Описание
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
-
kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)
-
kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
-
kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)
-
kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
-
kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
-
kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
-
kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
-
kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
-
kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
-
kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
-
kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)
-
kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
-
kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)
-
kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
-
kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)
-
kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)
-
kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
-
kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)
Bug Fix(es) and Enhancement(s):
-
Backport request: bonding: only set speed/duplex to unknown, if getting speed failed [rhel-10.2.z] (JIRA:Rocky Linux-179066)
-
RTLA segfaults on freed memory access on double SIGINT [rhel-10.2.z] (JIRA:Rocky Linux-193031)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 10
Ссылки на источники
Исправления
- Red Hat - 2376106
- Red Hat - 2502486
- Red Hat - 2502589
- Red Hat - 2507038
- Red Hat - 2507098
- Red Hat - 2511413
- Red Hat - 2513148
- Red Hat - 2513245
- Red Hat - 2513287
- Red Hat - 2513430
- Red Hat - 2514462
- Red Hat - 2524501
- Red Hat - 2525413
- Red Hat - 2528788
- Red Hat - 2535070
- Red Hat - 2535309
- Red Hat - 2540391
- Red Hat - 2540475
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there. However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one. The root cause is missing validation in netlbl_conn_setattr(). netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket. The syzkaller must have called connect() for an IPv6 address on an IPv4 socket. We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage. Let's copy the validation to netlbl_conn_setattr(). [0]: Oops: general protection fault, probably for non-canonical address...
In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there. However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one. The root cause is missing validation in netlbl_conn_setattr(). netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket. The syzkaller must have called connect() for an IPv6 address on an IPv4 socket. We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage. Let's copy the validation to netlbl_conn_setattr(). [0]: Oops: general protection fault, probably for non-canonical address...
In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref in txopt_get(). [0] The offset 0x70 was of struct ipv6_txoptions in struct ipv6_pinfo, so struct ipv6_pinfo was NULL there. However, this never happens for IPv6 sockets as inet_sk(sk)->pinet6 is always set in inet6_create(), meaning the socket was not IPv6 one. The root cause is missing validation in netlbl_conn_setattr(). netlbl_conn_setattr() switches branches based on struct sockaddr.sa_family, which is passed from userspace. However, netlbl_conn_setattr() does not check if the address family matches the socket. The syzkaller must have called connect() for an IPv6 address on an IPv4 socket. We have a proper validation in tcp_v[46]_connect(), but security_socket_connect() is called in the earlier stage. Let's copy the validation to netlbl_conn_setattr(). [0]: Oops: general protection fault, probably for non-canonical
In the Linux kernel, the following vulnerability has been resolved: c ...