Описание
Important: kernel security update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
-
kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (CVE-2026-64541)
-
kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)
-
kernel: s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452)
-
kernel: s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451)
-
kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)
-
kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)
-
kernel: fs/resctrl: Fix use-after-free during unmount (CVE-2026-72080)
-
kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)
-
kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)
-
kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)
-
kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)
-
kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)
-
kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)
-
kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
-
kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)
-
kernel: s390/boot: Avoid IPL parameter append past command line (CVE-2026-98403)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 9
Ссылки на источники
Исправления
- Red Hat - 2507721
- Red Hat - 2513314
- Red Hat - 2515351
- Red Hat - 2515353
- Red Hat - 2516278
- Red Hat - 2516412
- Red Hat - 2516674
- Red Hat - 2521384
- Red Hat - 2521419
- Red Hat - 2524422
- Red Hat - 2524442
- Red Hat - 2524458
- Red Hat - 2524475
- Red Hat - 2532290
- Red Hat - 2532407
- Red Hat - 2552209
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_c...
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_c...
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (ne
In the Linux kernel, the following vulnerability has been resolved: n ...