Most recent entries from all

bdu:2026-13889

BELL-CVE-2026-46319

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

certfr-2026-avi-0783 — De multiples vulnérabilités ont été découvertes dans Microsoft Azure. Elles permettent à un attaquant de provoquer une…

certfr-2026-avi-0783

EUVD-2026-348073

fkie_cve-2026-46319

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: Only release RCU read lock after ct_ft

When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read critical section before returning ct_ft. The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero() is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft object. This vulnerability can lead to privilege escalation.

Analysis from zdi-disclosures@trendmicro.com: When initializing act_ct, tcf_ct_init() is called, which internally triggers tcf_ct_flow_table_get().

static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)

{ struct zones_ht_key key = { .net = net, .zone = params->zone }; struct tcf_ct_flow_table *ct_ft; int err = -ENOMEM;

mutex_lock(&zones_mutex); ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params); // [1] if (ct_ft && refcount_inc_not_zero(&ct_ft->ref)) // [2] goto out_unlock; ... }

static __always_inline void *rhashtable_lookup_fast( struct rhashtable *ht, const void *key, const struct rhashtable_params params) { void *obj;

rcu_read_lock(); obj = rhashtable_lookup(ht, key, params); rcu_re…

GHSA-q9hw-vhj5-hw57

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: Only release RCU read lock after ct_ft

Analysis from zdi-disclosures@trendmicro.com: When initializing act_ct, tcf_ct_init() is called, which internally triggers tcf_ct_flow_table_get().

static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)

{ struct zones_ht_key key = { .net = net, .zone = params->zone }; struct tcf_ct_flow_table *ct_ft; int err = -ENOMEM;

mutex_lock(&zones_mutex); ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params); // [1] if (ct_ft && refcount_inc_not_zero(&ct_ft->ref)) // [2] goto out_unlock; ... }

static __always_inline void *rhashtable_lookup_fast( struct rhashtable *ht, const void *key, const struct rhashtable_params params) { void *obj;

rcu_read_lock(); obj = rhashtable_lookup(ht, key, params); rcu_re…

msrc_CVE-2026-46319 — net/sched: act_ct: Only release RCU read lock after ct_ft

msrc_CVE-2026-46319

openSUSE-SU-2026:11014-1 — kernel-devel-7.0.12-1.1 on GA media

kernel-devel-7.0.12-1.1 on GA media

RHSA-2026:75746 — Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

kernel: nvme-pci: fix mempool alloc size kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition kernel: gfs2: Fix unlikely race in gdlm_put_lock kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send kernel: gfs2: Fix slab-use-after-free in qd_put kernel: net/sched: act_ct: Only release RCU read lock after ct_ft kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 kernel: gfs2: add some missing log locking kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list kernel: ipvs: clear the svc scheduler ptr early on edit kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_…

RLSA-2026:75746 — Important: kernel-rt security, bug fix, and enhancement update

Affected: Rocky Linux:8: kernel-rt

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

* kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

* kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)

* kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

* kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

* kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

* kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

* kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

* kernel: gfs2: add some missing log locking (CVE-2026-53049)

* kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

* kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

* kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

* kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

* kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

* kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

* kernel: tunnels: l…

SUSE-SU-2026:22521-1 — Security update for the Linux Kernel

Security update for the Linux Kernel

UBUNTU-CVE-2026-46319

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 201 more

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read critical section before returning ct_ft. The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero() is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft object. This vulnerability can lead to privilege escalation. Analysis from zdi-disclosures@trendmicro.com: When initializing act_ct, tcf_ct_init() is called, which internally triggers tcf_ct_flow_table_get(). static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params) { struct zones_ht_key key = { .net = net, .zone = params->zone }; struct tcf_ct_flow_table *ct_ft; int err = -ENOMEM; mutex_lock(&zones_mutex); ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params); // [1] if (ct_ft && refcount_inc_not_zero(&ct_ft->ref)) // [2] goto out_unlock; ... } static __always_inline void *rhashtable_lookup_fast( struct rhashtable *ht, const void *key, const struct rhashtable_params params) { void *obj; rcu_read_lock(); obj = rhashtable_lookup(ht, key, params); rcu_read_unloc…

WID-SEC-W-2026-1870 — Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service

Eiin Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder andere, nicht näher bezeichnete Angriffe durchzuführen.