Threats Tagged 'cve-2026-46145'

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Kernel: Privilege escalation via uninitialized data in vmci transport packet (CVE-2025-38403) * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) Bug Fix(es) and Enhancement(s): * smb: client: use actual path when queryfs (JIRA:RHEL-145425) * RT scheduler livelock caused by missing backport of 94894c9c477e [rhel-9.4.z] (JIRA:RHEL-244408) * kernel warning : kernel/softirq.c:306 do_softirq_post_smp_call_flush+0x29/0x60 when system is booted with nosmt [rhel-9.4.z] (JIRA:RHEL-80300) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149) * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) Bug Fix(es) and Enhancement(s): * Memory leak in metadata_dst leading to OOM [rhel-10.0.z] (JIRA:RHEL-125758) * Kernel panic in cached_dir_offload_close [rhel-10.0.z] (JIRA:RHEL-128580) * RHEL10.0 - s390/pci: Fix __pcilg_mio_inuser() inline assembly [rhel-10.0.z] (JIRA:RHEL-161485) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744) * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211) * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023) * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) * kernel: vhost: reset the vring metadata cache on vring reconfiguration (CVE-2026-74580) Bug Fix(es) and Enhancement(s): * [RHEL 9] Bonding reports unknown speed/duplex for tg3 interface [rhel-9.6.z] (JIRA:RHEL-182767) * [RHEL9] tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [rhel-9.6.z] (JIRA:RHEL-214435) * vhost: reset the vring metadata cache on vring reconfiguration [rhel-9.6.z] (JIRA:RHEL-224548) * [RHEL9] BUG: KASAN: global-out-of-bounds in scsi_sysfs_add_host+0x179/0x1b0 [rhel-9.6.z] (JIRA:RHEL-234440) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) Bug Fix(es) and Enhancement(s): * Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772) * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260) * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) Bug Fix(es) and Enhancement(s): * RHEL9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-9.8.z] (JIRA:RHEL-166048) * [RHEL 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs [rhel-9.8.z] (JIRA:RHEL-175699) * DPLL: Add support for pin operational state [rhel-9.8.z] (JIRA:RHEL-175820) * DPLL: Add support for fractional frequency offset between pin and device [rhel-9.8.z] (JIRA:RHEL-175823) * ibmveth Adapter Freeze with Small MSS [rhel-9.8.z] (JIRA:RHEL-178308) * RHEL9.4 - s390/mm: Add missing secure storage access fixups [rhel-9.8.z] (JIRA:RHEL-183317) * rbd: eliminate a race in lock_dwork draining on unmap [rhel-9.8.z] (JIRA:RHEL-183130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786) * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056) * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772) * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260) * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) Bug Fix(es) and Enhancement(s): * RHEL10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-10.2.z] (JIRA:RHEL-166047) * RHEL9.5 crash due to lpfc NULL ndlp->vport [rhel-10.2.z] (JIRA:RHEL-171774) * objtool static_call check blocks build of out-of-tree livepatch modules on RHEL 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:RHEL-178495) * ibmveth Adapter Freeze with Small MSS [rhel-10.2.z] (JIRA:RHEL-179723) * rbd: eliminate a race in lock_dwork draining on unmap [rhel-10.2.z] (JIRA:RHEL-183127) * RHEL10.0 - s390/mm: Add missing secure storage access fixups [rhel-10.2.z] (JIRA:RHEL-183319) * [RHEL10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:RHEL-182299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056) * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) Bug Fix(es) and Enhancement(s): * RHEL8 RT kernel panic in replenish_dl_entity() caused by stale DEADLINE PI state during rt_mutex de-boosting (JIRA:RHEL-178520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467) * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds check it so the memcpy cannot overflow.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle