CVE-2025-39964

In the Linux kernel, the following vulnerability has been resolved:

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state.

Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

The Linux Kernel, the operating system core itself.

Security Fix(es):

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.(CVE-2025-22080)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-23150)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix OOB read when checking dotdot dir

Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, when the corrupted directory is removed).

ext4_empty_dir() assumes every ext4 directory contains at least '.' and '..' as directory entries in the first data block. It first loads the '.' dir entry, performs sanity checks by calling ext4_check_dir_entry() and then uses its rec_len member to compute the location of '..' dir entry (in ext4_next_entry). It assumes the '..' dir entry fits into the same data block.

If the rec_len of '.' is precisely one block (4KB), it slips through the sanity checks (it is considered the last directory entry in the data block) and leaves "struct ext4_dir_entry_2 *de" point…

The Linux Kernel, the operating system core itself.

Security Fix(es):

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

In the Linux kernel, the following vulnerability has been resolved:

cdx: Fix possible UAF error in driver_override_show()

Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c

This function driver_override_show() is part of DEVICE_ATTR_RW, which includes both driver_override_show() and driver_override_store(). These functions can be executed concurrently in sysfs.

The driver_override_store() function uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the device (device_lock(dev)). If driver_override_show() reads cdx_dev->driver_override without locking, it could potentially access a freed pointer if driver_override_store() frees the string concurrently. This could lead to printing a kernel address, which is a security risk since DEVICE_ATTR can be read by all users.

Additionally, a similar pattern is used in drivers/amba/bus.c, as well as many other bus drivers, where device_lock() is taken in the show function, and it has been working without issues.

This potential bug was detected by our experimental static analysis tool, which analyzes locking APIs and paired functions to identify data races and atomicity violations.(CVE-2025-21915)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.(CVE-2025-22080)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour…

The Linux Kernel, the operating system core itself.

Security Fix(es):

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.(CVE-2025-22080)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-23150)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix OOB read when checking dotdot dir

Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, when the corrupted directory is removed).

ext4_empty_dir() assumes every ext4 directory contains at least '.' and '..' as directory entries in the first data block. It first loads the '.' dir entry, performs sanity checks by calling ext4_check_dir_entry() and then uses its rec_len member to compute the location of '..' dir entry (in ext4_next_entry). It assumes the '..' dir entry fits into the same data block.

If the rec_len of '.' is precisely one block (4KB), it slips through the sanity checks (it is considered the last directory entry in the data block) and leaves "struct ext4_dir_entry_2 *de" point…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

udf: Detect system inodes linked into directory hierarchy

When UDF filesystem is corrupted, hidden system inodes can be linked into directory hierarchy which is an avenue for further serious corruption of the filesystem and kernel confusion as noticed by syzbot fuzzed images. Refuse to access system inodes linked into directory hierarchy and vice versa.(CVE-2023-53695)

In the Linux kernel, a boundary check vulnerability exists in the SCSI SES (SCSI Enclosure Services) component. The vulnerability involves improper boundary checking of the addl_desc_ptr pointer in the ses_enclosure_data_process() function, which may lead to out-of-bounds accesses.(CVE-2023-7324)

In the Linux kernel, the following vulnerability has been resolved:

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state.

Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.(CVE-2025-39964)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

• kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread (CVE-2023-54120)

• kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)

• kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)

• kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)

• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

• kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

• kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

• kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

• kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

• kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

• kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

Bug Fix(es) and Enhancement(s):

• Intel IOMMU: possible circular locking dependency (JIRA:Rocky Linux-243217)

• xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:Rocky Linux-251578)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

• kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread (CVE-2023-54120)

• kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)

• kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)

• kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)

• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

• kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

• kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

• kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

• kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

• kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

• kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

Bug Fix(es) and Enhancement(s):

• Intel IOMMU: possible circular locking dependency (JIRA:Rocky Linux-243217)

• xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:Rocky Linux-251578)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

• kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)

• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

• kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157)

• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

• kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)

• kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)

• kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)

• kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)

• kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

Bug Fix(es) and Enhancement(s):

• [Intel 9.8 FEAT] ice: Driver Update [rhel-9.8.z] (JIRA:Rocky Linux-213003)

• Rocky Linux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [rhel-9.8.z] (JIRA:Rocky Linux-254108)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

• kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)

• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

• kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)

• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

• kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)

• kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)

• kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

Bug Fix(es) and Enhancement(s):

• Update kernel to use new certificate paths [rhel-10.2.z] (JIRA:Rocky Linux-169478)

• RHIVOS - [backport] S32G Driver Enablement - PWM (JIRA:Rocky Linux-255517)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2025-39964 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-39964 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-39964 in the linux package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2025-39964 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-39964 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)
• kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread (CVE-2023-54120)
• kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)
• kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)
• kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)
• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)
• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
• kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)
• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
• kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
• kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)
• kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
• kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)
• kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)
• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)
• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

Bug Fix(es) and Enhancement(s):

• Intel IOMMU: possible circular locking dependency (JIRA:AlmaLinux-243217)
• xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:AlmaLinux-251578)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)
• kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread (CVE-2023-54120)
• kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)
• kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)
• kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)
• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)
• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
• kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)
• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
• kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
• kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)
• kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
• kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)
• kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)
• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)
• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

Bug Fix(es) and Enhancement(s):

• Intel IOMMU: possible circular locking dependency (JIRA:AlmaLinux-243217)
• xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:AlmaLinux-251578)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)
• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)
• kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)
• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
• kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157)
• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)
• kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)
• kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)
• kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)
• kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)
• kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

Bug Fix(es) and Enhancement(s):

• [Intel 9.8 FEAT] ice: Driver Update [almalinux-9.8.z] (JIRA:AlmaLinux-213003)
• AlmaLinux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [almalinux-9.8.z] (JIRA:AlmaLinux-254108)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)
• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)
• kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)
• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)
• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
• kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)
• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)
• kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)
• kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)
• kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)

Bug Fix(es) and Enhancement(s):

• Update kernel to use new certificate paths [almalinux-10.2.z] (JIRA:AlmaLinux-169478)
• RHIVOS - [backport] S32G Driver Enablement - PWM (JIRA:AlmaLinux-255517)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state.

Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

In the Linux kernel, the following vulnerability has been resolved:

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state.

Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

• crypto: af_alg - Fix incorrect boolean values in af_alg_ctx {CVE-2025-40022}
• arm64: pensando: Must boot Ortano kernel with spin-table
• net/sched: adjust device watchdog timer to detect stopped queue at right time
• net/mlx5: Mark the mellanox graceful_period fix as out-of-tree change
• infiniband/xsigo: Replace BUG_ON with WARN_ON_ONCE.
• infiniband/xsigo: xsvnic_main: Remove unused functions
• infiniband/xsigo: xve_cm: Fix mixed code warning
• infiniband/xsigo: xve_ethtool: Remove unused variable 'priv'
• infiniband/xsigo: xve_ib: Fix misleading indentation
• infiniband/xsigo: xve_ib: Fix mixed code warning
• infiniband/xsigo: xve_verbs: Remove unused label 'out_free_pd'
• infiniband/xsigo: xve_main: Remove unused function 'xve_napi_del'
• infiniband/xsigo: xve_main: Fix mixed code warning
• infiniband/xsigo: xve_main: Fix misleading indentation
• inifinibad/xsigo: xsvnic_main: Remove unused variable 'xsvnic_ethtool_ops'
• infiniband/xsigo: xscore_impl: Remove unused label 'err_pd'
• rds: Fix jiffies type in struct rds_conn_path
• kernel: sysctl: Remove unused variable 'zero'
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• RDMA/cm: Base cm_id destruction timeout on CMA values
• x86/its: Build fails with CONFIG_MITIGATION_ITS=n
• LTS tag: v5.4.302
• Input: pegasus-notetaker - fix potential out-of-bounds access {CVE-2025-68217}
• Input: remove third argument of usb_maxpacket()
• usb: deprecate the third argument of usb_maxpacket()
• fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
• pmdomain: imx: Fix reference count leak in imx_gpc_remove
• pmdomain: arm: scmi: Fix genpd leak on provider registration failure {CVE-2025-68204}
• net: netpoll: fix incorrect refcount handling causing incorrect cleanup {CVE-2025-68245}
• net: qede: Initialize qede_ll_ops with designated initializer
• net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error {CVE-2025-68220}
• ALSA: usb-audio: fix uac2 clock source at terminal parser
• mm/page_alloc: fix hash table order logging in alloc_large_system_hash()
• kconfig/nconf: Initialize the default locale at startup
• kconfig/mconf: Initialize the default locale at startup
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• s390/ctcm: Fix double-kfree {CVE-2025-40253}
• net: openvswitch: remove never-working support for setting nsh fields {CVE-2025-40254}
• mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
• MIPS: Malta: Fix !EVA SOC-it PCI MMIO
• scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() {CVE-2025-68229}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• Input: cros_ec_keyb - fix an invalid memory access {CVE-2025-40263}
• be2net: pass wrb_params in case of OS2BMC {CVE-2025-40264}
• isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() {CVE-2025-68734}
• EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
• EDAC/altera: Handle OCRAM ECC enable after warm reset
• spi: Try to get ACPI GPIO IRQ earlier
• ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe {CVE-2025-68241}
• strparser: Fix signed/unsigned mismatch bug
• gcov: add support for GCC 15
• mm/ksm: fix flag-dropping behavior in ksm_madvise {CVE-2025-40040}
• ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd {CVE-2025-40275}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• ASoC: cs4271: Fix regulator leak on probe failure
• regulator: fixed: fix GPIO descriptor leak on register failure
• regulator: fixed: use dev_err_probe for register
• Bluetooth: L2CAP: export l2cap_chan_hold for modules
• net_sched: limit try_bulk_dequeue_skb() batches
• net_sched: remove need_resched() from qdisc_run()
• net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
• net/mlx5e: Fix maxrate wraparound in threshold between units
• net: sched: act_ife: initialize struct tc_ife to fix KMSAN…

• ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}
• tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}
• mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681}
• cpuset: fix warning when disabling remote partition {CVE-2025-71142}
• virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}
• netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126}
• atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460}
• idpf: fix error handling in the init_task on load {CVE-2026-23017}
• rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}
• block: zero non-PI portion of auto integrity buffer {CVE-2026-23007}
• can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}
• virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}
• net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}
• gfs2: Validate i_depth for exhash directories {CVE-2025-38710}
• KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
• ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}
• RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}
• RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
• scsi: qla2xxx: Validate sp before freeing associated memory {CVE-2025-71236}
• net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770}
• drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656}
• iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}
• net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}
• can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}
• Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
• ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003}
• drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
• mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}
• lib/buildid: use __kernel_read() for sleepable context {CVE-2026-23002}
• scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• irqchip/imx-irqsteer: Handle runtime power management correctly {CVE-2024-42290}
• io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop {CVE-2026-23113}
• net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
• net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• net: USB: Fix wrong-direction WARNING in plusb.c {CVE-2023-52742}
• module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521}
• udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
• net/mlx5: qos: Restrict RTNL area to avoid a lock cycle {CVE-2025-39947}
• scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• nfsd: check that server is running in unlock_filesystem {CVE-2026-22989}
• af_key: validate families in pfkey_send_migrate() {CVE-2026-31515}
• netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286} -…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-90413
  • IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• CVE-2026-53062
  • dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
  • dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
• CVE-2026-64237
  • Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
  • Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• CVE-2026-64109
  • af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2025-38512
  • wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2026-22980
  • nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-37885
  • KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2023-53039
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• CVE-2019-12456
  • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
• CVE-2024-46812
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• CVE-2026-31761
  • iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
• CVE-2026-53120
  • PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2026-31527
  • driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-23268
  • apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2025-21812
  • ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
• CVE-2026-46266
  • inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-53355
  • net: rds: clear i_sends on setup unwind {CVE-2026-53355}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2023-52922
  • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-90413
  • IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• CVE-2026-53062
  • dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
  • dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
• CVE-2026-64237
  • Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
  • Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• CVE-2026-64109
  • af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2025-38512
  • wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2026-22980
  • nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-37885
  • KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2023-53039
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• CVE-2019-12456
  • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
• CVE-2024-46812
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• CVE-2026-31761
  • iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
• CVE-2026-53120
  • PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2026-31527
  • driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-23268
  • apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2025-21812
  • ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
• CVE-2026-46266
  • inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-53355
  • net: rds: clear i_sends on setup unwind {CVE-2026-53355}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2023-52922
  • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2025-39827
  • net: rose: include node references in rose_neigh refcount {CVE-2025-39827}
• CVE-2026-93140
  • udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
• CVE-2026-90112
  • net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112}
• CVE-2026-90237
  • netfilter: nft_ct: move custom expectation support to helper {CVE-2026-90237}
• CVE-2026-93051
  • misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051}
• CVE-2026-90379
  • wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash {CVE-2026-90379}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90383
  • misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-93047
  • drm/v3d: Associate BOs with every job that accesses them {CVE-2026-93047}
• CVE-2026-93192
  • drm/v3d: Clear queue->active_job when v3d_fence_create() fails {CVE-2026-93192}
• CVE-2026-93050
  • ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove {CVE-2026-93050}
• CVE-2026-90311
  • thermal: hwmon: Remove hwmon class device along with its parent {CVE-2026-90311}
• CVE-2026-93191
  • smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191}
• CVE-2026-93042
  • dmaengine: dw-edma: Terminate all descriptors without callbacks {CVE-2026-93042}
• CVE-2026-93056
  • usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056}
• CVE-2026-93203
  • batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203}
• CVE-2026-93204
  • batman-adv: dat: atomically update mac addresses {CVE-2026-93204}
• CVE-2026-90000
  • HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-93202
  • i3c: master: Fix recursive locking during device registration {CVE-2026-93202}
• CVE-2026-90347
  • arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry {CVE-2026-90347}
• CVE-2026-90267
  • scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
• CVE-2026-92500
  • ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500}
• CVE-2026-93196
  • nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196}
• CVE-2026-90207
  • ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207}
• CVE-2026-90307
  • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
• CVE-2026-90110
  • inetpeer: randomize RB-tree node comparison using SipHash {CVE-2026-90110}
• CVE-2026-90293
  • IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
• CVE-2026-89838
  • f2fs: limit recovery filename logging to stored length {CVE-2026-89838}
• CVE-2026-93177
  • drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177}
• CVE-2026-89823
  • drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
• CVE-2026-90041
  • HID: sony: clean up device list on probe failure {CVE-2026-90041}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-93095 -…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2025-38068
  • crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• CVE-2024-56570
  • ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570}
• CVE-2025-21753
  • btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• CVE-2026-46116
  • xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}
• CVE-2022-49811
  • drbd: use after free in drbd_create_device() {CVE-2022-49811}
• CVE-2022-49059
  • nfc: nci: add flush_workqueue to prevent uaf {CVE-2022-49059}
• CVE-2025-22004
  • net: atm: fix use after free in lec_send() {CVE-2025-22004}
• CVE-2025-21764
  • ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
• CVE-2025-21762
  • arp: use RCU protection in arp_xmit() {CVE-2025-21762}
• CVE-2026-52934
  • batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934}
• CVE-2026-46090
  • ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090}
• CVE-2026-53131
  • netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• CVE-2026-53091
  • net: pull headers in qdisc_pkt_len_init() {CVE-2026-53091}
• CVE-2026-52986
  • netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986}
• CVE-2025-71116
  • libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• CVE-2026-43493
  • crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• CVE-2026-31597
  • ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}
• CVE-2026-43116
  • netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• CVE-2026-43458
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
• CVE-2026-53002
  • netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
• CVE-2026-46212
  • batman-adv: bla: prevent use-after-free when deleting claims {CVE-2026-46212}
• CVE-2026-31787
  • xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• CVE-2023-53357
  • md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2026-43076
  • ocfs2: validate inline data i_size during inode read {CVE-2026-43076}
• CVE-2025-38464
  • tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2026-43279
  • ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• CVE-2024-36013
  • Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• CVE-2026-46270
  • power: supply: rt9455: Fix use-after-free in power_supply_changed() {CVE-2026-46270}
• CVE-2026-46259
  • procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• CVE-2026-52998
  • netfilter: xt_osf: fix potential NULL…

• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• kabi: add tcp_v4_syn_recv_sock to the x86_64 kABI whitelist {CVE-2026-43198}
• Update to kernel 3.10.0-1160.164.1.el7
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• netfilter: expect: fix crash when putting uninited expectation {CVE-2026-43116}
• netfilter: nf_ct_expect: Add nf_ct_remove_expect() {CVE-2026-43116}
• Revert "netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}"
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• i2c: stub: Avoid an array overrun on I2C block transfers {CVE-2026-64191}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
• netfilter: nft_rbtree: ignore inactive matching element with no descendants
• netfilter: nft_rbtree: introduce nft_rbtree_interval_end() helper
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• netfilter: conntrack: check netns when walking expect hash
• netfilter: nf_tables: don't skip expired elements during walk {CVE-2023-52924}
• net: atm: fix crash due to unvalidated vcc pointer in sigd_send() {CVE-2026-31411}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
• ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• macsec: don't read an unset MAC header in macsec_encrypt() {CVE-2026-72019}
• dm-ioctl: fix a possible overflow in list_version_get_info {CVE-2026-72106}
• drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() {CVE-2026-68111}
• drm/amdgpu: fix division by zero with invalid uvd dimensions {CVE-2026-68106}
• driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
• net: tun: bound receive headroom {CVE-2026-81000}
• cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372}
• wifi: rt2x00: avoid full teardown before work setup in probe {CVE-2026-72005}
• ipvs: reset full ip_vs_seq structs in ip_vs_conn_new {CVE-2026-72020}
• scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083}
• bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() {CVE-2026-72039}
• net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked {CVE-2026-72036}
• vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets {CVE-2026-68299}
• drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234}
• tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}
• media: pci: dm1105: Free allocated workqueue {CVE-2026-68218}
• IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
• bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• tcp: keep kABI of tcp_v4_syn_recv_sock() for the CVE-2026-43198 fix
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}

• md/raid1,raid10: strip REQ_NOWAIT from member bios {CVE-2025-22125}
• md/raid1: fix data lost for writemostly rdev {CVE-2025-22125}
• md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT {CVE-2025-22125}
• md/raid1,raid10: don't ignore IO flags {CVE-2025-22125}
• net/sched: netem: fix queue limit check to include reordered packets {CVE-2026-52984}
• netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() {CVE-2025-21703}
• net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770}
• drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818}
• drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46199}
• drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199}
• drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46230}
• drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230}
• vhost: Allow null msg.size on VHOST_IOTLB_INVALIDATE {CVE-2022-48862}
• vhost: handle error while adding split ranges to iotlb {CVE-2022-48862}
• vhost: allow batching hint without size {CVE-2022-48862}
• vhost: fix hung thread due to erroneous iotlb entries {CVE-2022-48862}
• md raid: fix hang when stopping arrays with metadata through dm-raid {CVE-2026-43309}
• dm raid: use proper md_ro_state enumerators {CVE-2026-43309}
• i40e: When removing VF MAC filters, only check PF-set MAC {CVE-2024-26830}
• i40e: Fix VF MAC filter removal {CVE-2024-26830}
• i40e: Do not allow untrusted VF to remove administratively set MAC {CVE-2024-26830}
• netlink: make sure we allow at least one dump skb {CVE-2025-38465}
• netlink: avoid infinite retry looping in netlink_unicast() {CVE-2025-38465}
• netlink: Fix rmem check in netlink_broadcast_deliver(). {CVE-2025-38465}
• netlink: Fix wraparounds of sk->sk_rmem_alloc. {CVE-2025-38465}
• ipv6: fix possible infinite loop in rt6_fill_node() {CVE-2024-56703}
• ipv6: prevent infinite loop in rt6_nlmsg_size() {CVE-2024-56703}
• ipv6: Fix soft lockups in fib6_select_path under high next hop churn {CVE-2024-56703}
• qede: fix out-of-bounds check for cqe->len_list[] {CVE-2025-40252}
• net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() {CVE-2025-40252}
• scsi: lpfc: apply the HBA_SETUP dev_loss check to SLI4 only {CVE-2024-49891}
• scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths {CVE-2024-49891}
• ext4: fix string copying in parse_apply_sb_mount_options() {CVE-2025-71123}
• ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() {CVE-2025-40198}
• openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-31678}
• openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678}
• blk-iolatency: Fix memory leak on add_disk() failures {CVE-2022-50550}
• drm/vkms: Fix use after free and double free on init error {CVE-2025-22097}
• iommu/amd: move wait_on_sem() out of spinlock {CVE-2026-43253}
• fbdev: bitblit: bound-check glyph index in bit_cursor() {CVE-2026-74635}
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page {CVE-2026-80726}
• wifi: nl80211: reject beacons with bad HE operation {CVE-2026-97517}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() {CVE-2026-98374}
• ALSA: usb-audio: Fix a DMA to stack memory bug {CVE-2024-53197}
• ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices {CVE-2024-53197}
• USB: core: Limit the length of unkillable synchronous timeouts {CVE-2026-43428}
• ext4: refresh inline data size before write operations {CVE-2025-68264}
• net, bpf: check master for NULL in xdp_master_redirect() {CVE-2026-64545}
• iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() {CVE-2026-31505}
• dm cache: fix…

• drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
• ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
• netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487}
• nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
• RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
• nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
• ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
• netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
• tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
• sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
• bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
• mpls: reload header after pskb_may_pull() {CVE-2026-89555}
• net: tun: bound receive headroom {CVE-2026-81000}
• netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• firewire: net: remove unused variable 'guid' {CVE-2023-53432}
• gfs2: Fix slab-use-after-free in gfs2_qd_dealloc {CVE-2023-52760}
• gfs2: fix kernel…

• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• kabi: add tcp_v4_syn_recv_sock to the x86_64 kABI whitelist {CVE-2026-43198}
• Update to kernel 3.10.0-1160.164.1.el7
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• netfilter: expect: fix crash when putting uninited expectation {CVE-2026-43116}
• netfilter: nf_ct_expect: Add nf_ct_remove_expect() {CVE-2026-43116}
• Revert "netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}"
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• i2c: stub: Avoid an array overrun on I2C block transfers {CVE-2026-64191}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
• netfilter: nft_rbtree: ignore inactive matching element with no descendants
• netfilter: nft_rbtree: introduce nft_rbtree_interval_end() helper
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• netfilter: conntrack: check netns when walking expect hash
• netfilter: nf_tables: don't skip expired elements during walk {CVE-2023-52924}
• net: atm: fix crash due to unvalidated vcc pointer in sigd_send() {CVE-2026-31411}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
• ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• macsec: don't read an unset MAC header in macsec_encrypt() {CVE-2026-72019}
• dm-ioctl: fix a possible overflow in list_version_get_info {CVE-2026-72106}
• drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() {CVE-2026-68111}
• drm/amdgpu: fix division by zero with invalid uvd dimensions {CVE-2026-68106}
• driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
• net: tun: bound receive headroom {CVE-2026-81000}
• cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372}
• wifi: rt2x00: avoid full teardown before work setup in probe {CVE-2026-72005}
• ipvs: reset full ip_vs_seq structs in ip_vs_conn_new {CVE-2026-72020}
• scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083}
• bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() {CVE-2026-72039}
• net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked {CVE-2026-72036}
• vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets {CVE-2026-68299}
• drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234}
• tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}
• media: pci: dm1105: Free allocated workqueue {CVE-2026-68218}
• IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
• bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• tcp: keep kABI of tcp_v4_syn_recv_sock() for the CVE-2026-43198 fix
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}

• ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF {CVE-2023-0266}
• net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• kabi: add tcp_v4_syn_recv_sock to the x86_64 kABI whitelist {CVE-2026-43198}
• Update to kernel 3.10.0-1160.164.1.el7
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• netfilter: expect: fix crash when putting uninited expectation {CVE-2026-43116}
• netfilter: nf_ct_expect: Add nf_ct_remove_expect() {CVE-2026-43116}
• Revert "netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}"
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• i2c: stub: Avoid an array overrun on I2C block transfers {CVE-2026-64191}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
• netfilter: nft_rbtree: ignore inactive matching element with no descendants
• netfilter: nft_rbtree: introduce nft_rbtree_interval_end() helper
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• netfilter: conntrack: check netns when walking expect hash
• netfilter: nf_tables: don't skip expired elements during walk {CVE-2023-52924}
• net: atm: fix crash due to unvalidated vcc pointer in sigd_send() {CVE-2026-31411}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
• ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• macsec: don't read an unset MAC header in macsec_encrypt() {CVE-2026-72019}
• dm-ioctl: fix a possible overflow in list_version_get_info {CVE-2026-72106}
• drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() {CVE-2026-68111}
• drm/amdgpu: fix division by zero with invalid uvd dimensions {CVE-2026-68106}
• driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
• net: tun: bound receive headroom {CVE-2026-81000}
• cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372}
• wifi: rt2x00: avoid full teardown before work setup in probe {CVE-2026-72005}
• ipvs: reset full ip_vs_seq structs in ip_vs_conn_new {CVE-2026-72020}
• scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083}
• bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() {CVE-2026-72039}
• net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked {CVE-2026-72036}
• vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets {CVE-2026-68299}
• drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234}
• tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}
• media: pci: dm1105: Free allocated workqueue {CVE-2026-68218}
• IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
• bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• tcp: keep kABI of tcp_v4_syn_recv_sock() for the CVE-2026-43198 fix
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}