Количество 40
Количество 40
BDU:2026-11665
Уязвимость компонента drivers/infiniband/core/user_mad.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
ROS-20260916-80-0032
Уязвимость kernel-lt
ROS-20260916-73-0030
Уязвимость kernel-lt
CVE-2026-23243
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80
CVE-2026-23243
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80
CVE-2026-23243
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80
CVE-2026-23243
RDMA/umad: Reject negative data_len in ib_umad_write
CVE-2026-23243
In the Linux kernel, the following vulnerability has been resolved: R ...
GHSA-85rq-57vx-88q2
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80
SUSE-SU-2026:1777-1
Security update for the Linux Kernel
SUSE-SU-2026:2178-1
Security update for the Linux Kernel (Live Patch 70 for SUSE Linux Enterprise 12 SP5)
SUSE-SU-2026:2168-1
Security update for the Linux Kernel (Live Patch 76 for SUSE Linux Enterprise 12 SP5)
SUSE-SU-2026:2153-1
Security update for the Linux Kernel (Live Patch 72 for SUSE Linux Enterprise 12 SP5)
SUSE-SU-2026:2148-1
Security update for the Linux Kernel (Live Patch 75 for SUSE Linux Enterprise 12 SP5)
SUSE-SU-2026:2137-1
Security update for the Linux Kernel (Live Patch 68 for SUSE Linux Enterprise 12 SP5)
SUSE-SU-2026:2189-1
Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:2158-1
Security update for the Linux Kernel (Live Patch 46 for SUSE Linux Enterprise 15 SP4)
SUSE-SU-2026:2141-1
Security update for the Linux Kernel (Live Patch 40 for SUSE Linux Enterprise 15 SP4)
SUSE-SU-2026:2131-1
Security update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:2199-1
Security update for the Linux Kernel (Live Patch 17 for SUSE Linux Enterprise 15 SP6)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2026-11665 Уязвимость компонента drivers/infiniband/core/user_mad.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 7.8 | 0% Низкий | 8 месяцев назад |
 | ROS-20260916-80-0032 Уязвимость kernel-lt | CVSS3: 7.8 | 0% Низкий | 4 дня назад |
| ROS-20260916-73-0030 Уязвимость kernel-lt | CVSS3: 7.8 | 0% Низкий | 4 дня назад |
 | CVE-2026-23243 In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 | CVSS3: 7.8 | 0% Низкий | 6 месяцев назад |
 | CVE-2026-23243 In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 | CVSS3: 7.3 | 0% Низкий | 6 месяцев назад |
 | CVE-2026-23243 In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 | CVSS3: 7.8 | 0% Низкий | 6 месяцев назад |
 | CVE-2026-23243 RDMA/umad: Reject negative data_len in ib_umad_write | CVSS3: 7.8 | 0% Низкий | 6 месяцев назад |
| CVE-2026-23243 In the Linux kernel, the following vulnerability has been resolved: R ... | CVSS3: 7.8 | 0% Низкий | 6 месяцев назад |
| GHSA-85rq-57vx-88q2 In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 | CVSS3: 7.8 | 0% Низкий | 6 месяцев назад |
 | SUSE-SU-2026:1777-1 Security update for the Linux Kernel | 4 месяца назад | ||
| SUSE-SU-2026:2178-1 Security update for the Linux Kernel (Live Patch 70 for SUSE Linux Enterprise 12 SP5) | 4 месяца назад | ||
| SUSE-SU-2026:2168-1 Security update for the Linux Kernel (Live Patch 76 for SUSE Linux Enterprise 12 SP5) | 4 месяца назад | ||
| SUSE-SU-2026:2153-1 Security update for the Linux Kernel (Live Patch 72 for SUSE Linux Enterprise 12 SP5) | 4 месяца назад | ||
| SUSE-SU-2026:2148-1 Security update for the Linux Kernel (Live Patch 75 for SUSE Linux Enterprise 12 SP5) | 4 месяца назад | ||
| SUSE-SU-2026:2137-1 Security update for the Linux Kernel (Live Patch 68 for SUSE Linux Enterprise 12 SP5) | 4 месяца назад | ||
| SUSE-SU-2026:2189-1 Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 15 SP7) | 4 месяца назад | ||
| SUSE-SU-2026:2158-1 Security update for the Linux Kernel (Live Patch 46 for SUSE Linux Enterprise 15 SP4) | 4 месяца назад | ||
| SUSE-SU-2026:2141-1 Security update for the Linux Kernel (Live Patch 40 for SUSE Linux Enterprise 15 SP4) | 4 месяца назад | ||
| SUSE-SU-2026:2131-1 Security update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise 15 SP7) | 4 месяца назад | ||
| SUSE-SU-2026:2199-1 Security update for the Linux Kernel (Live Patch 17 for SUSE Linux Enterprise 15 SP6) | 4 месяца назад |
Уязвимостей на страницу