https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:32:30 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:55764 <p><strong>Affected:</strong> AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902) * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136) * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329) * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374) * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884) * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879) * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219) * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* Backport &#34;sched/deadline: Fix bandwidth reclaim equation in GRUB&#34; to AlmaLinux 8.10 (JIRA:AlmaLinux-189997) * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-8.10.z] (JIRA:AlmaLinux-224556)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902) * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136) * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329) * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374) * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884) * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879) * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219) * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* Backport &#34;sched/deadline: Fix bandwidth reclaim equation in GRUB&#34; to AlmaLinux 8.10 (JIRA:AlmaLinux-189997) * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-8.10.z] (JIRA:AlmaLinux-224556)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:55764 https://cve.radiocsirt.org/vuln/bdu:2026-11095 bdu:2026-11095 https://cve.radiocsirt.org/vuln/bdu:2026-11095 https://cve.radiocsirt.org/vuln/bell-cve-2026-43206 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-43206 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0696 certfr-2026-avi-0696 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0696 https://cve.radiocsirt.org/vuln/euvd-2026-347856 EUVD-2026-347856 https://cve.radiocsirt.org/vuln/euvd-2026-347856 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43206 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()</p> <p>The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()</p> <p>The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43206 https://cve.radiocsirt.org/vuln/ghsa-h9w8-48v5-m9c9 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()</p> <p>The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()</p> <p>The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation.</p> https://cve.radiocsirt.org/vuln/ghsa-h9w8-48v5-m9c9 https://cve.radiocsirt.org/vuln/oesa-2026-2930 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: mac80211: check tdls flag in ieee80211_tdls_oper</p> <p>When NL80211_TDLS_ENABLE_LINK is called, the code only checks if the station exists but not whether it is actually a TDLS station. This allows the operation to proceed for non-TDLS stations, causing unintended side effects like modifying channel context and HT protection before failing.</p> <p>Add a check for sta-&amp;gt;sta.tdls early in the ENABLE_LINK case, before any side effects occur, to ensure the operation is only allowed for actual TDLS peers.(CVE-2026-43052)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: brcmfmac: validate bsscfg indices in IF events</p> <p>brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr-&amp;gt;iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check.</p> <p>Reject IF events whose bsscfg index does not fit in drvr-&amp;gt;iflist[] before indexing the interface array.</p> <p>[add missing wifi prefix](CVE-2026-43110)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>HID: roccat: fix use-after-free in roccat_report_event</p> <p>roccat_report_event() iterates over the device-&amp;gt;readers list without holding the readers_lock. This allows a concurrent roccat_release() to remove and free a reader while it&amp;apos;s still being accessed, leading to a use-after-f…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: mac80211: check tdls flag in ieee80211_tdls_oper</p> <p>When NL80211_TDLS_ENABLE_LINK is called, the code only checks if the station exists but not whether it is actually a TDLS station. This allows the operation to proceed for non-TDLS stations, causing unintended side effects like modifying channel context and HT protection before failing.</p> <p>Add a check for sta-&amp;gt;sta.tdls early in the ENABLE_LINK case, before any side effects occur, to ensure the operation is only allowed for actual TDLS peers.(CVE-2026-43052)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: brcmfmac: validate bsscfg indices in IF events</p> <p>brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr-&amp;gt;iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check.</p> <p>Reject IF events whose bsscfg index does not fit in drvr-&amp;gt;iflist[] before indexing the interface array.</p> <p>[add missing wifi prefix](CVE-2026-43110)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>HID: roccat: fix use-after-free in roccat_report_event</p> <p>roccat_report_event() iterates over the device-&amp;gt;readers list without holding the readers_lock. This allows a concurrent roccat_release() to remove and free a reader while it&amp;apos;s still being accessed, leading to a use-after-f…</p> https://cve.radiocsirt.org/vuln/oesa-2026-2930 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21555-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21555-1 https://cve.radiocsirt.org/vuln/rhsa-2026:55764 <p>kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() kernel: crypto: ccp - copy IV using skcipher ivsize kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() kernel: drm/amdgpu: zero-initialize GART table on allocation kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages kernel: drm/i915: Fix potential UAF in TTM object purge kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async</p> <p>kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() kernel: crypto: ccp - copy IV using skcipher ivsize kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() kernel: drm/amdgpu: zero-initialize GART table on allocation kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages kernel: drm/i915: Fix potential UAF in TTM object purge kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async</p> https://cve.radiocsirt.org/vuln/rhsa-2026:55764 https://cve.radiocsirt.org/vuln/rlsa-2026:55764 <p><strong>Affected:</strong> Rocky Linux:8: kernel</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)</p> <p>* kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)</p> <p>* kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)</p> <p>* kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)</p> <p>* kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)</p> <p>* kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)</p> <p>* kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)</p> <p>* kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)</p> <p>* kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)</p> <p>* kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* Backport &#34;sched/deadline: Fix bandwidth reclaim equation in GRUB&#34; to Rocky Linux 8.10 (JIRA:Rocky Linux-189997)</p> <p>* vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:Rocky Linux-224556)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:8: kernel</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902)</p> <p>* kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)</p> <p>* kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)</p> <p>* kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)</p> <p>* kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)</p> <p>* kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)</p> <p>* kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)</p> <p>* kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)</p> <p>* kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)</p> <p>* kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* Backport &#34;sched/deadline: Fix bandwidth reclaim equation in GRUB&#34; to Rocky Linux 8.10 (JIRA:Rocky Linux-189997)</p> <p>* vhost: reset the vring metadata cache on vring reconfiguration [rhel-8.10.z] (JIRA:Rocky Linux-224556)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:55764 https://cve.radiocsirt.org/vuln/suse-su-2026:22108-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22108-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-43206 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3 and 205 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3 and 205 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-43206 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1405 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht spezifizierte Angriffe durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht spezifizierte Angriffe durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1405