Threats Tagged 'cve-2026-53071'

This Red Hat Security Advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages, including the Real Time Linux Kernel (kernel-rt) for Red Hat Enterprise Linux 8. The update fixes several security issues such as user-triggerable warnings, double-free errors, use-after-free vulnerabilities, and arbitrary code execution via userfaultfd shadow stack manipulation. The advisory includes fixes for CVE-2026-46117 and others, impacting kernel components like RDMA/mana, netfilter, ice, zram, memfd, scsi target iscsi, smb client, sctp, and the Linux kernel core. The update requires a system reboot to take effect.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) * kernel: packet: use consistent hard_header_len in non-ring send paths () Bug Fix(es) and Enhancement(s): * RT scheduler livelock caused by missing backport of 94894c9c477e (JIRA:RHEL-244407) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523) * kernel: packet: use consistent hard_header_len in non-ring send paths () For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113) * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110) * kernel: Linux kernel: xfrm single-frag length not properly limited () * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: fanotify: fix false positive on permission events (CVE-2026-46150) * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) * kernel: can: bcm: thrtimer use-after-free during RX operation teardown () Bug Fix(es) and Enhancement(s): * [RHEL9] tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [rhel-9.8.z] (JIRA:RHEL-183980) * [RHEL-9.8.z]: mlx5: include bug fixes (JIRA:RHEL-188121) * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [rhel-9.8.z] (JIRA:RHEL-212061) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113) * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110) * kernel: Linux kernel: xfrm single-frag length not properly limited () * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: fanotify: fix false positive on permission events (CVE-2026-46150) * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) * kernel: can: bcm: thrtimer use-after-free during RX operation teardown () Bug Fix(es) and Enhancement(s): * [RHEL9] tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [rhel-9.8.z] (JIRA:RHEL-183980) * [RHEL-9.8.z]: mlx5: include bug fixes (JIRA:RHEL-188121) * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [rhel-9.8.z] (JIRA:RHEL-212061) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This advisory addresses security vulnerabilities and bug fixes in the Linux kernel packages for Red Hat Enterprise Linux 8. Two security issues are fixed: a user-triggerable WARN_ON() in the RDMA mana driver (CVE-2026-46117) and a missing channel lock in the Bluetooth l2cap component (CVE-2026-53071). The update also resolves a kernel deadlock issue related to lock order. The update is rated as important by Red Hat Product Security and requires a system reboot to take effect.

Multiple security vulnerabilities affecting the SUSE Linux Enterprise 15 SP4 RT kernel were addressed in a security update. The update fixes a range of issues including Bluetooth event handling, IPv6 ICMP error processing, use-after-free conditions, stale data exposure, buffer overflows, locking issues, and memory management bugs. These vulnerabilities impact kernel components such as Bluetooth, networking, crypto, KVM virtualization, and filesystem handling. The update mitigates these issues to improve system stability and security.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().