Most recent entries from all

ALSA-2026:68570 — Important: kernel security, bug fix, and enhancement update

Affected: AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114) * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971) * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176) * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192) * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869) * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinje…

BELL-CVE-2026-72003

Affected: Alpaquita:stream: linux-lts

EUVD-2026-353900

fkie_cve-2026-72003

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted:

u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data); ... memcpy(&mgmt_frame->u, frame, mgmt_frame_len - offsetof(struct ieee80211_mgmt, u));

The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When mgmt_frame_len is below that, the subtraction wraps as an unsigned value to a huge length. The memcpy then runs far past the kzalloc'd buffer. A malicious or malfunctioning AP can make the frame short during the external SAE auth exchange, so this is a remotely triggered heap overflow.

Reject frames shorter than the management header offset before the copy.

GHSA-chrv-c8hf-p9c7

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted:

u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data); ... memcpy(&mgmt_frame->u, frame, mgmt_frame_len - offsetof(struct ieee80211_mgmt, u));

Reject frames shorter than the management header offset before the copy.

RHSA-2026:68570 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update

kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow kernel: xfrm: hold dev ref until after transport_finish NF_HOOK kernel: RDMA/rxe: Fix race condition in QP timer handlers kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN kernel: ALSA: timer: Fix UAF at snd_timer_user_params() kernel: ALSA: timer: Forcibly close timer instances at closing kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() kernel: xfrm: input: hold netns during deferred transport reinjection kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() kernel: ALSA: seq: Serialize UMP output teardown with event_input kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() kernel: wifi: iwlwifi: mld: stop TX during firmware restart kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap kernel: Linux k…

RLSA-2026:68570 — Important: kernel security, bug fix, and enhancement update

Affected: Rocky Linux:9: kernel

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)

* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

* kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)

* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

* kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)

* kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)

* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

* kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)

* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

* kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)

* kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)

* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919…

UBUNTU-CVE-2026-72003

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 120 more

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data); ... memcpy(&mgmt_frame->u, frame, mgmt_frame_len - offsetof(struct ieee80211_mgmt, u)); The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When mgmt_frame_len is below that, the subtraction wraps as an unsigned value to a huge length. The memcpy then runs far past the kzalloc'd buffer. A malicious or malfunctioning AP can make the frame short during the external SAE auth exchange, so this is a remotely triggered heap overflow. Reject frames shorter than the management header offset before the copy.

WID-SEC-W-2026-2852 — Linux Kernel: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um root Rechte zu erlangen, um einen Denial of Service herbeizuführen oder einen nicht näher spezifizierten Angriff durchzuführen.