Threats Tagged 'cve-2026-63802'

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: xfrm single-frag length not properly limited () * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.44 fixes various security issues: The following security issues were fixed: - CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370). - CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283). - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391). - CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837). - CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015). - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012). - CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011). - CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003). - CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679). - CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (bsc#1273051). - CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052). - CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493). - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833). - CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837). - CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208). - CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228). - CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162). - CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409). - CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.36.1 fixes various security issues: The following security issues were fixed: - CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283). - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391). - CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837). - CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015). - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012). - CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011). - CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679). - CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (bsc#1273051). - CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052). - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833). - CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837). - CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208). - CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228). - CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162). - CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299). - CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409). - CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007) * kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266) * kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831) * kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802) * kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053) * kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383) * kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564) * kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201) * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243) * kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569) * kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844) * kernel: net: tun: bound receive headroom (CVE-2026-81000) * kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846) Bug Fix(es) and Enhancement(s): * kernel module .ko ELF files with non-zero sh_addr section addresses [rhel-10.2.z] (JIRA:RHEL-159298) * sctp: prevent peer transport count overflow [rhel-10.2.z] (JIRA:RHEL-216247) * [RHEL 10] bnxt_en: RX queue restart failed: err=-95 [rhel-10.2.z] (JIRA:RHEL-247283) * RHIVOS - S32G: backport missing fixes to 10.2 (JIRA:RHEL-259788) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat has issued an important security advisory for the Linux kernel packages in Red Hat Enterprise Linux 8, addressing multiple vulnerabilities including integer overflow, use-after-free, buffer overflow, and other flaws across various kernel components such as EDAC/bluefield, Wi-Fi drivers, KVM, net, blk-cgroup, scsi, and dm-verity. These vulnerabilities could lead to system crashes or other security impacts. The update requires a system reboot to take effect.

Red Hat has released an important security update for the kernel-rt packages, which provide the Real Time Linux Kernel for systems requiring high determinism. This update addresses multiple vulnerabilities including integer overflow, use-after-free, buffer overflow, and improper handling of network frames across various kernel components such as EDAC/bluefield, wifi mac80211, KVM, net qrtr, blk-cgroup, scsi, dm-verity, and others. The update is applicable to Red Hat Enterprise Linux 8 Real Time and related variants. A system reboot is required after applying the update to ensure the fixes take effect.

These are all security issues fixed in the kernel-devel-7.1.4-1.1 package on the GA media of openSUSE Tumbleweed.

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries. Move the flush from __blkg_release() (RCU callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent flush's rcu_read_lock() section to complete before freeing.