Описание
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
-
kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)
-
kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
-
kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942)
-
kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)
-
kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)
-
kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)
-
kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
-
kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)
-
kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)
-
kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)
-
kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)
-
kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)
-
kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)
-
kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)
-
kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)
Bug Fix(es) and Enhancement(s):
-
scsi: mpt3sas: avoid freeing unallocated PCIe SGL buffers [rhel 8.6.z] (JIRA:Rocky Linux-194117)
-
gfs2: harden gfs2_glock_hold [Rocky Linux-8] (JIRA:Rocky Linux-240340)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 8
Ссылки на источники
Исправления
- Red Hat - 2425039
- Red Hat - 2482566
- Red Hat - 2492091
- Red Hat - 2492115
- Red Hat - 2492270
- Red Hat - 2492397
- Red Hat - 2492771
- Red Hat - 2502254
- Red Hat - 2502331
- Red Hat - 2502380
- Red Hat - 2502541
- Red Hat - 2513253
- Red Hat - 2513397
- Red Hat - 2513408
- Red Hat - 2513474
Связанные уязвимости
ELSA-2026-66325-0: kernel security, bug fix, and enhancement update (IMPORTANT)
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems: 1. Commands sent to FW, after chip reset got stuck and never freed as FW is not going to respond to them anymore. 2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") attempted to fix this, but introduced another bug under different circumstances when two different CPUs were racing to call qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in dma_unmap_sg_attrs(). So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and partially revert "scsi: qla2xxx: target: Fix offline port handling and host reset handling" at __qla2x00_abort_all_cmds.
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems: 1. Commands sent to FW, after chip reset got stuck and never freed as FW is not going to respond to them anymore. 2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") attempted to fix this, but introduced another bug under different circumstances when two different CPUs were racing to call qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in dma_unmap_sg_attrs(). So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and partially revert "scsi: qla2xxx: target: Fix offline port handling and host reset handling" at __qla2x00_abort_all_cmds.
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems: 1. Commands sent to FW, after chip reset got stuck and never freed as FW is not going to respond to them anymore. 2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce53817a ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") attempted to fix this, but introduced another bug under different circumstances when two different CPUs were racing to call qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in dma_unmap_sg_attrs(). So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and partially revert "scsi: qla2xxx: target: Fix offline port handling and host reset handling" at __qla2x00_abort_all_cmds.
