Threats Tagged 'ubuntu-16-04-lts'

In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race with concurrent readers that still observe vport->dev. Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let vport_netdev_free() drop the reference from the RCU callback, matching the non-tunnel destroy path and avoiding additional synchronization under RTNL.

A vulnerability in the Linux kernel's drm/xe/uapi subsystem was resolved by adding validation to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cached memory. This issue could allow a GPU to bypass CPU caches and read stale sensitive data directly from DRAM, potentially leaking data from previously freed pages of other processes. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-28.28 and related versions. A patch is available and should be applied to mitigate the risk.

This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-5.14.0-687.10.1.el9_8. Security Fix(es): * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933) * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability in the Linux kernel's thermal subsystem was fixed to address an error path in thermal zone device registration. The issue involved missing synchronization that could cause premature freeing of thermal zone device data if an error occurred during registration. This flaw could lead to system instability or crashes. The vulnerability is part of a broader set of Linux kernel security fixes addressing multiple subsystems and architectures. A patch is available and users are advised to update and reboot their systems. The update requires recompilation of third-party kernel modules due to an ABI change.

This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-5.14.0-284.134.1.el9_2. Security Fix(es): * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002) * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007) * kernel: vhost: reset the vring metadata cache on vring reconfiguration (CVE-2026-74580) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) Bug Fix(es) and Enhancement(s): * kernel: vhost: reset the vring metadata cache on vring reconfiguration [rhel-7.9.z] (JIRA:RHEL-224557) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

These are all security issues fixed in the expat-2.9.0-1.1 package on the GA media of openSUSE Tumbleweed.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.