Threats Tagged 'cve-2026-31504'

This security update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.52 addresses multiple vulnerabilities including a heap overflow in the NFSv4.0 LOCK replay cache, use-after-free in network packet handling, rejection of oversized directory entries in fuse, and other kernel networking and filesystem issues. These fixes resolve high-severity security problems that could impact system stability and security.

This security update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.121 addresses multiple vulnerabilities including heap overflow, use-after-free, and improper handling of oversized directory entries. The update fixes five distinct security issues affecting kernel components such as NFSv4.0, network packet handling, FUSE filesystem, and generic receive offload (GRO). These vulnerabilities are rated high severity and have been resolved by the SUSE Product Security Team in this patch.

This security update for the SUSE Linux Enterprise Kernel 4.12.14-122.299 addresses multiple vulnerabilities including a heap overflow in the NFSv4.0 LOCK replay cache, a use-after-free in network packet handling, fixes related to dirty.frag, and an issue in generic receive offload (GRO) merging. These vulnerabilities were fixed in this update to improve kernel security.

In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registration is not cleaned up by `fanout_release()`, leaving a dangling pointer in the fanout array. `packet_release()` does NOT zero `po->num` in its `bind_lock` section. After releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex` still matches the bound device. A concurrent `packet_notifier(NETDEV_UP)` that already found the socket in `sklist` can re-register the hook. For fanout sockets, this re-registration calls `__fanout_link(sk, po)` which adds the socket back into `f->arr[]` and increments `f->num_members`, but does NOT increment `f->sk_ref`. The fix sets `po->num` to zero in `packet_release` while `bind_lock` is held to prevent NETDEV_UP from linking, preventing the race window. This bug was found following an additional audit with Claude Code based on CVE-2025-38617.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle