A vulnerability in the Linux kernel's BPF subsystem was fixed to address missing migration protection in the function __rhtab_map_lookup_and_delete_batch(). The issue involved improper handling of CPU migration during a delete loop, which could cause a kernel bug due to use of smp_processor_id() in preemptible code. The fix adds migrate_disable()/migrate_enable() calls to prevent task migration during this operation.
A vulnerability in the Linux kernel rust_binder component was fixed by ensuring deferred work items on a thread's todo list are properly canceled when the thread exits. Previously, these deferred work items were not cleaned up in the Thread::release() method if the thread died while having an active outgoing transaction.
A race condition vulnerability in the Linux kernel's KVM s390 architecture implementation was fixed by using READ_ONCE() in the _destroy_pages_crste() function to prevent multiple dereferences of a pointer. This fix addresses a concurrency issue that could potentially lead to unstable behavior in the kernel's memory management for this architecture.
A vulnerability in the Linux kernel's drm/virtio component caused an object leak in the virtio_gpu_resource_create_ioctl() function. The issue arises because drm_gem_object_release() is called incorrectly on an error path, preventing the proper freeing of resources. This leads to leaks of the virtio_gpu_object, its associated pages, scatter-gather table, resource ID, and host-side resource. The flaw has been fixed by replacing drm_gem_object_release() with drm_gem_object_put().
A vulnerability in the Linux kernel's drm/virtio component caused object leaks in the virtio_gpu_resource_create_blob_ioctl() function. The issue arises because drm_gem_object_release() was incorrectly called on error paths instead of dropping the reference, preventing proper resource freeing and causing leaks of virtio_gpu_object, resource IDs, and host-side resources. This flaw has been fixed by using drm_gem_object_put() to correctly release references.
A vulnerability in the Linux kernel's ovpn module involves unsafe in-place updates of the local endpoint bind structure, leading to potential torn reads of IPv6 addresses during concurrent updates. This issue has been resolved by replacing the bind structure when learning a new local endpoint, ensuring safe publication and synchronization.
A vulnerability in the Linux kernel's BPF verifier allowed unsafe passing of PTR_TO_PACKET pointers to mutating subprograms, risking invalid memory assumptions. This flaw was fixed by rejecting BPF code that passes PTR_TO_PACKET pointers to subprograms that may mutate packets, ensuring memory safety across subprogram boundaries.
A vulnerability in the Linux kernel's BPF sockmap implementation allows creation of sockmaps with max_entries greater than INT_MAX, leading to an integer overflow in sock_map_free(). This causes out-of-bounds memory writes during map destruction, potentially resulting in memory corruption or kernel crashes. The issue arises because sock_map_alloc() did not properly reject large max_entries values, allowing a signed integer iterator in sock_map_free() to overflow. The flaw has been fixed by rejecting max_entries values greater than INT_MAX at creation time.
A use-after-free vulnerability in the Linux kernel SCTP implementation was fixed by ensuring that the association or transport reference is held before rearming a timer in timer handlers. The flaw involved calling mod_timer() before taking the necessary reference without holding the socket lock, which could lead to a race condition causing a reference count underflow and potential kernel instability.
A vulnerability in the Linux kernel NFC LLCP implementation causes list corruption and reference count desynchronization in the nfc_llcp_recv_dm() function. This occurs when handling DM(NOBOUND)/DM(REJ) messages for sockets still linked on the connecting_sockets list, leading to improper socket unlinking and locking. An unprivileged local process can exploit this to leak kernel sockets indefinitely, resulting in memory exhaustion and denial of service.
A vulnerability in the Linux kernel affecting the Berkeley Packet Filter (BPF) on MIPS32 architecture was fixed. The issue involved incorrect instruction emission causing invalid comparison results when using immediate operands in certain jump instructions. This flaw was corrected by changing the instruction to use the proper immediate form. The vulnerability was identified through testing on MIPS32r1 emulated by QEMU.
A vulnerability in the Linux kernel's network subsystem (net: xps) allows an out-of-range traffic class to be used, leading to a heap out-of-bounds write. This occurs because the system does not properly reject traffic classes that exceed the configured number of traffic classes (dev->num_tc), causing an index overflow in the XPS map. The issue has been fixed in several Linux kernel commits.
A use-after-free (UAF) vulnerability was identified and fixed in the Linux kernel's net/smc component. The function smcr_port_err() traversed the smc_lgr_list.list without holding the necessary lock, allowing concurrent termination of list entries that could lead to dereferencing freed memory. The fix involves holding the smc_lgr_list.lock during traversal and adjusting smc_ib_gid_check() to call smcr_port_err() after releasing the lock.
A vulnerability in the Linux kernel autofs subsystem causes a file reference leak of sbi->pipe in the autofs_kill_sb() function. This occurs when autofs_fill_super() fails before clearing the AUTOFS_SBI_CATATONIC flag, leading to autofs_catatonic_mode() returning early without releasing the pipe file reference. The issue results in a permanent leak of the pipe struct file reference. The flaw has been fixed by explicitly releasing sbi->pipe if it remains non-NULL after autofs_catatonic_mode() is called.
A vulnerability in the Linux kernel's GPIO character device interface could leak kernel stack contents to user-space in an error path. This occurs when the GPIO chip guard acquisition fails, and the info struct passed to user-space is not properly zeroed, potentially exposing sensitive kernel memory data. The issue has been fixed by changing the function to return an error code and ensuring the info struct is zeroed before use.
A vulnerability in the Linux kernel related to sysctl was fixed by restoring a range check in the proc_dointvec_ms_jiffies_minmax function. The issue arose because a previous commit incorrectly removed this range check, potentially allowing improper values to be processed.
CVE-2026-93786 addresses a vulnerability in the Linux kernel's ksmbd component related to POSIX ACL mask handling. The issue involved improper mutation of the parent's ACL or overwriting of the child's VFS-computed access and default ACLs, which could widen effective permissions during SMB object creation. The fix preserves restrictive ACL_MASK entries to prevent unauthorized permission escalation.
Red Hat has issued a security advisory for Red Hat Enterprise Linux 9.6 Extended Update Support addressing four kernel vulnerabilities affecting netfilter nf_tables, blk-mq cached requests, slab zeroing behavior, and SCTP transport handling. The update also includes bug fixes and enhancements for Intel drivers. Systems must be rebooted after applying the update to activate the fixes. The advisory rates the security impact as Important. No CVSS score is provided and no known exploits are reported in the wild.
CVE-2026-90235 is a critical vulnerability in the Linux kernel's sunrpc xprtsock component. It involves improper handling of shared socket callback pointers without proper memory visibility guarantees, leading to potential use of stale callback pointers after restoration. This flaw affects the handling of AF_LOCAL, UDP, and TCP sockets during takeover and teardown, risking invocation of outdated callbacks. The issue has been fixed by annotating shared socket callbacks with READ_ONCE and WRITE_ONCE to ensure proper memory visibility and prevent stale pointer usage.
Red Hat has issued a security advisory for multiple vulnerabilities in the Linux kernel packages of Red Hat Enterprise Linux 10. These include out-of-bounds reads, buffer overflows, use-after-free conditions, denial of service, and privilege escalation issues. The update also contains bug fixes and enhancements. A system reboot is required after applying the update. Red Hat recommends prompt installation to mitigate potential risks.