Описание
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
-
kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)
-
kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
-
kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
-
kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)
-
kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
-
kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)
-
kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)
-
kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)
-
kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
-
kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
-
kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
-
kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
-
kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)
-
kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)
-
kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)
-
kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
-
kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)
-
kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)
-
kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege Escalation Vulnerability ()
Bug Fix(es) and Enhancement(s):
-
kernel panic in percpu_counter_add_batch() via submit_bio_noacct() due to NULL pointer (JIRA:Rocky Linux-250378)
-
ipv4: ip_gre: make ipgre_header() robust (rhel-9.8.z) (JIRA:Rocky Linux-271127)
-
ip6_gre: make ip6gre_header() robust (rhel-9.8.z) (JIRA:Rocky Linux-271130)
-
Backport "sched: The newidle balance regression" series to rhel 9.8 [rhel-9.8.z] (JIRA:Rocky Linux-288067)
-
Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z] (JIRA:Rocky Linux-291352)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 9
Ссылки на источники
Исправления
- Red Hat - 2492108
- Red Hat - 2492733
- Red Hat - 2492853
- Red Hat - 2507222
- Red Hat - 2513435
- Red Hat - 2516579
- Red Hat - 2516935
- Red Hat - 2516970
- Red Hat - 2519475
- Red Hat - 2524438
- Red Hat - 2535227
- Red Hat - 2540396
- Red Hat - 2540555
- Red Hat - 2546487
- Red Hat - 2553390
- Red Hat - 2554835
- Red Hat - 2555068
Связанные уязвимости
ELSA-2026-93412: kernel security, bug fix, and enhancement update (IMPORTANT)
In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
