Threats Tagged 'cve-2026-74582'

A use-after-free vulnerability in the Linux kernel's vsock/vmci subsystem was fixed by Red Hat. The flaw occurs during a peer reset connection in the handshake phase, causing improper socket cleanup and leading to a use-after-free condition detected by KASAN. This vulnerability has high severity and affects multiple Linux kernel versions prior to specific 5.15.x updates. Official kernel updates have been released to address this issue. Users should apply these updates and reboot to mitigate the vulnerability.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) * kernel: packet: use consistent hard_header_len in non-ring send paths () Bug Fix(es) and Enhancement(s): * RT scheduler livelock caused by missing backport of 94894c9c477e (JIRA:RHEL-244407) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523) * kernel: packet: use consistent hard_header_len in non-ring send paths () For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: packet: use consistent hard_header_len in non-ring send paths () For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fanotify: fix false positive on permission events (CVE-2026-46150) * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120) * kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361) * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002) * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) * kernel: packet: use consistent hard_header_len in non-ring send paths () * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581) Bug Fix(es) and Enhancement(s): * [kABI] protect struct alt_instr [rhel-10.0] (JIRA:RHEL-122758) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: packet: use consistent hard_header_len in non-ring send paths () * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring metadata region, and iotlb_access_ok() returns early on a cache hit, taking the hit as proof that the region has already been validated: if (vhost_vq_meta_fetch(vq, addr, len, type)) return true; The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on device IOTLB (re)initialisation and on vq reset, but not when VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when VHOST_SET_VRING_NUM changes the region sizes. With a device IOTLB attached both ioctls are accepted while the vq is live, and neither validates the addresses at ioctl time: vq_access_ok() and vq_log_used_access_ok() return true early because the addresses are GIOVAs, deferring validation to prefetch time. Once the cache has been populated that deferred validation no longer runs -- vq_meta_prefetch() hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps translating through the old mapping as map->addr + addr - map->start for an address the mapping no longer covers. vhost_copy_to_user() and vhost_copy_from_user() consume the result with __copy_to_user() and __copy_from_user(), which do not check it either, so a subsequent used ring update or descriptor fetch accesses memory outside the region the IOTLB actually maps. Reset the metadata cache whenever the vring is reconfigured, so the new addresses are pushed back through iotlb_access_ok()'s slow path.

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.35.1 fixes various security issues The following security issues were fixed: - CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893). - CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723). - CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698). - CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662). - CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023). - CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).