Threats Tagged 'cve-2026-64563'

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004) * kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442) * kernel: udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503) * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339) * kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015) * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266) * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306) * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933) * kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075) * kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CVE-2026-53277) * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228) * kernel: net: add pskb_may_pull() to skb_gro_receive_list() (CVE-2026-53235) * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223) * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275) * kernel: ipv6: anycast: insert aca into global hash under idev->lock (CVE-2026-53259) * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002) * kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993) * kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (CVE-2026-64265) * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319) * kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287) * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563) * kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597) Bug Fix(es) and Enhancement(s): * Customer needs "netfilter: nfnetlink_queue: optimize verdict lookup with hash table" patch [RHEL 10.2] (JIRA:RHEL-132852) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493) * kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002) * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007) * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563) * kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343) * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129) * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.

In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p on table restart rhashtable_walk_start_check() has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-validates iter->p against the table and sets iter->p = NULL if the object is gone. When iter->walker.tbl is NULL (table was freed during resize), it resets slot and skip but forgets to clear iter->p. rhashtable_walk_next() then dereferences the stale iter->p, reading freed memory. This is a use-after-free. Any caller that does multi-fragment rhashtable walks across walk_stop/walk_start boundaries is affected. Concrete cases include netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC (tipc_nl_sk_walk in net/tipc/socket.c). Crash stack (netlink_diag): BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0 Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080) Call Trace: rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016) __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122) netlink_diag_dump+0xc2/0x240 netlink_dump+0x5bc/0x1270 netlink_recvmsg+0x7a3/0x980 sock_recvmsg+0x1bc/0x200 __sys_recvfrom+0x1d4/0x2c0