Описание
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
-
kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007)
-
kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)
-
kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)
-
kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
-
kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)
-
kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
-
kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)
-
kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)
-
kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923)
-
kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)
-
kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)
-
kernel: netfilter: handle unreadable frags (CVE-2026-64414)
-
kernel: hwrng: virtio: clamp device-reported used.len at copy_data() (CVE-2026-64456)
-
kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)
-
kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
-
kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)
-
kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
-
kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)
-
kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)
Bug Fix(es) and Enhancement(s):
-
nouveau vga_switcheroo binding holds Realtek ALC245 converter stream open ? analog output (device 0) returns EBUSY [rhel-10.2.z] (JIRA:Rocky Linux-239776)
-
Rocky Linux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-10.2.z] (JIRA:Rocky Linux-254105)
-
RHIVOS - [backport] S32G Fix STM driver linking failing modpost (JIRA:Rocky Linux-255225)
-
RHIVOS - [backport] S32G Driver Enablement - OCOTP (JIRA:Rocky Linux-255516)
-
RHIVOS - [backport] S32G Driver Enablement - INA231 (JIRA:Rocky Linux-255518)
-
RHIVOS - [backport] S32G Driver Enablement - PIT (JIRA:Rocky Linux-255519)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 10
Ссылки на источники
Исправления
- Red Hat - 2348565
- Red Hat - 2439924
- Red Hat - 2492436
- Red Hat - 2492741
- Red Hat - 2492742
- Red Hat - 2492792
- Red Hat - 2502295
- Red Hat - 2502347
- Red Hat - 2502418
- Red Hat - 2502575
- Red Hat - 2502596
- Red Hat - 2507102
- Red Hat - 2507255
- Red Hat - 2513171
- Red Hat - 2513218
- Red Hat - 2513271
- Red Hat - 2513286
- Red Hat - 2513353
- Red Hat - 2516490
Связанные уязвимости
ELSA-2026-68507: kernel security, bug fix, and enhancement update (IMPORTANT)
ELSA-2026-68570: kernel security, bug fix, and enhancement update (IMPORTANT)
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: socinfo: Avoid out of bounds read of serial number On MSM8916 devices, the serial number exposed in sysfs is constant and does not change across individual devices. It's always: db410c:/sys/devices/soc0$ cat serial_number 2644893864 The firmware used on MSM8916 exposes SOCINFO_VERSION(0, 8), which does not have support for the serial_num field in the socinfo struct. There is an existing check to avoid exposing the serial number in that case, but it's not correct: When checking the item_size returned by SMEM, we need to make sure the *end* of the serial_num is within bounds, instead of comparing with the *start* offset. The serial_number currently exposed on MSM8916 devices is just an out of bounds read of whatever comes after the socinfo struct in SMEM. Fix this by changing offsetof() to offsetofend(), so that the size of the field is also taken into account.
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: socinfo: Avoid out of bounds read of serial number On MSM8916 devices, the serial number exposed in sysfs is constant and does not change across individual devices. It's always: db410c:/sys/devices/soc0$ cat serial_number 2644893864 The firmware used on MSM8916 exposes SOCINFO_VERSION(0, 8), which does not have support for the serial_num field in the socinfo struct. There is an existing check to avoid exposing the serial number in that case, but it's not correct: When checking the item_size returned by SMEM, we need to make sure the *end* of the serial_num is within bounds, instead of comparing with the *start* offset. The serial_number currently exposed on MSM8916 devices is just an out of bounds read of whatever comes after the socinfo struct in SMEM. Fix this by changing offsetof() to offsetofend(), so that the size of the field is also taken into account.