Threats Tagged 'cve-2026-52924'

This security update provides a functional equivalent of RHSA-2026:45114. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:45114.

A buffer overflow vulnerability was identified and fixed in the Linux kernel ALSA firewire-motu driver affecting the hwdep_read() function for DSP events. The flaw allowed more bytes to be written to a user buffer than requested if the buffer was smaller than the event header size. Red Hat released a security update for Red Hat Enterprise Linux 8.6 and related variants to address this issue. The update clamps the copy size to the user-requested length, preventing the overflow. This fix is part of a broader kernel security update that addresses multiple vulnerabilities. The system must be rebooted after applying the update for the fix to take effect.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149) * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) Bug Fix(es) and Enhancement(s): * Memory leak in metadata_dst leading to OOM [rhel-10.0.z] (JIRA:RHEL-125758) * Kernel panic in cached_dir_offload_close [rhel-10.0.z] (JIRA:RHEL-128580) * RHEL10.0 - s390/pci: Fix __pcilg_mio_inuser() inline assembly [rhel-10.0.z] (JIRA:RHEL-161485) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211) * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003) * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131) * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189) * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277) * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276) * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581) Bug Fix(es) and Enhancement(s): * [RHEL-9.8.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:RHEL-166118) * ss core dumped when there is an SCTP session [rhel-9.8.z] (JIRA:RHEL-212398) * [IBM 9.9 FEAT] zcrypt driver overwrite function - kernel part [rhel-9.8.z] (JIRA:RHEL-245333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189) * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277) * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276) Bug Fix(es) and Enhancement(s): * ss core dumped when there is an SCTP session [rhel-8.10.z] (JIRA:RHEL-212400) * SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-8.10.z] (JIRA:RHEL-222800) * [RHEL-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:RHEL-178088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security vulnerabilities affecting the SUSE Linux Enterprise 15 SP4 RT kernel were addressed in a security update. The update fixes a range of issues including Bluetooth event handling, IPv6 ICMP error processing, use-after-free conditions, stale data exposure, buffer overflows, locking issues, and memory management bugs. These vulnerabilities impact kernel components such as Bluetooth, networking, crypto, KVM virtualization, and filesystem handling. The update mitigates these issues to improve system stability and security.