Security update for the Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check the payload, not the Ethernet header, and would reintroduce the small packet regression fixed by commit 63137bc5882a. However, the optional ARP sender hardware address rewrite is different. It writes through skb_store_bits() at an offset relative to skb->data: skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) skb_header_pointer() only safely reads the ARP header; it does not make the later sender hardware address range writable. If that range is still held in a nonlinear skb fragment backed by a splice-importe...

Уязвимость функции ebt_snat_tg() модуля net/bridge/netfilter/ebt_snat.c реализации сетевых функций ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() ...

ELSA-2026-50319: Unbreakable Enterprise kernel security update (IMPORTANT)

Security update for the Linux Kernel

Уязвимость kernel-lt

Уязвимость kernel-lt

Уязвимость kernel-lt

Уязвимость kernel-lt

Уязвимость функции ep_remove() ядра операционных систем Linux, позволяющая нарушителю выполнить произвольный код

Security update for the Linux Kernel

Security update for the Linux Kernel

Security update for the Linux Kernel (Live Patch 18 for SUSE Linux Enterprise 15 SP7)

ELSA-2026-39083: kernel update (IMPORTANT)

Security update for the Linux Kernel (Live Patch 17 for SUSE Linux Enterprise 15 SP7)

ELSA-2026-500385: Unbreakable Enterprise kernel security update (IMPORTANT)

ELBA-2026-500163: Unbreakable Enterprise kernel bug fix update (NA)

Security update for the Linux Kernel (Live Patch 16 for SUSE Linux Enterprise 15 SP7)

ELSA-2026-71233: kernel security, bug fix, and enhancement update (IMPORTANT)