Threats Tagged 'cve-2026-64034'

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099) Bug Fix(es) and Enhancement(s): * gve: backport large queue depth patches [rhel-10.2.z] (JIRA:RHEL-219261) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security vulnerabilities affecting the Linux kernel have been addressed in a security update. These include fixes for use-after-free, out-of-bounds reads, integer overflows, memory corruption, denial of service, and buffer overflow issues across various kernel subsystems such as fbcon, smb, drm/amdgpu, netfilter, accel/ivpu, and others. The update is applicable to SUSE and Red Hat Enterprise Linux distributions. The vendor has released official patches to remediate these vulnerabilities.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323) * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942) * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199) * kernel: arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875) * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556) * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159) * kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156) * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155) * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273) * kernel: perf: Reject exited events as group leaders (CVE-2026-74753) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic. DMA-coherent memory is mapped uncacheable on x86 and is shared, unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes directly to host-visible memory. A H/W can modify the value between the check and the use, bypassing the bounds validation. Fix this by reading hwc_msg_id exactly once using READ_ONCE() into a stack-local variable in mana_hwc_rx_event_handler(), and passing the validated value as a parameter to mana_hwc_handle_resp().