Threats Tagged 'cve-2026-63944'

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.44 fixes various security issues: The following security issues were fixed: - CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370). - CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283). - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391). - CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837). - CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015). - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012). - CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011). - CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003). - CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679). - CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (bsc#1273051). - CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052). - CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493). - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833). - CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837). - CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208). - CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228). - CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162). - CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409). - CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.37.1 fixes various security issues: The following security issues were fixed: - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391). - CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015). - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012). - CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011). - CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052). - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833). - CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837). - CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228). - CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299). - CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409). - CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.36.1 fixes various security issues: The following security issues were fixed: - CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283). - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391). - CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837). - CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015). - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012). - CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011). - CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679). - CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (bsc#1273051). - CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052). - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833). - CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837). - CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208). - CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228). - CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162). - CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299). - CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409). - CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This Red Hat security advisory addresses multiple vulnerabilities and bug fixes in the Linux kernel packages for Red Hat Enterprise Linux 8 and 9. It includes a denial of service vulnerability in the qla2xxx SCSI driver (CVE-2025-68745) and several other security issues affecting Bluetooth, DRM, SCTP, Wi-Fi, and other kernel subsystems. The update is rated as important by Red Hat and requires a system reboot to apply. The advisory also contains non-security bug fixes and enhancements.

This Red Hat security advisory addresses multiple vulnerabilities and bug fixes in the Linux kernel, including a denial of service vulnerability in the qla2xxx SCSI driver (CVE-2025-68745) and numerous other issues affecting various kernel subsystems such as Bluetooth, DRM, SCTP, Wi-Fi, and more. The advisory covers security fixes, bug fixes, and enhancements for Red Hat Enterprise Linux 9 and related components. A patch is available to remediate these issues.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133) * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339) * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493) * kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015) * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266) * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306) * kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330) * kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002) * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223) * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275) * kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366) * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563) * kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597) * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129) * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) Bug Fix(es) and Enhancement(s): * KSM to deduplicate only zero pages [rhel-9.8.z] (JIRA:RHEL-249161) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from an RCU-protected iteration over hdev->conn_hash.list and is not valid once these locks are dropped. A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL: hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL); While hci_conn_del() dequeues with data=conn: hci_cmd_sync_dequeue(hdev, NULL, conn, NULL); Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never matches, and the pending work item is not cancelled. Fix this by saving conn->conn_timeout into a local variable while the locks are still held, so the stale conn pointer is never dereferenced after unlock. This is the same class of bug as the one fixed by commit 035c25007c9e ("Bluetooth: hci_sync: Fix UAF on le_read_features_complete") which addressed the identical pattern in a different function. This vulnerability was identified using 0sec.ai, an open-source automated security auditing platform (https://github.com/0sec-labs).

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from an RCU-protected iteration over hdev->conn_hash.list and is not valid once these locks are dropped. A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL: hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL); While hci_conn_del() dequeues with data=conn: hci_cmd_sync_dequeue(hdev, NULL, conn, NULL); Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never matches, and the pending work item is not cancelled. Fix this by saving conn->conn_timeout into a local variable while the locks are still held, so the stale conn pointer is never dereferenced after unlock. This is the same class of bug as the one fixed by commit 035c25007c9e ("Bluetooth: hci_sync: Fix UAF on le_read_features_complete") which addressed the identical pattern in a different function. This vulnerability was identified using 0sec.ai, an open-source automated security auditing platform (https://github.com/0sec-labs).