Описание
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
-
kernel: Kernel: Denial of Service in network socket error handling (CVE-2026-22977)
-
kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174)
-
kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
-
kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398)
-
kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
-
kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)
-
kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
-
kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
-
kernel: KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932)
-
kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
-
kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)
-
kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)
-
kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)
-
kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)
-
kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
-
kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)
Bug Fix(es) and Enhancement(s):
-
ipv4: ip_gre: make ipgre_header() robust (rhel-10.2.z) (JIRA:Rocky Linux-270702)
-
ip6_gre: make ip6gre_header() robust (rhel-10.2.z) (JIRA:Rocky Linux-270721)
-
Rocky Linux is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.2.z] (JIRA:Rocky Linux-291348)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 10
Ссылки на источники
Исправления
- Red Hat - 2431602
- Red Hat - 2482549
- Red Hat - 2502872
- Red Hat - 2513188
- Red Hat - 2513435
- Red Hat - 2516935
- Red Hat - 2524438
- Red Hat - 2535212
- Red Hat - 2535227
- Red Hat - 2540396
- Red Hat - 2540555
- Red Hat - 2546385
- Red Hat - 2546487
- Red Hat - 2553390
- Red Hat - 2555068
Связанные уязвимости
ELSA-2026-93413: kernel security, bug fix, and enhancement update (IMPORTANT)
In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[] field. [2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is enabled and the kernel attempts to copy sk_buff.cb data to userspace via sock_recv_errqueue() -> put_cmsg(). The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone() (from skbuff_fclone_cache) [1] 2. The skb is cloned via skb_clone() using the pre-allocated fclone [3] 3. The cloned skb is queued to sk_error_queue for timestamp reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE) 5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb [4] 6. __check_heap_object() fails because skbuff_fclone_cache has no usercopy whitelist [5] When cloned skbs allocated from skbuff_fclone_cache are used in the socket error que...
In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[] field. [2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is enabled and the kernel attempts to copy sk_buff.cb data to userspace via sock_recv_errqueue() -> put_cmsg(). The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone() (from skbuff_fclone_cache) [1] 2. The skb is cloned via skb_clone() using the pre-allocated fclone [3] 3. The cloned skb is queued to sk_error_queue for timestamp reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE) 5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb [4] 6. __check_heap_object() fails because skbuff_fclone_cache has no usercopy whitelist [5] When cloned skbs allocated from skbuff_fclone_cache are used in the socket error que...
In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[] field. [2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is enabled and the kernel attempts to copy sk_buff.cb data to userspace via sock_recv_errqueue() -> put_cmsg(). The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone() (from skbuff_fclone_cache) [1] 2. The skb is cloned via skb_clone() using the pre-allocated fclone [3] 3. The cloned skb is queued to sk_error_queue for timestamp reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE) 5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb [4] 6. __check_heap_object() fails because skbuff_fclone_cache has no usercopy whitelist [5] When cloned skbs allocated from skbuff_fclone_cache are used in the socket er
net: sock: fix hardened usercopy panic in sock_recv_errqueue