https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:05:02 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:67150 <p><strong>Affected:</strong> AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745) * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466) * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479) * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566) * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656) * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368) * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: iommu/amd: Fix clone_alias() to use the original device&#39;s devid (CVE-2026-53053) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluet…</p> <p><strong>Affected:</strong> AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745) * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466) * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479) * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566) * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656) * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368) * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: iommu/amd: Fix clone_alias() to use the original device&#39;s devid (CVE-2026-53053) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluet…</p> https://cve.radiocsirt.org/vuln/alsa-2026:67150 https://cve.radiocsirt.org/vuln/bdu:2026-12566 bdu:2026-12566 https://cve.radiocsirt.org/vuln/bdu:2026-12566 https://cve.radiocsirt.org/vuln/bell-cve-2026-31566 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-31566 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0519 certfr-2026-avi-0519 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0519 https://cve.radiocsirt.org/vuln/euvd-2026-347719 EUVD-2026-347719 https://cve.radiocsirt.org/vuln/euvd-2026-347719 https://cve.radiocsirt.org/vuln/fkie_cve-2026-31566 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib</p> <p>amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job completion.</p> <p>Currently, the code drops the fence reference using dma_fence_put() before calling dma_fence_wait().</p> <p>If dma_fence_put() releases the last reference, the fence may be freed before dma_fence_wait() is called. This can lead to a use-after-free.</p> <p>Fix this by waiting on the fence first and releasing the reference only after dma_fence_wait() completes.</p> <p>Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory &#39;f&#39; (line 696)</p> <p>(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib</p> <p>amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job completion.</p> <p>Currently, the code drops the fence reference using dma_fence_put() before calling dma_fence_wait().</p> <p>If dma_fence_put() releases the last reference, the fence may be freed before dma_fence_wait() is called. This can lead to a use-after-free.</p> <p>Fix this by waiting on the fence first and releasing the reference only after dma_fence_wait() completes.</p> <p>Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory &#39;f&#39; (line 696)</p> <p>(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-31566 https://cve.radiocsirt.org/vuln/ghsa-j5m6-wgmm-m7m9 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib</p> <p>amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job completion.</p> <p>Currently, the code drops the fence reference using dma_fence_put() before calling dma_fence_wait().</p> <p>If dma_fence_put() releases the last reference, the fence may be freed before dma_fence_wait() is called. This can lead to a use-after-free.</p> <p>Fix this by waiting on the fence first and releasing the reference only after dma_fence_wait() completes.</p> <p>Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory &#39;f&#39; (line 696)</p> <p>(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib</p> <p>amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job completion.</p> <p>Currently, the code drops the fence reference using dma_fence_put() before calling dma_fence_wait().</p> <p>If dma_fence_put() releases the last reference, the fence may be freed before dma_fence_wait() is called. This can lead to a use-after-free.</p> <p>Fix this by waiting on the fence first and releasing the reference only after dma_fence_wait() completes.</p> <p>Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory &#39;f&#39; (line 696)</p> <p>(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)</p> https://cve.radiocsirt.org/vuln/ghsa-j5m6-wgmm-m7m9 https://cve.radiocsirt.org/vuln/msrc_cve-2026-31566 msrc_CVE-2026-31566 https://cve.radiocsirt.org/vuln/msrc_cve-2026-31566 https://cve.radiocsirt.org/vuln/oesa-2026-2581 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: mvpp2: Prevent parser TCAM memory corruption</p> <p>Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications.</p> <p>Both the TCAM and SRAM tables are indirectly accessed by configuring an index register that selects the row to read or write to. This means that operations must be atomic in order to, e.g., avoid spreading writes across multiple rows. Since the shadow SRAM array is used to find free rows in the hardware table, it must also be protected in order to avoid TOCTOU errors where multiple cores allocate the same row.</p> <p>This issue was detected in a situation where `mvpp2_set_rx_mode()` ran concurrently on two CPUs. In this particular case the MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the classifier unit to drop all incoming unicast - indicated by the `rx_classifier_drops` counter.(CVE-2025-22060)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mptcp: fix NULL pointer in can_accept_new_subflow</p> <p>When testing valkey benchmark tool with MPTCP, the kernel panics in &amp;apos;mptcp_can_accept_new_subflow&amp;apos; because subflow_req-&amp;gt;msk is NULL.</p> <p>Call trace:</p> <p>mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P) subflow_syn_recv_sock (./net/mptcp/subflow.c:854) tcp_check_req (./net/ipv4/tcp_minisocks.c:863) tcp_v4_rcv (./net/…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: mvpp2: Prevent parser TCAM memory corruption</p> <p>Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications.</p> <p>Both the TCAM and SRAM tables are indirectly accessed by configuring an index register that selects the row to read or write to. This means that operations must be atomic in order to, e.g., avoid spreading writes across multiple rows. Since the shadow SRAM array is used to find free rows in the hardware table, it must also be protected in order to avoid TOCTOU errors where multiple cores allocate the same row.</p> <p>This issue was detected in a situation where `mvpp2_set_rx_mode()` ran concurrently on two CPUs. In this particular case the MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the classifier unit to drop all incoming unicast - indicated by the `rx_classifier_drops` counter.(CVE-2025-22060)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>mptcp: fix NULL pointer in can_accept_new_subflow</p> <p>When testing valkey benchmark tool with MPTCP, the kernel panics in &amp;apos;mptcp_can_accept_new_subflow&amp;apos; because subflow_req-&amp;gt;msk is NULL.</p> <p>Call trace:</p> <p>mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P) subflow_syn_recv_sock (./net/mptcp/subflow.c:854) tcp_check_req (./net/ipv4/tcp_minisocks.c:863) tcp_v4_rcv (./net/…</p> https://cve.radiocsirt.org/vuln/oesa-2026-2581 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21555-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21555-1 https://cve.radiocsirt.org/vuln/rhsa-2026:71330 <p>kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib kernel: netfilter: nf_queue: hold bridge skb-&gt;dev while queued kernel: pppoe: reload header pointer after dev_hard_header() kernel: ipvs: do not propagate one-packet flag to synced conns kernel: nvme-tcp: reject a read that transferred too few bytes</p> <p>kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib kernel: netfilter: nf_queue: hold bridge skb-&gt;dev while queued kernel: pppoe: reload header pointer after dev_hard_header() kernel: ipvs: do not propagate one-packet flag to synced conns kernel: nvme-tcp: reject a read that transferred too few bytes</p> https://cve.radiocsirt.org/vuln/rhsa-2026:71330 https://cve.radiocsirt.org/vuln/rlsa-2026:67150 <p><strong>Affected:</strong> Rocky Linux:9: kernel</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)</p> <p>* kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)</p> <p>* kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)</p> <p>* kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)</p> <p>* kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)</p> <p>* kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)</p> <p>* kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)</p> <p>* kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)</p> <p>* kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)</p> <p>* kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)</p> <p>* kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)</p> <p>* kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)</p> <p>* kernel: iommu/amd: Fix clone_alias() to use the original device&#39;s devid (CVE-2026-53053)</p> <p>* kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)</p> <p>* kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)</p> <p>* kernel: Bluetooth: RFCOMM: hold li…</p> <p><strong>Affected:</strong> Rocky Linux:9: kernel</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)</p> <p>* kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)</p> <p>* kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)</p> <p>* kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)</p> <p>* kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)</p> <p>* kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)</p> <p>* kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)</p> <p>* kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)</p> <p>* kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)</p> <p>* kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)</p> <p>* kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)</p> <p>* kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)</p> <p>* kernel: iommu/amd: Fix clone_alias() to use the original device&#39;s devid (CVE-2026-53053)</p> <p>* kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)</p> <p>* kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)</p> <p>* kernel: Bluetooth: RFCOMM: hold li…</p> https://cve.radiocsirt.org/vuln/rlsa-2026:67150 https://cve.radiocsirt.org/vuln/suse-su-2026:23066-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23066-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-31566 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 140 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job completion. Currently, the code drops the fence reference using dma_fence_put() before calling dma_fence_wait(). If dma_fence_put() releases the last reference, the fence may be freed before dma_fence_wait() is called. This can lead to a use-after-free. Fix this by waiting on the fence first and releasing the reference only after dma_fence_wait() completes. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory &#39;f&#39; (line 696) (cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 140 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job completion. Currently, the code drops the fence reference using dma_fence_put() before calling dma_fence_wait(). If dma_fence_put() releases the last reference, the fence may be freed before dma_fence_wait() is called. This can lead to a use-after-free. Fix this by waiting on the fence first and releasing the reference only after dma_fence_wait() completes. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory &#39;f&#39; (line 696) (cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-31566 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1279 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, welche zu einem Denial-of-Service-Zustand, einer Rechteausweitung, der Ausführung von Code oder einer Speicherbeschädigung führen könnten.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, welche zu einem Denial-of-Service-Zustand, einer Rechteausweitung, der Ausführung von Code oder einer Speicherbeschädigung führen könnten.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1279