https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:03:25 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:65334 <p><strong>Affected:</strong> AlmaLinux:10: kernel, AlmaLinux:10: kernel-64k, AlmaLinux:10: kernel-64k-core, AlmaLinux:10: kernel-64k-debug, AlmaLinux:10: kernel-64k-debug-core, AlmaLinux:10: kernel-64k-debug-devel, AlmaLinux:10: kernel-64k-debug-devel-matched, AlmaLinux:10: kernel-64k-debug-modules, AlmaLinux:10: kernel-64k-debug-modules-core, AlmaLinux:10: kernel-64k-debug-modules-extra and 65 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256) * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182) * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209) * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254) * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322) * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975) * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015) * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947) * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sy…</p> <p><strong>Affected:</strong> AlmaLinux:10: kernel, AlmaLinux:10: kernel-64k, AlmaLinux:10: kernel-64k-core, AlmaLinux:10: kernel-64k-debug, AlmaLinux:10: kernel-64k-debug-core, AlmaLinux:10: kernel-64k-debug-devel, AlmaLinux:10: kernel-64k-debug-devel-matched, AlmaLinux:10: kernel-64k-debug-modules, AlmaLinux:10: kernel-64k-debug-modules-core, AlmaLinux:10: kernel-64k-debug-modules-extra and 65 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256) * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182) * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209) * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254) * kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322) * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975) * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015) * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947) * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sy…</p> https://cve.radiocsirt.org/vuln/alsa-2026:65334 https://cve.radiocsirt.org/vuln/bell-cve-2026-63975 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-63975 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0926 certfr-2026-avi-0926 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0926 https://cve.radiocsirt.org/vuln/euvd-2026-348330 EUVD-2026-348330 https://cve.radiocsirt.org/vuln/euvd-2026-348330 https://cve.radiocsirt.org/vuln/fkie_cve-2026-63975 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp</p> <p>If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan-&gt;dcid may be assigned previously it really needs to be disconnected.</p> <p>Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp</p> <p>If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan-&gt;dcid may be assigned previously it really needs to be disconnected.</p> <p>Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-63975 https://cve.radiocsirt.org/vuln/ghsa-g36p-q7h2-h3pp <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp</p> <p>If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan-&gt;dcid may be assigned previously it really needs to be disconnected.</p> <p>Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp</p> <p>If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan-&gt;dcid may be assigned previously it really needs to be disconnected.</p> <p>Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously.</p> https://cve.radiocsirt.org/vuln/ghsa-g36p-q7h2-h3pp https://cve.radiocsirt.org/vuln/oesa-2026-3204 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()</p> <p>Simplify the code by using device managed memory allocations.</p> <p>This also fixes a memory leak in rtw_register_hw(). The supported bands were not freed in the error path.</p> <p>Copied from commit 145df52a8671 (&amp;quot;wifi: rtw89: Convert rtw89_core_set_supported_band to use devm_*&amp;quot;).(CVE-2025-71273)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xfrm: hold dev ref until after transport_finish NF_HOOK</p> <p>After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The skb-&amp;gt;dev pointer is then used inside NF_HOOK and its okfn, which can race with device teardown.</p> <p>Remove the dev_put from the async resumption entry and instead drop the reference after the NF_HOOK call in transport_finish, using a saved device pointer since NF_HOOK may consume the skb. This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn.</p> <p>For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set.(CVE-2026-31663)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>x86: shadow stacks: proper error handling for mmap lock</p> <p>김영민 reports that shstk_pop_sigframe() doesn&amp;apos;t check for errors from mmap_read_lock_killable(), whic…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()</p> <p>Simplify the code by using device managed memory allocations.</p> <p>This also fixes a memory leak in rtw_register_hw(). The supported bands were not freed in the error path.</p> <p>Copied from commit 145df52a8671 (&amp;quot;wifi: rtw89: Convert rtw89_core_set_supported_band to use devm_*&amp;quot;).(CVE-2025-71273)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xfrm: hold dev ref until after transport_finish NF_HOOK</p> <p>After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The skb-&amp;gt;dev pointer is then used inside NF_HOOK and its okfn, which can race with device teardown.</p> <p>Remove the dev_put from the async resumption entry and instead drop the reference after the NF_HOOK call in transport_finish, using a saved device pointer since NF_HOOK may consume the skb. This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn.</p> <p>For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set.(CVE-2026-31663)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>x86: shadow stacks: proper error handling for mmap lock</p> <p>김영민 reports that shstk_pop_sigframe() doesn&amp;apos;t check for errors from mmap_read_lock_killable(), whic…</p> https://cve.radiocsirt.org/vuln/oesa-2026-3204 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21555-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21555-1 https://cve.radiocsirt.org/vuln/rhsa-2026:70402 <p>kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread kernel: Bluetooth: L2CAP: Fix potential user-after-free kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing kernel: Bluetooth: serialize accept_q access kernel: iommu/amd: Fix clone_alias() to use the original device&#39;s devid kernel: dm cache policy smq: fix missing locks in invalidating cache blocks kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() kernel: keys: Pin request_key_auth payload in instantiate paths kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads</p> <p>kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread kernel: Bluetooth: L2CAP: Fix potential user-after-free kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing kernel: Bluetooth: serialize accept_q access kernel: iommu/amd: Fix clone_alias() to use the original device&#39;s devid kernel: dm cache policy smq: fix missing locks in invalidating cache blocks kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() kernel: keys: Pin request_key_auth payload in instantiate paths kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads</p> https://cve.radiocsirt.org/vuln/rhsa-2026:70402 https://cve.radiocsirt.org/vuln/rlsa-2026:65334 <p><strong>Affected:</strong> Rocky Linux:10: kernel</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)</p> <p>* kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)</p> <p>* kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)</p> <p>* kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)</p> <p>* kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)</p> <p>* kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)</p> <p>* kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)</p> <p>* kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)</p> <p>* kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)</p> <p>* kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)</p> <p>* kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)</p> <p>* kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)</p> <p>* kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)</p> <p>* kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)</p> <p>* kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)</p> <p>* kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)…</p> <p><strong>Affected:</strong> Rocky Linux:10: kernel</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)</p> <p>* kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)</p> <p>* kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)</p> <p>* kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)</p> <p>* kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)</p> <p>* kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)</p> <p>* kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)</p> <p>* kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)</p> <p>* kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)</p> <p>* kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)</p> <p>* kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)</p> <p>* kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)</p> <p>* kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)</p> <p>* kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)</p> <p>* kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)</p> <p>* kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)…</p> https://cve.radiocsirt.org/vuln/rlsa-2026:65334 https://cve.radiocsirt.org/vuln/suse-su-2026:23066-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23066-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-63975 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 192 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan-&gt;dcid may be assigned previously it really needs to be disconnected. Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 192 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2cap_chan_del may invalidate the tmp cursor created by list_for_each_entry_safe and in fact it is the wrong procedure as the chan-&gt;dcid may be assigned previously it really needs to be disconnected. Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so instead schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-63975 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2403 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2403