A vulnerability in the Linux kernel's exFAT filesystem driver caused an integer overflow leading to an infinite loop when handling a damaged volume with a zero-sized upcase table. The issue occurs if the upcase table size is zero due to corrupted media or device malfunction. The fix involves not attempting to load a zero-sized upcase table and instead falling back to a default table or marking the volume read-only if no valid table is found.
A vulnerability in the Linux kernel's netfilter nfnetlink_log component was resolved. The issue involved freeing per-network namespace state without waiting for an RCU grace period, potentially causing use-after-free conditions during concurrent packet processing. The fix ensures the pointer is cleared only after RCU readers have completed, preventing unsafe memory access.
A vulnerability in the Linux kernel's wifi libipw component was resolved that involved improper boundary checks when reading the WEP key index from network packet data. The function libipw_rx() previously checked for skb->len >= hdrlen + 3 before reading skb->data[hdrlen + 3], which did not sufficiently ensure the byte was within bounds. The fix requires hdrlen + 4 bytes before accessing that byte, preventing a potential out-of-bounds read. This is a local source-boundary check and does not affect key index semantics.
A vulnerability in the Linux kernel's wifi cfg80211 subsystem was resolved that involved improper validation of management frame lengths before processing. Specifically, certain management frames shorter than expected for their subtype could cause out-of-bounds reads when accessing fixed fields, such as the reason code in deauthentication frames. The fix added precise length checks per subtype and removed a misleading warning, ensuring malformed frames are dropped silently. This vulnerability affects specific Linux kernel versions listed and has a medium severity rating.
A vulnerability in the Linux kernel's cachefiles subsystem was fixed to address a double fput() call in error handling within cachefiles_create_tmpfile(). This flaw could lead to serious impacts on confidentiality, integrity, and availability. The issue affects specific Linux kernel versions listed and has a CVSS 3.1 score of 7.0, indicating a medium severity level.
A vulnerability in the Linux kernel's stmmac xgmac2 network driver caused an interrupt storm due to enabling the RX Buffer Unavailable (RBUE) interrupt by default. This interrupt storm occurs under heavy receive (RX) pressure when the DMA runs out of RX descriptors, firing RBUE continuously without forward progress, leading to degraded system performance. The issue was resolved by disabling RBUE in the default RX interrupt mask, preventing the interrupt storm while maintaining normal RX handling. This fix trades the storm for a clean stall with the same RX outcome. The vulnerability affects specific Linux kernel versions listed and has a CVSS score of 7.5, indicating medium severity with high impact on availability.
A vulnerability in the Linux kernel's ath11k Wi-Fi driver allows invalid data access and potential memory corruption due to packets exceeding the maximum native Wi-Fi header length. This occurs in the ath11k_dp_rx_h_undecap_nwifi() function when processing certain packet types. A fix has been implemented by adding a sanity check before processing to prevent this invalid access.
A vulnerability in the Linux kernel's ACPICA component related to validating handler object types in two functions has been resolved. The issue affected specific Linux kernel versions and could impact confidentiality, integrity, and availability. The vulnerability has a CVSS score of 8.4, indicating high severity. No known exploits in the wild have been reported. The affected versions are specific kernel builds around versions 3.11 to 3.13.
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: pcie: null RX pointers after free
When iwl_pcie_tx_init() fails after RX init, nic init unwinds via
iwl_pcie_rx_free().
The freed RX members stayed non-NULL on the live transport object,
so later teardown or retry could touch stale RX state.
Set rx_pool, global_table, rxq, and alloc_page to NULL after free
to make repeated cleanup and retry paths safe.
A use-after-free vulnerability was fixed in the Linux kernel's octeon staging driver. The issue involved missing disabling of the NAPI instance before freeing interrupts, which could lead to the active poll function accessing freed memory and causing a crash.
A vulnerability in the Linux kernel's ath11k wireless driver caused frames with out-of-range MCS values to be dropped due to invalid rate metadata. This was fixed by capping the MCS value to the maximum supported and properly setting encoding metadata, allowing valid frames to be processed instead of discarded.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007)
* kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266)
* kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)
* kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
* kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053)
* kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)
* kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)
* kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201)
* kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)
* kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
* kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)
* kernel: net: tun: bound receive headroom (CVE-2026-81000)
* kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)
Bug Fix(es) and Enhancement(s):
* kernel module .ko ELF files with non-zero sh_addr section addresses [rhel-10.2.z] (JIRA:RHEL-159298)
* sctp: prevent peer transport count overflow [rhel-10.2.z] (JIRA:RHEL-216247)
* [RHEL 10] bnxt_en: RX queue restart failed: err=-95 [rhel-10.2.z] (JIRA:RHEL-247283)
* RHIVOS - S32G: backport missing fixes to 10.2 (JIRA:RHEL-259788)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A vulnerability in libical 4.0.6 involves an incompatible function pointer passed to bsearch() in the icalparameter_string_to_kind() function. This causes undefined behavior and process termination when parsing certain iCalendar data, resulting in a denial of service condition.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)
* kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)
* kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)
* kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
* kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
* kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
* kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157)
* kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)
* kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)
* kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)
* kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)
* kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)
* kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)
Bug Fix(es) and Enhancement(s):
* [Intel 9.8 FEAT] ice: Driver Update [rhel-9.8.z] (JIRA:RHEL-213003)
* RHEL 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-9.8.z] (JIRA:RHEL-254108)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Arc Search for Android versions prior to 1.12.10 do not show a fullscreen notification when a page enters fullscreen mode while the app runs in the background. This allows a remote attacker to craft websites that render fake UI elements, such as spoofed address bars, potentially misleading users about the content's origin and increasing phishing risk.
A vulnerability in Red Hat Ansible Automation Platform's automation-controller allows an authenticated administrator to exploit a Python format-string template used for logging API 4XX errors. This flaw permits reading sensitive application secrets such as the Django secret key and database password by crafting a malicious format string. The secrets can be exfiltrated via logs forwarded to external aggregators, potentially enabling offline decryption of stored credentials, session forgery, and direct database access.