026-1759 https://cve.radiocsirt.org/vuln/opensuse-su-2026:20145-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:20145-1 https://cve.radiocsirt.org/vuln/rhsa-2026:1194 <p>kernel: Linux kernel: Information disclosure and denial of service in ntb_hw_switchtec module kernel: Linux kernel drm/xe: Out-of-bounds shift in TLB invalidation kernel: Linux kernel (openvswitch): Denial of Service and limited data exposure via improper key length validation kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability kernel: drm/xe: Use local fence in error path of xe_migrate_clear kernel: Linux kernel: Denial of service due to use-after-free in scsi: lpfc kernel: Bluetooth: ISO: Fix possible UAF on iso_conn_free kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy kernel: mptcp: fix race condition in mptcp_schedule_work() kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once</p> <p>kernel: Linux kernel: Information disclosure and denial of service in ntb_hw_switchtec module kernel: Linux kernel drm/xe: Out-of-bounds shift in TLB invalidation kernel: Linux kernel (openvswitch): Denial of Service and limited data exposure via improper key length validation kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability kernel: drm/xe: Use local fence in error path of xe_migrate_clear kernel: Linux kernel: Denial of service due to use-after-free in scsi: lpfc kernel: Bluetooth: ISO: Fix possible UAF on iso_conn_free kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy kernel: mptcp: fix race condition in mptcp_schedule_work() kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once</p> https://cve.radiocsirt.org/vuln/rhsa-2026:1194 https://cve.radiocsirt.org/vuln/suse-su-2026:0278-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:0278-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-40318 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 137 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and &#34;UAF&#34;. Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 137 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the same entry, leading to double list_del() and &#34;UAF&#34;. Fix this by holding cmd_sync_work_lock across both lookup and cancel, so that the entry cannot be removed concurrently.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-40318 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2756 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder weitere, nicht spezifizierte Auswirkungen zu erlangen.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder weitere, nicht spezifizierte Auswirkungen zu erlangen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2756