Most recent entries from all

ALSA-2026:71233 — Important: kernel security, bug fix, and enhancement update

Affected: AlmaLinux:10: kernel-64k-debug-devel, AlmaLinux:10: kernel-64k-debug-devel-matched, AlmaLinux:10: kernel-64k-devel, AlmaLinux:10: kernel-64k-devel-matched, AlmaLinux:10: kernel-debug-devel, AlmaLinux:10: kernel-debug-devel-matched, AlmaLinux:10: kernel-devel, AlmaLinux:10: kernel-devel-matched, AlmaLinux:10: kernel-doc, AlmaLinux:10: kernel-headers and 4 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007) * kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266) * kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831) * kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802) * kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053) * kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383) * kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564) * kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201) * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243) * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569) * kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844) * kernel: net: tun: bound receive headroom (CVE-2026-81000) * kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)

Bug Fix(es) and Enhancement(s):

* kernel module .ko ELF files with non-zero sh_addr section addresses [almalinux-10.2.z] (JIRA:AlmaLinux-159298) * sctp: prevent peer transport count overflow [almalinux-10.2.z] (JIRA:Alm…

BELL-CVE-2026-74569

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

certfr-2026-avi-1090 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provo…

certfr-2026-avi-1090

EUVD-2026-356430

fkie_cve-2026-74569

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16_MAX while the packet stays under the 65535 enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobytes. diff then wraps, and "datalen = datalen + diff - msglen" yields a huge unsigned datalen, so the next iteration's ct_sip_get_header() reads past the linearized skb tail.

Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the 65535 byte packet limit, and the seqadj core is already s32 (nf_ct_seqadj_set() takes s32), so no previously accepted input is rejected.

BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25 ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694) nf_confirm (net/netfilter/nf_conntrack_proto.c:183) nf_hook_slow (net/netfilter/core.c:619) ip6_output (net/ipv6/ip6_output.c:246) ip6_forward (net/ipv6/ip6_output.c:690) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6212) process_backlog (net/core/dev.c:6676) __napi_poll (net/core/dev.c:7735) net_rx…

GHSA-jjgj-x6vq-56wx

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

msrc_CVE-2026-74569 — netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

msrc_CVE-2026-74569

RHSA-2026:71233 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update

kernel: block: zero non-PI portion of auto integrity buffer kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() kernel: mac802154: llsec: add skb_cow_data() before in-place crypto kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() kernel: smb: client: fix double-free in SMB2_flush() replay kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing kernel: ALSA: timer: drain a slave's callback before its master detaches it kernel: selinux: check connect-related permissions on TCP Fast Open kernel: sctp: prevent peer transport count overflow kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() kernel: xfrm: ah6: validate routing header segments_left kernel: net: tun: bound receive headroom kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read

RHSA-2026:75747 — security update for kernel

security update for kernel

RLSA-2026:75746 — Important: kernel-rt security, bug fix, and enhancement update

Affected: Rocky Linux:8: kernel-rt

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

* kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

* kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)

* kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

* kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

* kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

* kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

* kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

* kernel: gfs2: add some missing log locking (CVE-2026-53049)

* kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

* kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

* kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

* kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

* kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

* kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

* kernel: tunnels: l…

UBUNTU-CVE-2026-74569

Affected: Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 247 more

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16_MAX while the packet stays under the 65535 enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobytes. diff then wraps, and "datalen = datalen + diff - msglen" yields a huge unsigned datalen, so the next iteration's ct_sip_get_header() reads past the linearized skb tail. Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the 65535 byte packet limit, and the seqadj core is already s32 (nf_ct_seqadj_set() takes s32), so no previously accepted input is rejected. BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25 ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694) nf_confirm (net/netfilter/nf_conntrack_proto.c:183) nf_hook_slow (net/netfilter/core.c:619) ip6_output (net/ipv6/ip6_output.c:246) ip6_forward (net/ipv6/ip6_output.c:690) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6212) process_backlog (net/core/dev.c:6676) __napi_poll (net/core/dev.c:7735) net_rx_act…

WID-SEC-W-2026-2852 — Linux Kernel: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um root Rechte zu erlangen, um einen Denial of Service herbeizuführen oder einen nicht näher spezifizierten Angriff durchzuführen.