Описание
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
-
kernel: udp: Deal with race between UDP socket address change and rehash (CVE-2024-57974)
-
kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388)
-
kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979)
-
kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978)
-
kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
-
kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523)
-
kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)
-
kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242)
-
kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515)
-
kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
-
kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)
-
kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)
-
kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)
-
kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)
-
kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)
Bug Fix(es) and Enhancement(s):
- kernel panic at __crypto_xor+0x2 after a number of out-of-bounds read and use-after-free read (JIRA:Rocky Linux-257205)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 9
Ссылки на источники
Исправления
- Red Hat - 2348512
- Red Hat - 2502255
- Red Hat - 2502376
- Red Hat - 2502382
- Red Hat - 2507098
- Red Hat - 2507122
- Red Hat - 2516251
- Red Hat - 2516417
- Red Hat - 2517006
- Red Hat - 2528642
- Red Hat - 2532122
- Red Hat - 2535066
- Red Hat - 2540323
- Red Hat - 2546385
- Red Hat - 2546494
Связанные уязвимости
ELSA-2026-90365: kernel security, bug fix, and enhancement update (IMPORTANT)
In the Linux kernel, the following vulnerability has been resolved: udp: Deal with race between UDP socket address change and rehash If a UDP socket changes its local address while it's receiving datagrams, as a result of connect(), there is a period during which a lookup operation might fail to find it, after the address is changed but before the secondary hash (port and address) and the four-tuple hash (local and remote ports and addresses) are updated. Secondary hash chains were introduced by commit 30fff9231fad ("udp: bind() optimisation") and, as a result, a rehash operation became needed to make a bound socket reachable again after a connect(). This operation was introduced by commit 719f835853a9 ("udp: add rehash on connect()") which isn't however a complete fix: the socket will be found once the rehashing completes, but not while it's pending. This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a client sending datagrams to it. After the server receives the fi...
In the Linux kernel, the following vulnerability has been resolved: udp: Deal with race between UDP socket address change and rehash If a UDP socket changes its local address while it's receiving datagrams, as a result of connect(), there is a period during which a lookup operation might fail to find it, after the address is changed but before the secondary hash (port and address) and the four-tuple hash (local and remote ports and addresses) are updated. Secondary hash chains were introduced by commit 30fff9231fad ("udp: bind() optimisation") and, as a result, a rehash operation became needed to make a bound socket reachable again after a connect(). This operation was introduced by commit 719f835853a9 ("udp: add rehash on connect()") which isn't however a complete fix: the socket will be found once the rehashing completes, but not while it's pending. This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a client sending datagrams to it. After the server receives the fi...
In the Linux kernel, the following vulnerability has been resolved: udp: Deal with race between UDP socket address change and rehash If a UDP socket changes its local address while it's receiving datagrams, as a result of connect(), there is a period during which a lookup operation might fail to find it, after the address is changed but before the secondary hash (port and address) and the four-tuple hash (local and remote ports and addresses) are updated. Secondary hash chains were introduced by commit 30fff9231fad ("udp: bind() optimisation") and, as a result, a rehash operation became needed to make a bound socket reachable again after a connect(). This operation was introduced by commit 719f835853a9 ("udp: add rehash on connect()") which isn't however a complete fix: the socket will be found once the rehashing completes, but not while it's pending. This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a client sending datagrams to it. After the server receives the
udp: Deal with race between UDP socket address change and rehash