Threats Tagged 'cve-2026-68166'

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002) * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952) * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888) * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887) * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382) * kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564) * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166) Bug Fix(es) and Enhancement(s): * [HPEMC RHEL 10.1 BUG] mm/memory-failure: fix redundant updates for already poisoned pages. [rhel-10.0.z] (JIRA:RHEL-147239) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064) * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147) * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970) * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185) * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073) * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800) * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397) * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808) * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399) * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392) * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824) * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002) * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018) * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887) * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387) * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268) * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298) * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490) * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480) * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166) * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145) * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) Bug Fix(es) and Enhancement(s): * [RHEL 9] TPM becomes completely unresponsive and requires a full reboot to clear [rhel-9.8.z] (JIRA:RHEL-213940) * RT scheduler livelock caused by missing backport of 94894c9c477e [rhel-9.8.z] (JIRA:RHEL-240634) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834) * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003) * kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454) * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450) * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970) * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120) * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053) * kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189) * kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153) * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800) * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397) * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399) * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392) * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391) * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018) * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136) * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189) * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298) * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490) * kernel: mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418) * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384) * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277) * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276) * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480) * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086) * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166) * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) Bug Fix(es) and Enhancement(s): * RHEL 10: s390: Revert support for DCACHE_WORD_ACCESS [rhel-10.2.z] (JIRA:RHEL-188180) * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-10.2.z] (JIRA:RHEL-193043) * ss core dumped when there is an SCTP session [rhel-10.2.z] (JIRA:RHEL-212393) * [RHEL-10.2.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:RHEL-218627) * RHEL10.0 - s390/pfault: Fix virtual vs physical address confusion [rhel-10.2.z] (JIRA:RHEL-222507) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with chosen return addresses via UFFDIO_COPY. Update vma_can_userfault() to reject VM_SHADOW_STACK. While on it, also reject VM_SPECIAL so that if a driver would implement vm_uffd_ops, it wouldn't be possible to register special VMAs with userfaultfd. Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude hugetlb VMAs from the check for VM_SPECIAL.