Threats Tagged 'cve-2026-31419'

This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel live patch module for kernel version 5.14.0-570.17.1.el9_6. The update fixes a privilege escalation or denial of service issue in the KVM component due to improper shadow page table entry handling (CVE-2026-23401), a heap overflow in the NFSv4.0 LOCK replay cache (CVE-2026-31402), and a use-after-free vulnerability in the bonding driver that can lead to denial of service (CVE-2026-31419). The advisory targets Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. A security update is available to address these issues.

This security advisory from Red Hat addresses multiple vulnerabilities in the Linux kernel live patch module for kernel version 4.18.0-553.53.1.el8_10. The issues include a privilege escalation or denial of service vulnerability in the KVM due to improper shadow page table entry handling (CVE-2026-23401), a heap overflow in the NFSv4.0 LOCK replay cache (CVE-2026-31402), and a use-after-free vulnerability in the bonding driver causing denial of service (CVE-2026-31419). These vulnerabilities have been rated with an overall security impact of Important by Red Hat. Updates are available as kpatch live patch modules to address these issues. The advisory provides detailed package updates and references for remediation.

This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel 5.14.0-427.68.2.el9_4 via kpatch live patch modules. The fixed issues include a privilege escalation or denial of service in KVM due to improper shadow page table entry handling (CVE-2026-23401), a heap overflow in the NFSv4.0 LOCK replay cache (CVE-2026-31402), and a use-after-free vulnerability in the bonding driver causing denial of service (CVE-2026-31419). These vulnerabilities affect Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related variants. Red Hat has released updated kpatch modules to remediate these issues. Users should apply these official patches to mitigate the risks. No known exploits in the wild have been reported at this time.

This advisory addresses multiple security vulnerabilities in the Linux kernel targeted by the kpatch live patch module for kernel-4.18.0-477.97.1.el8_8 on Red Hat Enterprise Linux 8.8. The vulnerabilities include privilege escalation or denial of service in the KVM due to improper shadow page table entry handling (CVE-2026-23401), a heap overflow in the NFSv4.0 LOCK replay cache (CVE-2026-31402), and a use-after-free in the bonding driver causing denial of service (CVE-2026-31419). These issues are rated as important by Red Hat and have corresponding patches available via kpatch modules. The advisory provides instructions for applying these updates to affected systems.

This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel 5.14.0-284.117.1.el9_2 via live patch modules for kpatch. The issues include a privilege escalation or denial of service vulnerability in the KVM due to improper shadow page table entry handling (CVE-2026-23401), a heap overflow in the NFSv4.0 LOCK replay cache (CVE-2026-31402), and a use-after-free in the bonding driver causing denial of service (CVE-2026-31419). These vulnerabilities affect Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and Extended Life Cycle versions. The advisory provides updated kpatch modules to remediate these issues. No CVSS scores are provided, but the severity is rated as important/high by Red Hat.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056) * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) Bug Fix(es) and Enhancement(s): * RHEL8 RT kernel panic in replenish_dl_entity() caused by stale DEADLINE PI state during rt_mutex de-boosting (JIRA:RHEL-178520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216) * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056) * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) * kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852) * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467) * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366) * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete (CVE-2026-43322) * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.