Most recent entries from all

ALSA-2026:63013 — Important: kernel-rt security, bug fix, and enhancement update

Affected: AlmaLinux:8: kernel-rt, AlmaLinux:8: kernel-rt-core, AlmaLinux:8: kernel-rt-debug, AlmaLinux:8: kernel-rt-debug-core, AlmaLinux:8: kernel-rt-debug-devel, AlmaLinux:8: kernel-rt-debug-modules, AlmaLinux:8: kernel-rt-debug-modules-extra, AlmaLinux:8: kernel-rt-devel, AlmaLinux:8: kernel-rt-modules, AlmaLinux:8: kernel-rt-modules-extra

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling (CVE-2024-57849) * kernel: smc91x: fix broken irq-context in PREEMPT_RT (CVE-2025-71132) * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800) * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397) * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399) * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392) * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391) * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018) * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268) * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298) * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480) * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

Bug Fix(es) and Enhancement(s):

* qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-8.10.z] (JIRA:AlmaL…

bdu:2026-10906

BELL-CVE-2025-71132

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

certfr-2026-avi-0166 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provo…

certfr-2026-avi-0166

EUVD-2026-347554

fkie_cve-2025-71132

In the Linux kernel, the following vulnerability has been resolved:

smc91x: fix broken irq-context in PREEMPT_RT

When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC:

[ 13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 [ 13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106] [ 13.062137] preempt=0x00000000 lock=0->0 RCU=0->1 workfn=mld_ifc_work [ 13.062266] C ** replaying previous printk message ** [ 13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT_{RT,(full)} [ 13.062353] Hardware name: , BIOS [ 13.062382] Workqueue: mld mld_ifc_work [ 13.062469] Call trace: [ 13.062494] show_stack+0x24/0x40 (C) [ 13.062602] __dump_stack+0x28/0x48 [ 13.062710] dump_stack_lvl+0x7c/0xb0 [ 13.062818] dump_stack+0x18/0x34 [ 13.062926] process_scheduled_works+0x294/0x450 [ 13.063043] worker_thread+0x260/0x3d8 [ 13.063124] kthread+0x1c4/0x228 [ 13.063235] ret_from_fork+0x10/0x20

This happens because smc_special_trylock() disables IRQs even on PREEMPT_RT, but smc_special_unlock() does not restore IRQs on PREEMPT_RT. The reason is that smc_special_unlock() calls spin_unlock_irqrestore(), and rcu_read_unlock_bh() in __dev_queue_xmit() cannot invoke rcu_read_unlock() through __local_bh_enable_ip() when current->softirq_disable_cnt becomes zero.

To address this issue, replace smc_special_trylock() with spin_trylock_irqsave().

GHSA-52xq-4j7g-g3fj

In the Linux kernel, the following vulnerability has been resolved:

smc91x: fix broken irq-context in PREEMPT_RT

When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC:

To address this issue, replace smc_special_trylock() with spin_trylock_irqsave().

msrc_CVE-2025-71132 — smc91x: fix broken irq-context in PREEMPT_RT

msrc_CVE-2025-71132

OESA-2026-2581 — kernel security update

Affected: openEuler:24.03-LTS-SP1: kernel

The Linux Kernel, the operating system core itself. Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: mvpp2: Prevent parser TCAM memory corruption

Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications.

Both the TCAM and SRAM tables are indirectly accessed by configuring an index register that selects the row to read or write to. This means that operations must be atomic in order to, e.g., avoid spreading writes across multiple rows. Since the shadow SRAM array is used to find free rows in the hardware table, it must also be protected in order to avoid TOCTOU errors where multiple cores allocate the same row.

This issue was detected in a situation where `mvpp2_set_rx_mode()` ran concurrently on two CPUs. In this particular case the MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the classifier unit to drop all incoming unicast - indicated by the `rx_classifier_drops` counter.(CVE-2025-22060)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix NULL pointer in can_accept_new_subflow

When testing valkey benchmark tool with MPTCP, the kernel panics in 'mptcp_can_accept_new_subflow' because subflow_req->msk is NULL.

Call trace:

mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P) subflow_syn_recv_sock (./net/mptcp/subflow.c:854) tcp_check_req (./net/ipv4/tcp_minisocks.c:863) tcp_v4_rcv (./net/…

openSUSE-SU-2026:20287-1 — Security update for the Linux Kernel

Security update for the Linux Kernel

RHSA-2026:63013 — Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling kernel: smc91x: fix broken irq-context in PREEMPT_RT kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down kernel: zram: fix use-after-free in zram_bvec_write_partial() kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr kernel: NFSv4/flexfiles: reject zero filehandle version count kernel: nfsd: fix posix_acl leak on SETACL decode failure kernel: nfsd: release layout stid on setlease failure kernel: pNFS: Fix use-after-free in pnfs_update_layout() kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access kernel: Kernel: Remote out-of-bounds write in RDMA/siw kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer

RLSA-2026:63013 — Important: kernel-rt security, bug fix, and enhancement update

Affected: Rocky Linux:8: kernel-rt

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling (CVE-2024-57849)

* kernel: smc91x: fix broken irq-context in PREEMPT_RT (CVE-2025-71132)

* kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

* kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)

* kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

* kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

* kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)

* kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

* kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

* kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)

* kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)

* kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)

* kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)

* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

Bug Fix(es) and Enhancement(s):

* qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-8.10.z] (JIRA:Rocky Linux-193045)

* powerpc/pse…

SUSE-SU-2026:0587-1 — Security update for the Linux Kernel

Security update for the Linux Kernel

UBUNTU-CVE-2025-71132

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 178 more

In the Linux kernel, the following vulnerability has been resolved: smc91x: fix broken irq-context in PREEMPT_RT When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC: [ 13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 [ 13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106] [ 13.062137] preempt=0x00000000 lock=0->0 RCU=0->1 workfn=mld_ifc_work [ 13.062266] C ** replaying previous printk message ** [ 13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT_{RT,(full)} [ 13.062353] Hardware name: , BIOS [ 13.062382] Workqueue: mld mld_ifc_work [ 13.062469] Call trace: [ 13.062494] show_stack+0x24/0x40 (C) [ 13.062602] __dump_stack+0x28/0x48 [ 13.062710] dump_stack_lvl+0x7c/0xb0 [ 13.062818] dump_stack+0x18/0x34 [ 13.062926] process_scheduled_works+0x294/0x450 [ 13.063043] worker_thread+0x260/0x3d8 [ 13.063124] kthread+0x1c4/0x228 [ 13.063235] ret_from_fork+0x10/0x20 This happens because smc_special_trylock() disables IRQs even on PREEMPT_RT, but smc_special_unlock() does not restore IRQs on PREEMPT_RT. The reason is that smc_special_unlock() calls spin_unlock_irqrestore(), and rcu_read_unlock_bh() in __dev_queue_xmit() cannot invoke rcu_read_unlock() through __local_bh_enable_ip() when current->softirq_disable_cnt becomes zero. To address this issue, replace smc_special_trylock() with spin_trylock_irqsave().

WID-SEC-W-2026-0119 — Linux Kernel: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service- Bedingung führen oder eine Speicherbeschädigung verursachen können.