Threats Tagged 'cve-2026-63987'

A security update for the SUSE Linux Enterprise 15 SP7 RT kernel addresses multiple security vulnerabilities across various kernel components, including hardware monitoring, Bluetooth, SCSI, networking, tracing, and more. These fixes resolve issues such as null pointer dereferences, memory leaks, use-after-free, out-of-bounds reads/writes, race conditions, and other kernel-level bugs. The update mitigates a broad range of potential security risks by correcting these defects.

A vulnerability in the Linux kernel's ethtool coalesce feature was resolved, where the function ethnl_update_profile() improperly bounds an index when processing user-controlled Netlink nested attributes. This could lead to out-of-bounds writes due to lack of constraints on the number of nested entries. The issue affects multiple specific Linux kernel versions and has a CVSS score of 7.8. A patch is available from the vendor.

In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES ethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION nest list with an index 'i' and writes new_profile[i++] without bounding i. The destination is kmemdup()'d at NET_DIM_PARAMS_NUM_PROFILES entries (5), but the Netlink nest count is entirely user-controlled. Netlink policies do not have support for constraining the number of nested entries (or number of multi-attr entries).