https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:38:43 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:67150 <p><strong>Affected:</strong> AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745) * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466) * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479) * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566) * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656) * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368) * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: iommu/amd: Fix clone_alias() to use the original device&#39;s devid (CVE-2026-53053) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluet…</p> <p><strong>Affected:</strong> AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745) * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466) * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479) * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566) * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656) * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368) * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: iommu/amd: Fix clone_alias() to use the original device&#39;s devid (CVE-2026-53053) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluet…</p> https://cve.radiocsirt.org/vuln/alsa-2026:67150 https://cve.radiocsirt.org/vuln/bell-cve-2026-63945 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-63945 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0926 certfr-2026-avi-0926 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0926 https://cve.radiocsirt.org/vuln/euvd-2026-348317 EUVD-2026-348317 https://cve.radiocsirt.org/vuln/euvd-2026-348317 https://cve.radiocsirt.org/vuln/fkie_cve-2026-63945 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock</p> <p>iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk).</p> <p>iso_sock_clear_timer() reads iso_pi(sk)-&gt;conn twice without the socket lock held:</p> <p>if (!iso_pi(sk)-&gt;conn) return; cancel_delayed_work(&amp;iso_pi(sk)-&gt;conn-&gt;timeout_work);</p> <p>Concurrently, iso_conn_del() executes under lock_sock(sk) and calls iso_chan_del(), which sets iso_pi(sk)-&gt;conn to NULL and may result in the final reference to the connection being dropped:</p> <p>CPU0 CPU1 ---- ---- iso_sock_clear_timer() if (conn != NULL) ... lock_sock(sk) iso_chan_del() iso_pi(sk)-&gt;conn = NULL cancel_delayed_work(conn) /* NULL deref or UAF */</p> <p>iso_pi(sk)-&gt;conn is not stable across the unlock window, causing a NULL pointer dereference or use-after-free.</p> <p>Serialize iso_sock_clear_timer() with the socket lock by moving it inside lock_sock()/release_sock(), matching the pattern used in iso_conn_del() and all other call sites.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock</p> <p>iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk).</p> <p>iso_sock_clear_timer() reads iso_pi(sk)-&gt;conn twice without the socket lock held:</p> <p>if (!iso_pi(sk)-&gt;conn) return; cancel_delayed_work(&amp;iso_pi(sk)-&gt;conn-&gt;timeout_work);</p> <p>Concurrently, iso_conn_del() executes under lock_sock(sk) and calls iso_chan_del(), which sets iso_pi(sk)-&gt;conn to NULL and may result in the final reference to the connection being dropped:</p> <p>CPU0 CPU1 ---- ---- iso_sock_clear_timer() if (conn != NULL) ... lock_sock(sk) iso_chan_del() iso_pi(sk)-&gt;conn = NULL cancel_delayed_work(conn) /* NULL deref or UAF */</p> <p>iso_pi(sk)-&gt;conn is not stable across the unlock window, causing a NULL pointer dereference or use-after-free.</p> <p>Serialize iso_sock_clear_timer() with the socket lock by moving it inside lock_sock()/release_sock(), matching the pattern used in iso_conn_del() and all other call sites.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-63945 https://cve.radiocsirt.org/vuln/ghsa-85m8-5mhx-q797 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock</p> <p>iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk).</p> <p>iso_sock_clear_timer() reads iso_pi(sk)-&gt;conn twice without the socket lock held:</p> <p>if (!iso_pi(sk)-&gt;conn) return; cancel_delayed_work(&amp;iso_pi(sk)-&gt;conn-&gt;timeout_work);</p> <p>Concurrently, iso_conn_del() executes under lock_sock(sk) and calls iso_chan_del(), which sets iso_pi(sk)-&gt;conn to NULL and may result in the final reference to the connection being dropped:</p> <p>CPU0 CPU1 ---- ---- iso_sock_clear_timer() if (conn != NULL) ... lock_sock(sk) iso_chan_del() iso_pi(sk)-&gt;conn = NULL cancel_delayed_work(conn) /* NULL deref or UAF */</p> <p>iso_pi(sk)-&gt;conn is not stable across the unlock window, causing a NULL pointer dereference or use-after-free.</p> <p>Serialize iso_sock_clear_timer() with the socket lock by moving it inside lock_sock()/release_sock(), matching the pattern used in iso_conn_del() and all other call sites.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock</p> <p>iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk).</p> <p>iso_sock_clear_timer() reads iso_pi(sk)-&gt;conn twice without the socket lock held:</p> <p>if (!iso_pi(sk)-&gt;conn) return; cancel_delayed_work(&amp;iso_pi(sk)-&gt;conn-&gt;timeout_work);</p> <p>Concurrently, iso_conn_del() executes under lock_sock(sk) and calls iso_chan_del(), which sets iso_pi(sk)-&gt;conn to NULL and may result in the final reference to the connection being dropped:</p> <p>CPU0 CPU1 ---- ---- iso_sock_clear_timer() if (conn != NULL) ... lock_sock(sk) iso_chan_del() iso_pi(sk)-&gt;conn = NULL cancel_delayed_work(conn) /* NULL deref or UAF */</p> <p>iso_pi(sk)-&gt;conn is not stable across the unlock window, causing a NULL pointer dereference or use-after-free.</p> <p>Serialize iso_sock_clear_timer() with the socket lock by moving it inside lock_sock()/release_sock(), matching the pattern used in iso_conn_del() and all other call sites.</p> https://cve.radiocsirt.org/vuln/ghsa-85m8-5mhx-q797 https://cve.radiocsirt.org/vuln/oesa-2026-3704 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: hns3: add VLAN id validation before using</p> <p>Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause out-of-bounds memory access once the VLAN id is bigger than or equal to VLAN_N_VID.</p> <p>Therefore, VLAN id needs to be checked to ensure it is within the range of VLAN_N_VID.(CVE-2025-71112)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ext4: fix string copying in parse_apply_sb_mount_options()</p> <p>strscpy_pad() can&amp;apos;t be used to copy a non-NUL-term string into a NUL-term string of possibly bigger size. Commit 0efc5990bca5 (&amp;quot;string.h: Introduce memtostr() and memtostr_pad()&amp;quot;) provides additional information in that regard. So if this happens, the following warning is observed:</p> <p>strnlen: detected buffer overflow: 65 byte read of buffer size 64 WARNING: CPU: 0 PID: 28655 at lib/string_helpers.c:1032 __fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Modules linked in: CPU: 0 UID: 0 PID: 28655 Comm: syz-executor.3 Not tainted 6.12.54-syzkaller-00144-g5f0270f1ba00 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Call Trace: &amp;lt;TASK&amp;gt; __fortify_panic+0x1f/0x30 lib/s…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: hns3: add VLAN id validation before using</p> <p>Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause out-of-bounds memory access once the VLAN id is bigger than or equal to VLAN_N_VID.</p> <p>Therefore, VLAN id needs to be checked to ensure it is within the range of VLAN_N_VID.(CVE-2025-71112)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ext4: fix string copying in parse_apply_sb_mount_options()</p> <p>strscpy_pad() can&amp;apos;t be used to copy a non-NUL-term string into a NUL-term string of possibly bigger size. Commit 0efc5990bca5 (&amp;quot;string.h: Introduce memtostr() and memtostr_pad()&amp;quot;) provides additional information in that regard. So if this happens, the following warning is observed:</p> <p>strnlen: detected buffer overflow: 65 byte read of buffer size 64 WARNING: CPU: 0 PID: 28655 at lib/string_helpers.c:1032 __fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Modules linked in: CPU: 0 UID: 0 PID: 28655 Comm: syz-executor.3 Not tainted 6.12.54-syzkaller-00144-g5f0270f1ba00 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Call Trace: &amp;lt;TASK&amp;gt; __fortify_panic+0x1f/0x30 lib/s…</p> https://cve.radiocsirt.org/vuln/oesa-2026-3704 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21555-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21555-1 https://cve.radiocsirt.org/vuln/rlsa-2026:67150 <p><strong>Affected:</strong> Rocky Linux:9: kernel</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)</p> <p>* kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)</p> <p>* kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)</p> <p>* kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)</p> <p>* kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)</p> <p>* kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)</p> <p>* kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)</p> <p>* kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)</p> <p>* kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)</p> <p>* kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)</p> <p>* kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)</p> <p>* kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)</p> <p>* kernel: iommu/amd: Fix clone_alias() to use the original device&#39;s devid (CVE-2026-53053)</p> <p>* kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)</p> <p>* kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)</p> <p>* kernel: Bluetooth: RFCOMM: hold li…</p> <p><strong>Affected:</strong> Rocky Linux:9: kernel</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)</p> <p>* kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)</p> <p>* kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)</p> <p>* kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)</p> <p>* kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)</p> <p>* kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)</p> <p>* kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)</p> <p>* kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)</p> <p>* kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)</p> <p>* kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)</p> <p>* kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)</p> <p>* kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)</p> <p>* kernel: iommu/amd: Fix clone_alias() to use the original device&#39;s devid (CVE-2026-53053)</p> <p>* kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)</p> <p>* kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)</p> <p>* kernel: Bluetooth: RFCOMM: hold li…</p> https://cve.radiocsirt.org/vuln/rlsa-2026:67150 https://cve.radiocsirt.org/vuln/suse-su-2026:23066-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23066-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-63945 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 153 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk). iso_sock_clear_timer() reads iso_pi(sk)-&gt;conn twice without the socket lock held: if (!iso_pi(sk)-&gt;conn) return; cancel_delayed_work(&amp;iso_pi(sk)-&gt;conn-&gt;timeout_work); Concurrently, iso_conn_del() executes under lock_sock(sk) and calls iso_chan_del(), which sets iso_pi(sk)-&gt;conn to NULL and may result in the final reference to the connection being dropped: CPU0 CPU1 ---- ---- iso_sock_clear_timer() if (conn != NULL) ... lock_sock(sk) iso_chan_del() iso_pi(sk)-&gt;conn = NULL cancel_delayed_work(conn) /* NULL deref or UAF */ iso_pi(sk)-&gt;conn is not stable across the unlock window, causing a NULL pointer dereference or use-after-free. Serialize iso_sock_clear_timer() with the socket lock by moving it inside lock_sock()/release_sock(), matching the pattern used in iso_conn_del() and all other call sites.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 153 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk). iso_sock_clear_timer() reads iso_pi(sk)-&gt;conn twice without the socket lock held: if (!iso_pi(sk)-&gt;conn) return; cancel_delayed_work(&amp;iso_pi(sk)-&gt;conn-&gt;timeout_work); Concurrently, iso_conn_del() executes under lock_sock(sk) and calls iso_chan_del(), which sets iso_pi(sk)-&gt;conn to NULL and may result in the final reference to the connection being dropped: CPU0 CPU1 ---- ---- iso_sock_clear_timer() if (conn != NULL) ... lock_sock(sk) iso_chan_del() iso_pi(sk)-&gt;conn = NULL cancel_delayed_work(conn) /* NULL deref or UAF */ iso_pi(sk)-&gt;conn is not stable across the unlock window, causing a NULL pointer dereference or use-after-free. Serialize iso_sock_clear_timer() with the socket lock by moving it inside lock_sock()/release_sock(), matching the pattern used in iso_conn_del() and all other call sites.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-63945 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2403 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2403