CVE-2026-64032

bridge: mcast: Fix a possible use-after-free when removing a bridge port

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

bridge: mcast: Fix a possible use-after-free when removing a bridge port

When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each port and enables the per-{port, VLAN} multicast contexts instead. The reverse happens when per-VLAN multicast snooping is disabled.

When global multicast snooping is enabled, the bridge iterates over all the bridge ports and enables the per-port multicast context on each port. The reverse happens when multicast snooping is disabled.

The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port:

ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1

ip link add name dummy1 up master br1 type dummy

ip link set dev br1 type bridge mcast_vlan_snooping 1

ip link set dev br1 type bridge mcast_snooping 0

ip link set dev br1 type bridge mcast_snooping 1

This is not intended and it is a problem since the commit cited below. Prior to this commit, when removing a bridge port, br_multicast_disable_port() would disable the per-port multicast context and the per-{port, VLAN} multicast contexts would get disabled when flushing VLANs.

After this commit, br_multicast_disable_port() only disables the per-port multicast context if per-VLAN multicast snooping is disabled. If both types of contexts were enabled on the port when it was removed, the per-port multicast context would remain enabled when freeing the bridge port, leading to a use-after-free [1].

Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled.

[1] ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927) WARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0 [...] Call Trace: <IRQ> __debug_check_no_obj_freed (lib/debugobjects.c:1116) kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565) kobject_cleanup (lib/kobject.c:689) rcu_do_batch (kernel/rcu/tree.c:2617) rcu_core (kernel/rcu/tree.c:2869) handle_softirqs (kernel/softirq.c:622) __irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735) irq_exit_rcu (kernel/softirq.c:752) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47)) </IRQ>

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.13%Unchanged since Jul 20, 2026

What each source reports

CVE List Score used 7.8

bridge: mcast: Fix a possible use-after-free when removing a bridge port

In the Linux kernel, the following vulnerability has been resolved:

bridge: mcast: Fix a possible use-after-free when removing a bridge port

The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port:

ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1

ip link add name dummy1 up master br1 type dummy

ip link set dev br1 type bridge mcast_vlan_snooping 1

ip link set dev br1 type bridge mcast_snooping 0

ip link set dev br1 type bridge mcast_snooping 1

Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled.

Record: CVE-2026-64032
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2026-45605 7.8

In the Linux kernel, the following vulnerability has been resolved:

bridge: mcast: Fix a possible use-after-free when removing a bridge port

The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port:

ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1

ip link add name dummy1 up master br1 type dummy

ip link set dev br1 type bridge mcast_vlan_snooping 1

ip link set dev br1 type bridge mcast_snooping 0

ip link set dev br1 type bridge mcast_snooping 1

Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled.

Record: EUVD-2026-45605
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qpwr-692j-qmg9 7.8

In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a...

In the Linux kernel, the following vulnerability has been resolved:

bridge: mcast: Fix a possible use-after-free when removing a bridge port

The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port:

ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1

ip link add name dummy1 up master br1 type dummy

ip link set dev br1 type bridge mcast_vlan_snooping 1

ip link set dev br1 type bridge mcast_snooping 0

ip link set dev br1 type bridge mcast_snooping 1

Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled.

Record: GHSA-qpwr-692j-qmg9
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

bridge: mcast: Fix a possible use-after-free when removing a bridge port

The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port:

ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1

ip link add name dummy1 up master br1 type dummy

ip link set dev br1 type bridge mcast_vlan_snooping 1

ip link set dev br1 type bridge mcast_snooping 0

ip link set dev br1 type bridge mcast_snooping 1

Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled.

Record: CVE-2026-64032
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVBELL-CVE-2026-64032 7.8

Record: BELL-CVE-2026-64032
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

bridge: mcast: Fix a possible use-after-free when removing a bridge port

In the Linux kernel, the following vulnerability has been resolved:

bridge: mcast: Fix a possible use-after-free when removing a bridge port

The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port:

ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1

ip link add name dummy1 up master br1 type dummy

ip link set dev br1 type bridge mcast_vlan_snooping 1

ip link set dev br1 type bridge mcast_snooping 0

ip link set dev br1 type bridge mcast_snooping 1

Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled.

Record: CVE-2026-64032
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 40 moreShow less

OSVDEBIAN-CVE-2026-64032 7.8

In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each port and enables the per-{port, VLAN} multicast contexts instead. The reverse happens when per-VLAN multicast snooping is disabled. When global multicast snooping is enabled, the bridge iterates over all the bridge ports and enables the per-port multicast context on each port. The reverse happens when multicast snooping is disabled. The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port: # ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1 # ip link add name dummy1 up master br1 type dummy # ip link set dev br1 type bridge mcast_vlan_snooping 1 # ip link set dev br1 type bridge mcast_snooping 0 # ip link set dev br1 type bridge mcast_snooping 1 This is not intended and it is a problem since the commit cited below. Prior to this commit, when removing a bridge port, br_multicast_disable_port() would disable the per-port multicast context and the per-{port, VLAN} multicast contexts would get disabled when flushing VLANs. After this commit, br_multicast_disable_port() only disables the per-port multicast context if per-VLAN multicast snooping is disabled. If both types of contexts were enabled on the port when it was removed, the per-port multicast context would remain enabled when freeing the bridge port, leading to a use-after-free [1]. Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled. [1] ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927) WARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0 [...] Call Trace: <IRQ> __debug_check_no_obj_freed (lib/debugobjects.c:1116) kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565) kobject_cleanup (lib/kobject.c:689) rcu_do_batch (kernel/rcu/tree.c:2617) rcu_core (kernel/rcu/tree.c:2869) handle_softirqs (kernel/softirq.c:622) __irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735) irq_exit_rcu (kernel/softirq.c:752) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47)) </IRQ>

Record: DEBIAN-CVE-2026-64032
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-3704 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: add VLAN id validation before using

Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause out-of-bounds memory access once the VLAN id is bigger than or equal to VLAN_N_VID.

Therefore, VLAN id needs to be checked to ensure it is within the range of VLAN_N_VID.(CVE-2025-71112)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix string copying in parse_apply_sb_mount_options()

strscpy_pad() can't be used to copy a non-NUL-term string into a NUL-term string of possibly bigger size. Commit 0efc5990bca5 ("string.h: Introduce memtostr() and memtostr_pad()") provides additional information in that regard. So if this happens, the following warning is observed:

strnlen: detected buffer overflow: 65 byte read of buffer size 64 WARNING: CPU: 0 PID: 28655 at lib/string_helpers.c:1032 __fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Modules linked in: CPU: 0 UID: 0 PID: 28655 Comm: syz-executor.3 Not tainted 6.12.54-syzkaller-00144-g5f0270f1ba00 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Call Trace: <TASK> __fortify_panic+0x1f/0x30 lib/string_helpers.c:1039 strnlen include/linux/fortify-string.h:235 [inline] sized_strscpy include/linux/fortify-string.h:309 [inline] parse_apply_sb_mount_options fs/ext4/super.c:2504 [inline] __ext4_fill_super fs/ext4/super.c:5261 [inline] ext4_fill_super+0x3c35/0xad00 fs/ext4/super.c:5706 get_tree_bdev_flags+0x387/0x620 fs/super.c:1636 vfs_get_tree+0x93/0x380 fs/super.c:1814 do_new_mount fs/namespace.c:3553 [inline] path_mount+0x6ae/0x1f70 fs/namespace.c:3880 do_mount fs/namespace.c:3893 [inline] __do_sys_mount fs/namespace.c:4103 [inline] __se_sys_mount fs/namespace.c:4080 [inline] __x64_sys_mount+0x280/0x300 fs/namespace.c:4080 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x64/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Since userspace is expected to provide s_mount_opts field to be at most 63 characters long with the ending byte being NUL-term, use a 64-byte buffer which matches the size of s_mount_opts, so that strscpy_pad() does its job properly. Return with error if the user still managed to provide a non-NUL-term string here.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-71123)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/umad: Reject negative data_len in ib_umad_write

ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list().

Add an explicit check to reject negative data_len before creating the send buffer.

KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80(CVE-2026-23243)

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix memory allocation in nvme_pr_read_keys()

nvme_pr_read_keys() takes num_keys from userspace and uses it to calculate the allocation size for rse via struct_size(). The upper limit is PR_KEYS_MAX (64K).

A malicious or buggy userspace can pass a large num_keys value that results in a 4MB allocation attempt at most, causing a warning in the page allocator when the order exceeds…

Record: OESA-2026-3704
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:83207 8.1

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2026:83207
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:83207 8.1

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)
kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)
kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)
kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Bug Fix(es) and Enhancement(s):

cannot use VFs of i40e/ice NIC in bond device (JIRA:Rocky Linux-143410)
ionic: commit backported to 9.8 missing in 10.2 (JIRA:Rocky Linux-165657)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:83207
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:86033 8.8

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)
kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)
kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)
kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)
kernel: Linux kernel: Denial of Service due to incorrect GSO state handling in network fragment reassembly (CVE-2026-80590)
kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()
kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)
kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999)

Bug Fix(es) and Enhancement(s):

Batch: z-stream xfrm - rhel-9.8.z (NST-Core-26W38) (JIRA:Rocky Linux-256697)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:86033
CVSS 3.1: 8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-64032 7.3

Record: UBUNTU-CVE-2026-64032
CVSS 4.0: 7.3 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVALSA-2026:83207 No score

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)
kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)
kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)
kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Bug Fix(es) and Enhancement(s):

cannot use VFs of i40e/ice NIC in bond device (JIRA:AlmaLinux-143410)
ionic: commit backported to 9.8 missing in 10.2 (JIRA:AlmaLinux-165657)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:83207
Updated: 2026-11-02

OSVALSA-2026:86033 No score

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)
kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)
kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)
kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)
kernel: Linux kernel: Denial of Service due to incorrect GSO state handling in network fragment reassembly (CVE-2026-80590)
kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()
kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)
kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999)

Bug Fix(es) and Enhancement(s):

Batch: z-stream xfrm - almalinux-9.8.z (NST-Core-26W38) (JIRA:AlmaLinux-256697)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:86033
Updated: 2026-11-06

OSVUSN-8575-1 No score

linux, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-realtime, linux-xilinx-zynqmp vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)