Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

rocky логотип

RLSA-2026:63129

Опубликовано: 05 сент. 2026
Источник: rocky
Оценка: Important

Описание

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

  • kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)

  • kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)

  • kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

  • kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)

  • kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)

  • kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

  • kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

  • kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)

  • kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)

  • kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

  • kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)

  • kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

  • kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

  • kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)

  • kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)

  • kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)

  • kernel: smb: client: fix query directory replay double-free (CVE-2026-64387)

  • kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)

  • kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)

  • kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)

  • kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)

  • kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)

  • kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)

  • kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166)

  • kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145)

  • kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)

  • kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)

Bug Fix(es) and Enhancement(s):

  • [Rocky Linux 9] TPM becomes completely unresponsive and requires a full reboot to clear [rhel-9.8.z] (JIRA:Rocky Linux-213940)

  • RT scheduler livelock caused by missing backport of 94894c9c477e [rhel-9.8.z] (JIRA:Rocky Linux-240634)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Затронутые продукты

  • Rocky Linux 9

НаименованиеАрхитектураРелизRPM
kernelaarch64687.44.1.el9_8kernel-5.14.0-687.44.1.el9_8.aarch64.rpm
kernel-64kaarch64687.44.1.el9_8kernel-64k-5.14.0-687.44.1.el9_8.aarch64.rpm
kernel-64k-coreaarch64687.44.1.el9_8kernel-64k-core-5.14.0-687.44.1.el9_8.aarch64.rpm
kernel-64k-debugaarch64687.44.1.el9_8kernel-64k-debug-5.14.0-687.44.1.el9_8.aarch64.rpm
kernel-64k-debug-coreaarch64687.44.1.el9_8kernel-64k-debug-core-5.14.0-687.44.1.el9_8.aarch64.rpm
kernel-64k-debug-modulesaarch64687.44.1.el9_8kernel-64k-debug-modules-5.14.0-687.44.1.el9_8.aarch64.rpm
kernel-64k-debug-modules-coreaarch64687.44.1.el9_8kernel-64k-debug-modules-core-5.14.0-687.44.1.el9_8.aarch64.rpm
kernel-64k-debug-modules-extraaarch64687.44.1.el9_8kernel-64k-debug-modules-extra-5.14.0-687.44.1.el9_8.aarch64.rpm
kernel-64k-modulesaarch64687.44.1.el9_8kernel-64k-modules-5.14.0-687.44.1.el9_8.aarch64.rpm
kernel-64k-modules-coreaarch64687.44.1.el9_8kernel-64k-modules-core-5.14.0-687.44.1.el9_8.aarch64.rpm

Показывать по

Связанные CVE

CVE-2025-40064
CVE-2025-71147
CVE-2026-45970
CVE-2026-46185
CVE-2026-53073
CVE-2026-53391
CVE-2026-53392
CVE-2026-53397
CVE-2026-53399
CVE-2026-63800
CVE-2026-63808
CVE-2026-63824
CVE-2026-63886
CVE-2026-63887
CVE-2026-64002
CVE-2026-64018
CVE-2026-64268
CVE-2026-64298
CVE-2026-64304
CVE-2026-64387
CVE-2026-64438
CVE-2026-64490
CVE-2026-68145
CVE-2026-68166
CVE-2026-68480
CVE-2026-72069
CVE-2026-72130

Ссылки на источники

Исправления

Связанные уязвимости

oracle-oval логотип

ELSA-2026-63129-0

oracle-oval
3 дня назад

ELSA-2026-63129-0: kernel security, bug fix, and enhancement update (IMPORTANT)

ubuntu логотип

CVE-2025-40064

CVSS3: 7.8
ubuntu
11 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in __pnet_find_base_ndev(). syzbot reported use-after-free of net_device in __pnet_find_base_ndev(), which was called during connect(). [0] smc_pnet_find_ism_resource() fetches sk_dst_get(sk)->dev and passes down to pnet_find_base_ndev(), where RTNL is held. Then, UAF happened at __pnet_find_base_ndev() when the dev is first used. This means dev had already been freed before acquiring RTNL in pnet_find_base_ndev(). While dev is going away, dst->dev could be swapped with blackhole_netdev, and the dev's refcnt by dst will be released. We must hold dev's refcnt before calling smc_pnet_find_ism_resource(). Also, smc_pnet_find_roce_resource() has the same problem. Let's use __sk_dst_get() and dst_dev_rcu() in the two functions. [0]: BUG: KASAN: use-after-free in __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926 Read of size 1 at addr ffff888036bac33a by task syz.0.3632/18609 CPU: 1 UID: 0 ...

redhat логотип

CVE-2025-40064

CVSS3: 7.1
redhat
11 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in __pnet_find_base_ndev(). syzbot reported use-after-free of net_device in __pnet_find_base_ndev(), which was called during connect(). [0] smc_pnet_find_ism_resource() fetches sk_dst_get(sk)->dev and passes down to pnet_find_base_ndev(), where RTNL is held. Then, UAF happened at __pnet_find_base_ndev() when the dev is first used. This means dev had already been freed before acquiring RTNL in pnet_find_base_ndev(). While dev is going away, dst->dev could be swapped with blackhole_netdev, and the dev's refcnt by dst will be released. We must hold dev's refcnt before calling smc_pnet_find_ism_resource(). Also, smc_pnet_find_roce_resource() has the same problem. Let's use __sk_dst_get() and dst_dev_rcu() in the two functions. [0]: BUG: KASAN: use-after-free in __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926 Read of size 1 at addr ffff888036bac33a by task syz.0.3632/18609 CPU: 1 UID: 0 ...

nvd логотип

CVE-2025-40064

CVSS3: 7.8
nvd
11 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in __pnet_find_base_ndev(). syzbot reported use-after-free of net_device in __pnet_find_base_ndev(), which was called during connect(). [0] smc_pnet_find_ism_resource() fetches sk_dst_get(sk)->dev and passes down to pnet_find_base_ndev(), where RTNL is held. Then, UAF happened at __pnet_find_base_ndev() when the dev is first used. This means dev had already been freed before acquiring RTNL in pnet_find_base_ndev(). While dev is going away, dst->dev could be swapped with blackhole_netdev, and the dev's refcnt by dst will be released. We must hold dev's refcnt before calling smc_pnet_find_ism_resource(). Also, smc_pnet_find_roce_resource() has the same problem. Let's use __sk_dst_get() and dst_dev_rcu() in the two functions. [0]: BUG: KASAN: use-after-free in __pnet_find_base_ndev+0x1b1/0x1c0 net/smc/smc_pnet.c:926 Read of size 1 at addr ffff888036bac33a by task syz.0.3632/18609 CPU: 1

msrc логотип

CVE-2025-40064

msrc
9 месяцев назад

smc: Fix use-after-free in __pnet_find_base_ndev().