https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:26:07 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:38491 <p><strong>Affected:</strong> AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling (CVE-2026-22979) * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* Kernel panic very early during boot while reading a tracefs file (available_filter_functions) due to invalid module name pointer [9.8.z] (JIRA:AlmaLinux-183236)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling (CVE-2026-22979) * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* Kernel panic very early during boot while reading a tracefs file (available_filter_functions) due to invalid module name pointer [9.8.z] (JIRA:AlmaLinux-183236)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:38491 https://cve.radiocsirt.org/vuln/bdu:2026-08889 bdu:2026-08889 https://cve.radiocsirt.org/vuln/bdu:2026-08889 https://cve.radiocsirt.org/vuln/bell-cve-2026-43499 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-43499 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0745 certfr-2026-avi-0745 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0745 https://cve.radiocsirt.org/vuln/essa-2026:0154 <p>Important: kernel update</p> <p>Important: kernel update</p> https://cve.radiocsirt.org/vuln/essa-2026:0154 https://cve.radiocsirt.org/vuln/euvd-2026-364804 EUVD-2026-364804 https://cve.radiocsirt.org/vuln/euvd-2026-364804 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43499 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>rtmutex: Use waiter::task instead of current in remove_waiter()</p> <p>remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue().</p> <p>In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems:</p> <p>1) the rbtree dequeue happens without waiter::task::pi_lock being held</p> <p>2) the waiter task&#39;s pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around.</p> <p>3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task</p> <p>Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems.</p> <p>[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>rtmutex: Use waiter::task instead of current in remove_waiter()</p> <p>remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue().</p> <p>In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems:</p> <p>1) the rbtree dequeue happens without waiter::task::pi_lock being held</p> <p>2) the waiter task&#39;s pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around.</p> <p>3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task</p> <p>Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems.</p> <p>[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43499 https://cve.radiocsirt.org/vuln/ghsa-cqc6-9f34-295v <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>rtmutex: Use waiter::task instead of current in remove_waiter()</p> <p>remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue().</p> <p>In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems:</p> <p>1) the rbtree dequeue happens without waiter::task::pi_lock being held</p> <p>2) the waiter task&#39;s pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around.</p> <p>3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task</p> <p>Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems.</p> <p>[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>rtmutex: Use waiter::task instead of current in remove_waiter()</p> <p>remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue().</p> <p>In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems:</p> <p>1) the rbtree dequeue happens without waiter::task::pi_lock being held</p> <p>2) the waiter task&#39;s pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around.</p> <p>3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task</p> <p>Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems.</p> <p>[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]</p> https://cve.radiocsirt.org/vuln/ghsa-cqc6-9f34-295v https://cve.radiocsirt.org/vuln/msrc_cve-2026-43499 msrc_CVE-2026-43499 https://cve.radiocsirt.org/vuln/msrc_cve-2026-43499 https://cve.radiocsirt.org/vuln/oesa-2026-2674 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>btrfs: qgroup: fix race between quota disable and quota rescan ioctl</p> <p>There&amp;apos;s a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info-&amp;gt;qgroup_tree rbtree.</p> <p>This happens as follows:</p> <p>1) Task A enters btrfs_ioctl_quota_rescan() -&amp;gt; btrfs_qgroup_rescan();</p> <p>2) Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info-&amp;gt;qgroup_rescan_running is false (it wasn&amp;apos;t set yet by task A);</p> <p>3) Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info-&amp;gt;qgroup_tree without taking the lock fs_info-&amp;gt;qgroup_lock;</p> <p>4) Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info-&amp;gt;qgroup_tree tree while holding fs_info-&amp;gt;qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free.</p> <p>Fix this by taking fs_info-&amp;gt;qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don&amp;apos;t start the rescan worker if quotas were already disabled.(CVE-2025-39759)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: wilc1000: avoid buffer overflow in WID string configuration</p> <p>Fix the following copy overflow warning identi…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP4: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>btrfs: qgroup: fix race between quota disable and quota rescan ioctl</p> <p>There&amp;apos;s a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info-&amp;gt;qgroup_tree rbtree.</p> <p>This happens as follows:</p> <p>1) Task A enters btrfs_ioctl_quota_rescan() -&amp;gt; btrfs_qgroup_rescan();</p> <p>2) Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info-&amp;gt;qgroup_rescan_running is false (it wasn&amp;apos;t set yet by task A);</p> <p>3) Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info-&amp;gt;qgroup_tree without taking the lock fs_info-&amp;gt;qgroup_lock;</p> <p>4) Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info-&amp;gt;qgroup_tree tree while holding fs_info-&amp;gt;qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free.</p> <p>Fix this by taking fs_info-&amp;gt;qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don&amp;apos;t start the rescan worker if quotas were already disabled.(CVE-2025-39759)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: wilc1000: avoid buffer overflow in WID string configuration</p> <p>Fix the following copy overflow warning identi…</p> https://cve.radiocsirt.org/vuln/oesa-2026-2674 https://cve.radiocsirt.org/vuln/rhsa-2026:37728 <p>kernel: rtmutex: Use waiter::task instead of current in remove_waiter() kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock</p> <p>kernel: rtmutex: Use waiter::task instead of current in remove_waiter() kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock</p> https://cve.radiocsirt.org/vuln/rhsa-2026:37728 https://cve.radiocsirt.org/vuln/rlsa-2026:38491 <p><strong>Affected:</strong> Rocky Linux:9: kernel</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling (CVE-2026-22979)</p> <p>* kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)</p> <p>* kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086)</p> <p>* kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)</p> <p>* kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* Kernel panic very early during boot while reading a tracefs file (available_filter_functions) due to invalid module name pointer [9.8.z] (JIRA:Rocky Linux-183236)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:9: kernel</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling (CVE-2026-22979)</p> <p>* kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)</p> <p>* kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086)</p> <p>* kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)</p> <p>* kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* Kernel panic very early during boot while reading a tracefs file (available_filter_functions) due to invalid module name pointer [9.8.z] (JIRA:Rocky Linux-183236)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:38491 https://cve.radiocsirt.org/vuln/ssa-019113 <p>Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).</p> <p>Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.</p> <p>Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).</p> <p>Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.</p> https://cve.radiocsirt.org/vuln/ssa-019113 https://cve.radiocsirt.org/vuln/suse-su-2026:22043-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22043-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-43499 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 245 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task&#39;s pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 245 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task&#39;s pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-43499 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1656 <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um seine Privilegien zu eskalieren oder nicht näher spezifizierte Angriffe durchzuführen, darunter möglicherweise Denial-of-Service-Angriffe, Speicherbeschädigungen oder die Offenlegung von Informationen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um seine Privilegien zu eskalieren oder nicht näher spezifizierte Angriffe durchzuführen, darunter möglicherweise Denial-of-Service-Angriffe, Speicherbeschädigungen oder die Offenlegung von Informationen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1656