Количество 20
Количество 20
CVE-2026-74588
In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport's list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither. The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches tchunk->transport->flight_size -= sctp_data_size(tchunk); inside the freed transport. KASAN reports a slab-use-after-free read ...
CVE-2026-74588
In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport's list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither. The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches tchunk->transport->flight_size -= sctp_data_size(tchunk); inside the freed transport. KASAN reports a slab-use-after-free read ...
CVE-2026-74588
In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport's list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither. The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches tchunk->transport->flight_size -= sctp_data_size(tchunk); inside the freed transport. KASAN reports a slab
CVE-2026-74588
sctp: keep chunk->transport in step with the list it is queued on
CVE-2026-74588
In the Linux kernel, the following vulnerability has been resolved: s ...
GHSA-g275-m9xc-x5q2
In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport's list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither. The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches tchunk->transport->flight_size -= sctp_data_size(tchunk); inside the freed transport. KASAN reports a s...
RLSA-2026:85773
Important: kernel security, bug fix, and enhancement update
RLSA-2026:85321
Important: kernel security, bug fix, and enhancement update
SUSE-SU-2026:4639-1
Security update for the Linux Kernel
SUSE-SU-2026:4668-1
Security update for the Linux Kernel
SUSE-SU-2026:4667-1
Security update for the Linux Kernel
SUSE-SU-2026:4660-1
Security update for the Linux Kernel
SUSE-SU-2026:4687-1
Security update for the Linux Kernel
ELSA-2026-500377
ELSA-2026-500377: Unbreakable Enterprise kernel security update (IMPORTANT)
openSUSE-SU-2026:22091-1
Security update for the Linux Kernel
SUSE-SU-2026:4706-1
Security update for the Linux Kernel
SUSE-SU-2026:4640-1
Security update for the Linux Kernel
ELSA-2026-500249
ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT)
ELSA-2026-500248
ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT)
ELSA-2026-500374
ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-74588 In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport's list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither. The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches tchunk->transport->flight_size -= sctp_data_size(tchunk); inside the freed transport. KASAN reports a slab-use-after-free read ... | CVSS3: 9.8 | 1% Низкий | 2 месяца назад |
 | CVE-2026-74588 In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport's list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither. The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches tchunk->transport->flight_size -= sctp_data_size(tchunk); inside the freed transport. KASAN reports a slab-use-after-free read ... | CVSS3: 8.8 | 1% Низкий | 2 месяца назад |
 | CVE-2026-74588 In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport's list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither. The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches tchunk->transport->flight_size -= sctp_data_size(tchunk); inside the freed transport. KASAN reports a slab | CVSS3: 9.8 | 1% Низкий | 2 месяца назад |
 | CVE-2026-74588 sctp: keep chunk->transport in step with the list it is queued on | CVSS3: 6.5 | 1% Низкий | 25 дней назад |
| CVE-2026-74588 In the Linux kernel, the following vulnerability has been resolved: s ... | CVSS3: 9.8 | 1% Низкий | 2 месяца назад |
| GHSA-g275-m9xc-x5q2 In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: if (chunk->tsn_gap_acked) { list_move_tail(&chunk->transmitted_list, &transport->transmitted); continue; } The chunk then sits on a live transport's list while chunk->transport still names a different one. If that transport is removed - sctp_assoc_rm_peer() from an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk is left with a dangling pointer. sctp_assoc_rm_peer() scrubs peer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on neither. The pointer is not followed while tsn_gap_acked is set. A SACK that reneges on the TSN clears the flag, and the next SACK reaches tchunk->transport->flight_size -= sctp_data_size(tchunk); inside the freed transport. KASAN reports a s... | CVSS3: 9.8 | 1% Низкий | 2 месяца назад |
 | RLSA-2026:85773 Important: kernel security, bug fix, and enhancement update | 5 дней назад | ||
| RLSA-2026:85321 Important: kernel security, bug fix, and enhancement update | 5 дней назад | ||
 | SUSE-SU-2026:4639-1 Security update for the Linux Kernel | 13 дней назад | ||
| SUSE-SU-2026:4668-1 Security update for the Linux Kernel | 12 дней назад | ||
| SUSE-SU-2026:4667-1 Security update for the Linux Kernel | 12 дней назад | ||
| SUSE-SU-2026:4660-1 Security update for the Linux Kernel | 12 дней назад | ||
| SUSE-SU-2026:4687-1 Security update for the Linux Kernel | 11 дней назад | ||
| ELSA-2026-500377 ELSA-2026-500377: Unbreakable Enterprise kernel security update (IMPORTANT) | 20 дней назад | ||
| openSUSE-SU-2026:22091-1 Security update for the Linux Kernel | 14 дней назад | ||
| SUSE-SU-2026:4706-1 Security update for the Linux Kernel | 10 дней назад | ||
| SUSE-SU-2026:4640-1 Security update for the Linux Kernel | 13 дней назад | ||
| ELSA-2026-500249 ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | около 2 месяцев назад | ||
| ELSA-2026-500248 ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | около 2 месяцев назад | ||
| ELSA-2026-500374 ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 20 дней назад |
Уязвимостей на страницу