Threats Tagged 'cve-2026-31669'

A use-after-free vulnerability in the Linux kernel's CAN ISO-TP implementation (isotp_sendmsg) was resolved. The issue occurs when tx.buf is freed prematurely during socket release while still potentially being accessed, leading to memory corruption. This vulnerability affects multiple Linux kernel versions prior to 6.8.0 and related distributions. It has a high severity with a CVSS score of 7.8. A patch is available and should be applied to prevent potential system compromise.

A high severity use-after-free vulnerability (CVE-2026-31669) in the Linux kernel's Multipath TCP (MPTCP) implementation was resolved. The flaw involves incorrect socket memory allocation for MPTCP IPv6 subflow child sockets due to improper slab cache initialization, leading to potential memory corruption. This vulnerability could allow an attacker to cause system compromise with high impact on confidentiality, integrity, and availability. Multiple Linux kernel subsystems were updated to fix this and related issues. Official patches are available and included in updated Linux kernel versions. Users should apply these updates and reboot to mitigate the risk.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984) * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This Red Hat security advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 9.6 Extended Update Support and related products. The update includes fixes for 18 CVEs affecting various kernel subsystems such as netfilter, ALSA, RDMA, TCP, SCTP, and others. The advisory rates the security impact as Important and covers issues like use-after-free, double free, race conditions, permission checking flaws, and validation errors. The update also includes bug fixes and enhancements unrelated to security. Systems must be rebooted after applying the update for changes to take effect.