Threats Tagged 'ubuntu-pro-18-04-lts'

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: xfrm single-frag length not properly limited () * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103) * kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360) * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365) * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398) * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970) * kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035) * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115) * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744) * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690) * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669) * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530) * kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (CVE-2026-89676) * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663) * kernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675) Bug Fix(es) and Enhancement(s): * mlxbf_bootctl: driver update to Linux v6.16 [Nvidia 10.2.z FEAT] (JIRA:RHEL-212709) * [GNR-D] missing interfaces tspll_cfg [rhel-10.2] (JIRA:RHEL-273805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.320 fixes various security issues: The following security issues were fixed: - CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391). - CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012). - CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493). - CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833). - CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228). - CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).

This update for openssl-3-livepatches fixes the following issue: - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).

A use-after-free vulnerability in the Linux kernel's vsock/vmci subsystem was fixed by Red Hat. The flaw occurred during a peer reset connection in the handshake phase, causing improper socket cleanup and leading to a use-after-free condition detected by KASAN. This vulnerability has a high severity score of 8.8 and affects multiple Linux kernel versions prior to specific 5.15.x updates. Official kernel updates have been released to address this issue. Users should apply these updates and reboot to mitigate the vulnerability.

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command- line username, leading to injection.

A vulnerability in sssd allows a local user to cause a Denial of Service (DoS) by exhausting the responder service's file descriptors. This is achieved by opening many concurrent connections to a responder socket and queuing new connection attempts, triggering an unthrottled retry loop. The result is high CPU usage and service stalls, preventing legitimate identity and authentication requests from being processed.

These are all security issues fixed in the kernel-devel-7.2.9-1.1 package on the GA media of openSUSE Tumbleweed.

CVE-2026-8674 is a reachable assertion vulnerability in the GNU C Library (glibc) affecting versions 2.26 through 2.44. It occurs when the DNS stub resolver initializes from an /etc/resolv.conf file or LOCALDOMAIN environment variable with a search list containing a domain roughly 200 characters or longer. This triggers an assertion failure that aborts the process. The flaw arises because the resolver truncates the search list into a fixed-size buffer but performs a consistency check against the wrong size, causing a valid truncated list to fail the assertion. Any process performing name resolution via glibc is affected, including long-running processes that reload /etc/resolv.conf after changes. Attackers on the local network may trigger this without privileges, leveraging DHCP or VPN server configurations that update search domains.