Количество 39
Количество 39
GHSA-27jv-r6jg-f5fr
In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->...
CVE-2026-23393
In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->head); kfree_rcu(peer_mep, rcu); ccm_rx_work_expired() // on freed peer_mep To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync() in both peer MEP deletion paths, so that subsequent queue_delayed_work() calls from ...
CVE-2026-23393
In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->head); kfree_rcu(peer_mep, rcu); ccm_rx_work_expired() // on freed peer_mep To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync() in both peer MEP deletion paths, so that subsequent queue_delayed_work() calls from ...
CVE-2026-23393
In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->hea
CVE-2026-23393
bridge: cfm: Fix race condition in peer_mep deletion
CVE-2026-23393
In the Linux kernel, the following vulnerability has been resolved: b ...
SUSE-SU-2026:2937-1
Security update for the Linux Kernel (Live Patch 51 for SUSE Linux Enterprise 15 SP4)
SUSE-SU-2026:2932-1
Security update for the Linux Kernel (Live Patch 49 for SUSE Linux Enterprise 15 SP4)
SUSE-SU-2026:2888-1
Security update for the Linux Kernel (Live Patch 52 for SUSE Linux Enterprise 15 SP4)
SUSE-SU-2026:2920-1
Security update for the Linux Kernel (Live Patch 43 for SUSE Linux Enterprise 15 SP4)
SUSE-SU-2026:2910-1
Security update for the Linux Kernel (Live Patch 46 for SUSE Linux Enterprise 15 SP4)
SUSE-SU-2026:2889-1
Security update for the Linux Kernel (Live Patch 44 for SUSE Linux Enterprise 15 SP4)
SUSE-SU-2026:2867-1
Security update for the Linux Kernel (Live Patch 41 for SUSE Linux Enterprise 15 SP4)
SUSE-SU-2026:2864-1
Security update for the Linux Kernel (Live Patch 45 for SUSE Linux Enterprise 15 SP4)
SUSE-SU-2026:2961-1
Security update for the Linux Kernel (Live Patch 39 for SUSE Linux Enterprise 15 SP5)
SUSE-SU-2026:2956-1
Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:2943-1
Security update for the Linux Kernel (Live Patch 14 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:2938-1
Security update for the Linux Kernel (Live Patch 37 for SUSE Linux Enterprise 15 SP5)
SUSE-SU-2026:2887-1
Security update for the Linux Kernel (Live Patch 12 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:2855-1
Security update for the Linux Kernel RT (Live Patch 11 for SUSE Linux Enterprise 15 SP7)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-27jv-r6jg-f5fr In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->... | CVSS3: 7.8 | 0% Низкий | 4 месяца назад |
 | CVE-2026-23393 In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->head); kfree_rcu(peer_mep, rcu); ccm_rx_work_expired() // on freed peer_mep To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync() in both peer MEP deletion paths, so that subsequent queue_delayed_work() calls from ... | CVSS3: 7.8 | 0% Низкий | 4 месяца назад |
 | CVE-2026-23393 In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->head); kfree_rcu(peer_mep, rcu); ccm_rx_work_expired() // on freed peer_mep To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync() in both peer MEP deletion paths, so that subsequent queue_delayed_work() calls from ... | 0% Низкий | 4 месяца назад | |
 | CVE-2026-23393 In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->hea | CVSS3: 7.8 | 0% Низкий | 4 месяца назад |
 | CVE-2026-23393 bridge: cfm: Fix race condition in peer_mep deletion | 0% Низкий | 4 месяца назад | |
| CVE-2026-23393 In the Linux kernel, the following vulnerability has been resolved: b ... | CVSS3: 7.8 | 0% Низкий | 4 месяца назад |
 | SUSE-SU-2026:2937-1 Security update for the Linux Kernel (Live Patch 51 for SUSE Linux Enterprise 15 SP4) | 18 дней назад | ||
| SUSE-SU-2026:2932-1 Security update for the Linux Kernel (Live Patch 49 for SUSE Linux Enterprise 15 SP4) | 18 дней назад | ||
| SUSE-SU-2026:2888-1 Security update for the Linux Kernel (Live Patch 52 for SUSE Linux Enterprise 15 SP4) | 18 дней назад | ||
| SUSE-SU-2026:2920-1 Security update for the Linux Kernel (Live Patch 43 for SUSE Linux Enterprise 15 SP4) | 18 дней назад | ||
| SUSE-SU-2026:2910-1 Security update for the Linux Kernel (Live Patch 46 for SUSE Linux Enterprise 15 SP4) | 18 дней назад | ||
| SUSE-SU-2026:2889-1 Security update for the Linux Kernel (Live Patch 44 for SUSE Linux Enterprise 15 SP4) | 18 дней назад | ||
| SUSE-SU-2026:2867-1 Security update for the Linux Kernel (Live Patch 41 for SUSE Linux Enterprise 15 SP4) | 18 дней назад | ||
| SUSE-SU-2026:2864-1 Security update for the Linux Kernel (Live Patch 45 for SUSE Linux Enterprise 15 SP4) | 20 дней назад | ||
| SUSE-SU-2026:2961-1 Security update for the Linux Kernel (Live Patch 39 for SUSE Linux Enterprise 15 SP5) | 17 дней назад | ||
| SUSE-SU-2026:2956-1 Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 15 SP7) | 17 дней назад | ||
| SUSE-SU-2026:2943-1 Security update for the Linux Kernel (Live Patch 14 for SUSE Linux Enterprise 15 SP7) | 17 дней назад | ||
| SUSE-SU-2026:2938-1 Security update for the Linux Kernel (Live Patch 37 for SUSE Linux Enterprise 15 SP5) | 18 дней назад | ||
| SUSE-SU-2026:2887-1 Security update for the Linux Kernel (Live Patch 12 for SUSE Linux Enterprise 15 SP7) | 18 дней назад | ||
| SUSE-SU-2026:2855-1 Security update for the Linux Kernel RT (Live Patch 11 for SUSE Linux Enterprise 15 SP7) | 21 день назад |
Уязвимостей на страницу