Most recent entries from all

ALSA-2026:23329 — Important: kernel security update

Affected: AlmaLinux:10: kernel, AlmaLinux:10: kernel-64k, AlmaLinux:10: kernel-64k-core, AlmaLinux:10: kernel-64k-debug, AlmaLinux:10: kernel-64k-debug-core, AlmaLinux:10: kernel-64k-debug-devel, AlmaLinux:10: kernel-64k-debug-devel-matched, AlmaLinux:10: kernel-64k-debug-modules, AlmaLinux:10: kernel-64k-debug-modules-core, AlmaLinux:10: kernel-64k-debug-modules-extra and 65 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366) * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete (CVE-2026-43322) * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-12586

BELL-CVE-2026-31613

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

certfr-2026-avi-0694 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un…

certfr-2026-avi-0694

ESSA-2026:0162 — Important: kernel security, bug fix, and enhancement update

Important: kernel security, bug fix, and enhancement update

EUVD-2026-347735

fkie_cve-2026-31613

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB reads parsing symlink error response

When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the symlink parsers as the only defense against an untrusted server.

symlink_data() walks SMB 3.1.1 error contexts with the loop test "p < end", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset 0. When the server-controlled ErrorDataLength advances p to within 1-7 bytes of end, the next iteration will read past it. When the matching context is found, sym->SymLinkErrorTag is read at offset 4 from p->ErrorContextData with no check that the symlink header itself fits.

smb2_parse_symlink_response() then bounds-checks the substitute name using SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from iov_base. That value is computed as sizeof(smb2_err_rsp) + sizeof(smb2_symlink_err_rsp), which is correct only when ErrorContextCount == 0.

With at least one error context the symlink data sits 8 bytes deeper, and each skipped non-matching context shifts it further by 8 + ALIGN(ErrorDataLength, 8). The check is too short, allowing the substitute name read to run past iov_len. The out-of-bound heap bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2).

Fix this all up by making the loops test require the full context header to fit, rejecting sym if its header runs past end,…

GHSA-3w37-m4pg-q585

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB reads parsing symlink error response

When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the symlink parsers as the only defense against an untrusted server.

Fix this all up by making the loops test require the full context header to fit, rejecting sym if its header runs past end,…

msrc_CVE-2026-31613 — smb: client: fix OOB reads parsing symlink error response

msrc_CVE-2026-31613

RHSA-2026:25120 — Red Hat Security Advisory: kernel-rt security update

kernel: smc: Fix use-after-free in tcp_write_timer_handler() kernel: geneve: Fix use-after-free in geneve_find_dev(). kernel: nbd: defer config unlock in nbd_genl_connect kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() kernel: netfilter: nf_tables: release flowtable after rcu grace period on error kernel: ALSA: 6fire: fix use-after-free on disconnect kernel: smb: client: fix OOB reads parsing symlink error response kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() kernel: dlm: validate length in dlm_search_rsb_tree kernel: RDMA/rxe: Fix double free in rxe_srq_from_init kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

RLSA-2026:25120 — Critical: kernel-rt security update

Affected: Rocky Linux:8: kernel-rt

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)

* kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)

* kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

* kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

* kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

* kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

* kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

* kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

* kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

* kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

* kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)

* kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)

* kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:22043-1 — Security update for the Linux Kernel

Security update for the Linux Kernel

UBUNTU-CVE-2026-31613

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 158 more

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the symlink parsers as the only defense against an untrusted server. symlink_data() walks SMB 3.1.1 error contexts with the loop test "p < end", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset 0. When the server-controlled ErrorDataLength advances p to within 1-7 bytes of end, the next iteration will read past it. When the matching context is found, sym->SymLinkErrorTag is read at offset 4 from p->ErrorContextData with no check that the symlink header itself fits. smb2_parse_symlink_response() then bounds-checks the substitute name using SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from iov_base. That value is computed as sizeof(smb2_err_rsp) + sizeof(smb2_symlink_err_rsp), which is correct only when ErrorContextCount == 0. With at least one error context the symlink data sits 8 bytes deeper, and each skipped non-matching context shifts it further by 8 + ALIGN(ErrorDataLength, 8). The check is too short, allowing the substitute name read to run past iov_len. The out-of-bound heap bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2). Fix this all up by making the loops test require the full context header to fit, rejecting sym if its header runs past end, and bo…

WID-SEC-W-2026-1279 — Linux Kernel: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, welche zu einem Denial-of-Service-Zustand, einer Rechteausweitung, der Ausführung von Code oder einer Speicherbeschädigung führen könnten.