Описание
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
-
kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202)
-
kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)
Bug Fix(es) and Enhancement(s):
-
[Rocky Linux9] tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [rhel-9.8.z] (JIRA:Rocky Linux-214434)
-
Kernels 5.14.0-434+ may lose page table dirty bit (and page data) [rhel-9.8.z] (JIRA:Rocky Linux-220787)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 9
Связанные CVE
Исправления
- Red Hat - 2492823
- Red Hat - 2492851
Связанные уязвимости
ELSA-2026-54443: kernel security, bug fix, and enhancement update (IMPORTANT)
ELSA-2026-54343: kernel security, bug fix, and enhancement update (IMPORTANT)
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied data_size is cast to signed int before being used in min_t(). Large unsigned values (>= 0x80000000) become negative, causing unsigned wraparound and oversized memcpy operations that can overflow the stack buffer. Change min_t(int, ...) to min() as both values are unsigned and can be handled by min() without explicit cast.
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied data_size is cast to signed int before being used in min_t(). Large unsigned values (>= 0x80000000) become negative, causing unsigned wraparound and oversized memcpy operations that can overflow the stack buffer. Change min_t(int, ...) to min() as both values are unsigned and can be handled by min() without explicit cast.