Threats Tagged 'cve-2026-23191'

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are performed outside the cable lock, this may result in UAF when a program attempts to trigger frequently while opening/closing the tied stream, as spotted by fuzzers. For addressing the UAF, this patch changes two things: - It covers the most of code in loopback_check_format() with cable->lock spinlock, and add the proper NULL checks. This avoids already some racy accesses. - In addition, now we try to check the state of the capture PCM stream that may be stopped in this function, which was the major pain point leading to UAF.

This Red Hat security advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 9.6 Extended Update Support and related products. The update includes fixes for 18 CVEs affecting various kernel subsystems such as netfilter, ALSA, RDMA, TCP, SCTP, and others. The advisory rates the security impact as Important and covers issues like use-after-free, double free, race conditions, permission checking flaws, and validation errors. The update also includes bug fixes and enhancements unrelated to security. Systems must be rebooted after applying the update for changes to take effect.