Threats Tagged 'cve-2026-46155'

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560) Bug Fix(es) and Enhancement(s): * [HPEMC RHEL 9 BUG] tick/sched: Limit non-timkeeper CPUs calling jiffies upda [rhel-9.6.z] (JIRA:RHEL-141460) * ibmveth Adapter Freeze with Small MSS [rhel-9.6.z] (JIRA:RHEL-178307) * RT scheduler livelock caused by missing backport of 94894c9c477e [rhel-9.6.z] (JIRA:RHEL-244409) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149) * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) Bug Fix(es) and Enhancement(s): * Memory leak in metadata_dst leading to OOM [rhel-10.0.z] (JIRA:RHEL-125758) * Kernel panic in cached_dir_offload_close [rhel-10.0.z] (JIRA:RHEL-128580) * RHEL10.0 - s390/pci: Fix __pcilg_mio_inuser() inline assembly [rhel-10.0.z] (JIRA:RHEL-161485) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276) * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259) Bug Fix(es) and Enhancement(s): * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [rhel-10.2.z] (JIRA:RHEL-162140) * [RHEL 10] Bonding reports unknown speed/duplex for tg3 interface [rhel-10.2.z] (JIRA:RHEL-182770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the NVIDIA for RHEL 10 Release Notes linked from the References section.

A vulnerability in the Linux kernel's SMB client was fixed that could cause an out-of-bounds read in the smb2_compound_op() function. This occurs when a server sends a truncated response with a large OutputBufferLength but terminates the EA list early, leading to a memcpy operation that can read beyond allocated memory and potentially leak kernel heap data. The issue affects multiple versions of the linux-hwe-edge kernel prior to specific 7.0.0 series updates. A patch is available to address this vulnerability.