CVE-2024-53143

In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix ordering of iput() and watched_objects decrement Ensure the superblock is kept alive until we're done with iput(). Holding a reference to an inode is not allowed unless we ensure the superblock stays alive, which fsnotify does by keeping the watched_objects count elevated, so iput() must happen before the watched_objects decrement. This can lead to a UAF of something like sb->s_fs_info in tmpfs, but the UAF is hard to hit because race orderings that oops are more likely, thanks to the CHECK_DATA_CORRUPTION() block in generic_shutdown_super(). Also, ensure that fsnotify_put_sb_watched_objects() doesn't call fsnotify_sb_watched_objects() on a superblock that may have already been freed, which would cause a UAF read of sb->s_fsnotify_info.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fsnotify: Fix ordering of iput() and watched_objects decrement (CVE-2024-53143)

• kernel: shmem: fix recovery on rename failures (CVE-2025-71072)

• kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415)

• kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488)

• kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923)

• kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368)

• kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531)

Bug Fix(es) and Enhancement(s):

• Kernel oops after increasing max number of mac addresses of a mlx5 VF [rhel-10.2.z] (JIRA:Rocky Linux-213035)

• Rocky Linux10.0 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [rhel-10.2.z] (JIRA:Rocky Linux-222503)

• Rocky Linux10.0 - s390/pkey: Check length in pkey_pckmo handler implementation [rhel-10.2.z] (JIRA:Rocky Linux-222505)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix ordering of iput() and watched_objects decrement Ensure the superblock is kept alive until we're done with iput(). Holding a reference to an inode is not allowed unless we ensure the superblock stays alive, which fsnotify does by keeping the watched_objects count elevated, so iput() must happen before the watched_objects decrement. This can lead to a UAF of something like sb->s_fs_info in tmpfs, but the UAF is hard to hit because race orderings that oops are more likely, thanks to the CHECK_DATA_CORRUPTION() block in generic_shutdown_super(). Also, ensure that fsnotify_put_sb_watched_objects() doesn't call fsnotify_sb_watched_objects() on a superblock that may have already been freed, which would cause a UAF read of sb->s_fsnotify_info.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fsnotify: Fix ordering of iput() and watched_objects decrement (CVE-2024-53143)
• kernel: shmem: fix recovery on rename failures (CVE-2025-71072)
• kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415)
• kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488)
• kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923)
• kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368)
• kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531)

Bug Fix(es) and Enhancement(s):

• Kernel oops after increasing max number of mac addresses of a mlx5 VF [almalinux-10.2.z] (JIRA:AlmaLinux-213035)
• AlmaLinux10.0 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [almalinux-10.2.z] (JIRA:AlmaLinux-222503)
• AlmaLinux10.0 - s390/pkey: Check length in pkey_pckmo handler implementation [almalinux-10.2.z] (JIRA:AlmaLinux-222505)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• SuperH RISC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• RAM backed block device driver;
• Network block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• Buffer Sharing and Synchronization framework;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• EFI core;
• Qualcomm firmware drivers;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NTB driver;
• Virtio pmem driver;
• NVME drivers;
• Parport drivers;
• PCI subsystem;
• Alibaba DDR Sub-System Driveway PMU driver;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• i.MX PM domains;
• Powercap sysfs driver;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• StarFive reset controller drivers;
• Real Time Clock drivers;
• SCSI subsystem;
• SuperH / SH-Mobile drivers;
• QCOM SoC drivers;
• Xilinx SoC drivers;
• SPI subsystem;
• Direct Digital Synthesis drivers;
• Media staging drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Port Controller Manager driver;
• TI TPS6598x USB Power Delivery controller driver;
• USB Type-C Connector System Software Interface driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Virtio drivers;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• File systems infrastructure;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• Proc file system;
• SMB network file system;
• UBI file system;
• BPF subsystem;
• Network file system (NFS) superblock;
• Virtio network driver;
• Bluetooth subsystem;
• Network traffic control;
• Network sockets;
• TCP network protocol;
• Tracing infrastructure;
• User-space API (UAPI);
• Kernel init infrastructure; -…