Описание
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
-
kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007)
-
kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005)
-
kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)
-
kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
-
kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053)
-
kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)
-
kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)
-
kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)
-
kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201)
-
kernel: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CVE-2026-72261)
-
kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)
-
kernel: net: tun: bound receive headroom (CVE-2026-81000)
-
kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)
Bug Fix(es) and Enhancement(s):
-
sctp: prevent peer transport count overflow [rhel-9.8.z] (JIRA:Rocky Linux-216251)
-
netfilter: nftables CVE and memory safety backports for 9.8 (JIRA:Rocky Linux-236634)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 9
Ссылки на источники
Исправления
- Red Hat - 2432674
- Red Hat - 2492381
- Red Hat - 2502243
- Red Hat - 2502251
- Red Hat - 2502498
- Red Hat - 2507134
- Red Hat - 2507399
- Red Hat - 2510890
- Red Hat - 2513481
- Red Hat - 2516527
- Red Hat - 2528676
- Red Hat - 2532176
- Red Hat - 2535391
- Red Hat - 2517043
Связанные уязвимости
ELSA-2026-71232: kernel security, bug fix, and enhancement update (IMPORTANT)
ELSA-2026-71233: kernel security, bug fix, and enhancement update (IMPORTANT)
In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer for writes needs to be fully initialized before being passed to the underlying block device, otherwise the uninitialized memory can be read back by userspace or anyone with physical access to the storage device. If protection information is generated, that portion of the integrity buffer is already initialized. The integrity data is also zeroed if PI generation is disabled via sysfs or the PI tuple size is 0. However, this misses the case where PI is generated and the PI tuple size is nonzero, but the metadata size is larger than the PI tuple. In this case, the remainder ("opaque") of the metadata is left uninitialized. Generalize the BLK_INTEGRITY_CSUM_NONE check to cover any case when the metadata is larger than just the PI tuple.
In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer for writes needs to be fully initialized before being passed to the underlying block device, otherwise the uninitialized memory can be read back by userspace or anyone with physical access to the storage device. If protection information is generated, that portion of the integrity buffer is already initialized. The integrity data is also zeroed if PI generation is disabled via sysfs or the PI tuple size is 0. However, this misses the case where PI is generated and the PI tuple size is nonzero, but the metadata size is larger than the PI tuple. In this case, the remainder ("opaque") of the metadata is left uninitialized. Generalize the BLK_INTEGRITY_CSUM_NONE check to cover any case when the metadata is larger than just the PI tuple.
In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer for writes needs to be fully initialized before being passed to the underlying block device, otherwise the uninitialized memory can be read back by userspace or anyone with physical access to the storage device. If protection information is generated, that portion of the integrity buffer is already initialized. The integrity data is also zeroed if PI generation is disabled via sysfs or the PI tuple size is 0. However, this misses the case where PI is generated and the PI tuple size is nonzero, but the metadata size is larger than the PI tuple. In this case, the remainder ("opaque") of the metadata is left uninitialized. Generalize the BLK_INTEGRITY_CSUM_NONE check to cover any case when the metadata is larger than just the PI tuple.