Описание
Important: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
-
kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
-
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
-
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
-
kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)
-
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
-
kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
-
kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
-
kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)
-
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
-
kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
-
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
-
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
-
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
-
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
-
kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
-
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
-
kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
-
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 9
Ссылки на источники
Исправления
- Red Hat - 2486979
- Red Hat - 2492286
- Red Hat - 2502460
- Red Hat - 2513234
- Red Hat - 2513277
- Red Hat - 2513293
- Red Hat - 2513299
- Red Hat - 2516526
- Red Hat - 2516575
- Red Hat - 2516606
- Red Hat - 2521436
- Red Hat - 2521498
- Red Hat - 2532279
- Red Hat - 2532309
- Red Hat - 2532515
- Red Hat - 2535158
- Red Hat - 2540182
- Red Hat - 2540230
Связанные уязвимости
ELSA-2026-83207: kernel security, bug fix, and enhancement update (IMPORTANT)
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read critical section before returning ct_ft. The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero() is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft object. This vulnerability can lead to privilege escalation. Analysis from zdi-disclosures@trendmicro.com: When initializing act_ct, tcf_ct_init() is called, which internally triggers tcf_ct_flow_table_get(). static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params) { struct zones_ht_key key = { .net = net, .zone = params->zone }; struct tcf_ct_flow_table *ct_ft; int err = -ENOMEM; mutex_lock(&zones_mutex); ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params); // [1] if (ct_ft && refcount_inc_not_zero(...
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read critical section before returning ct_ft. The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero() is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft object. This vulnerability can lead to privilege escalation. Analysis from zdi-disclosures@trendmicro.com: When initializing act_ct, tcf_ct_init() is called, which internally triggers tcf_ct_flow_table_get(). static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params) { struct zones_ht_key key = { .net = net, .zone = params->zone }; struct tcf_ct_flow_table *ct_ft; int err = -ENOMEM; mutex_lock(&zones_mutex); ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params); // [1] if (ct_ft && refcount_inc_not_zero(...