CVE-2026-72129

nvmet-rdma: handle inline data with a nonzero offset

9.8 CriticalFix available

In the Linux kernel, the following vulnerability has been resolved:

nvmet-rdma: handle inline data with a nonzero offset

nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page:

sg->offset = off;
sg->length = min_t(int, len, PAGE_SIZE - off);

When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist.

Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.71%Up 0.5 points since Aug 15, 2026

What each source reports

CVE List Score used 9.8

nvmet-rdma: handle inline data with a nonzero offset

In the Linux kernel, the following vulnerability has been resolved:

nvmet-rdma: handle inline data with a nonzero offset

sg->offset = off;
sg->length = min_t(int, len, PAGE_SIZE - off);

Record: CVE-2026-72129
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2026-58887 9.8

In the Linux kernel, the following vulnerability has been resolved:

nvmet-rdma: handle inline data with a nonzero offset

sg->offset = off;
sg->length = min_t(int, len, PAGE_SIZE - off);

Record: EUVD-2026-58887
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xp9m-f2x6-j3rp 9.8

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline...

In the Linux kernel, the following vulnerability has been resolved:

nvmet-rdma: handle inline data with a nonzero offset

sg->offset = off;
sg->length = min_t(int, len, PAGE_SIZE - off);

Record: GHSA-xp9m-f2x6-j3rp
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

NVD 9.8

In the Linux kernel, the following vulnerability has been resolved:

nvmet-rdma: handle inline data with a nonzero offset

sg->offset = off;
sg->length = min_t(int, len, PAGE_SIZE - off);

Record: CVE-2026-72129
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-72129 9.8

Record: BELL-CVE-2026-72129
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 9.8

nvmet-rdma: handle inline data with a nonzero offset

In the Linux kernel, the following vulnerability has been resolved:

nvmet-rdma: handle inline data with a nonzero offset

sg->offset = off;
sg->length = min_t(int, len, PAGE_SIZE - off);

Record: CVE-2026-72129
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 48 moreShow less

OSVDEBIAN-CVE-2026-72129 9.8

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len <= inline_data_size, but the mapping still assumes the data begins in the first inline page: sg->offset = off; sg->length = min_t(int, len, PAGE_SIZE - off); When a port is configured with inline_data_size > PAGE_SIZE (settable up to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size] makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and the block backend reads far past the first inline page. num_pages(len) also ignores the offset, so an in-bounds offset whose [off, off+len) span crosses a page boundary under-counts the scatterlist. Map the offset properly: split it into a page index and an in-page offset, start the scatterlist at that page, and size the page count from page_off + len. Because the request scatterlist may now start at inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL identity test in nvmet_rdma_release_rsp() to a range test; otherwise the persistent inline scatterlist is mistaken for an allocated one and nvmet_req_free_sgls() frees an inline page (and warns in free_large_kmalloc()).

Record: DEBIAN-CVE-2026-72129
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-3703 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: Fix sc7280 lpass potential buffer overflow

Case values introduced in commit 5f78e1fb7a3e ("ASoC: qcom: Add driver support for audioreach solution") cause out of bounds access in arrays of sc7280 driver data (e.g. in case of RX_CODEC_DMA_RX_0 in sc7280_snd_hw_params()).

Redefine LPASS_MAX_PORTS to consider the maximum possible port id for q6dsp as sc7280 driver utilizes some of those values.

Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37979)

In the Linux kernel, the following vulnerability has been resolved:

net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization

Syzbot reported shift-out-of-bounds exception on MDIO bus initialization.

The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations.

Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.(CVE-2025-38736)

In the Linux kernel, the following vulnerability has been resolved:

crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl

When page reassignment was added to af_alg_pull_tsgl the original loop wasn't updated so it may try to reassign one more page than necessary.

Add the check to the reassignment so that this does not happen.

Also update the comment which still refers to the obsolete offset argument.(CVE-2026-43078)

In the Linux kernel, the following vulnerability has been resolved:

crypto: algif_aead - snapshot IV for async AEAD requests

AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during request processing. For async requests, later socket activity can update that shared state before the original request has fully completed, which can lead to inconsistent IV handling.

Snapshot the IV into per-request storage when preparing the AEAD request, so in-flight operations no longer depend on mutable socket state.(CVE-2026-46028)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: esp: restore combined single-frag length gate

The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len.

Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb_page_frag_refill() may fall back to a single page while the destination sg still spans the combined skb->data_len.

Restore this combined-length page gate for both IPv4 and IPv6.(CVE-2026-63912)

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation. __ip_vs_get_out_rt() calls skb_ensure_writable() which may reallocate skb->head, causing the previously obtained IP header pointer to become a dangling pointer, leading to a use-after-free vulnerability.(CVE-2026-68476)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: fix more places with wrong ipv6 transport offsets

Sashiko reports for more incorrect IPv6 transport offsets.

The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause problems with apps over IPv6. As for the only official app in the kernel tree (FTP) this problem is harmless because we use Netfilter to mangle the FTP ports and we do not adjust the TCP seq numbers.

Also, provide correct offset of the ICMPV6 header in ip_vs_out_icmp_v6() for correct checksum checks when the IPv6 packet has extension headers.(CVE-2026-68477)

In the Linux kernel, the following vulnerability has been resolved:

ipvs: use parsed transport offset in SCTP state lookup …

Record: OESA-2026-3703
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-3704 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: add VLAN id validation before using

Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause out-of-bounds memory access once the VLAN id is bigger than or equal to VLAN_N_VID.

Therefore, VLAN id needs to be checked to ensure it is within the range of VLAN_N_VID.(CVE-2025-71112)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix string copying in parse_apply_sb_mount_options()

strscpy_pad() can't be used to copy a non-NUL-term string into a NUL-term string of possibly bigger size. Commit 0efc5990bca5 ("string.h: Introduce memtostr() and memtostr_pad()") provides additional information in that regard. So if this happens, the following warning is observed:

strnlen: detected buffer overflow: 65 byte read of buffer size 64 WARNING: CPU: 0 PID: 28655 at lib/string_helpers.c:1032 __fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Modules linked in: CPU: 0 UID: 0 PID: 28655 Comm: syz-executor.3 Not tainted 6.12.54-syzkaller-00144-g5f0270f1ba00 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Call Trace: <TASK> __fortify_panic+0x1f/0x30 lib/string_helpers.c:1039 strnlen include/linux/fortify-string.h:235 [inline] sized_strscpy include/linux/fortify-string.h:309 [inline] parse_apply_sb_mount_options fs/ext4/super.c:2504 [inline] __ext4_fill_super fs/ext4/super.c:5261 [inline] ext4_fill_super+0x3c35/0xad00 fs/ext4/super.c:5706 get_tree_bdev_flags+0x387/0x620 fs/super.c:1636 vfs_get_tree+0x93/0x380 fs/super.c:1814 do_new_mount fs/namespace.c:3553 [inline] path_mount+0x6ae/0x1f70 fs/namespace.c:3880 do_mount fs/namespace.c:3893 [inline] __do_sys_mount fs/namespace.c:4103 [inline] __se_sys_mount fs/namespace.c:4080 [inline] __x64_sys_mount+0x280/0x300 fs/namespace.c:4080 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x64/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Since userspace is expected to provide s_mount_opts field to be at most 63 characters long with the ending byte being NUL-term, use a 64-byte buffer which matches the size of s_mount_opts, so that strscpy_pad() does its job properly. Return with error if the user still managed to provide a non-NUL-term string here.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-71123)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/umad: Reject negative data_len in ib_umad_write

ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list().

Add an explicit check to reject negative data_len before creating the send buffer.

KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80(CVE-2026-23243)

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix memory allocation in nvme_pr_read_keys()

nvme_pr_read_keys() takes num_keys from userspace and uses it to calculate the allocation size for rse via struct_size(). The upper limit is PR_KEYS_MAX (64K).

A malicious or buggy userspace can pass a large num_keys value that results in a 4MB allocation attempt at most, causing a warning in the page allocator when the order exceeds…

Record: OESA-2026-3704
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:64770 8.1

Red Hat Security Advisory: kernel-rt security update

Record: RHSA-2026:64770
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:65334 8.1

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2026:65334
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:66000 8.1

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:66000
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:66180 8.1

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2026:66180
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:79778 8.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:79778
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:64770 8.1

Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:64770
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:65334 8.1

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)
kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)
kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)
kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)
kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)
kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)
kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)
kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)
kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)
kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)
kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)
kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)
kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)
kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)
kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)
kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)
kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)
kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)
kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)
kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051)
kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)
kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)
kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307)
kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193)
kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)
kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)

Bug Fix(es) and Enhancement(s):

rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [rhel-10.2.z] (JIRA:Rocky Linux-193027)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:65334
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:66180 8.1

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)
kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)
kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366)
kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)
kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)
kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

Bug Fix(es) and Enhancement(s):

KSM to deduplicate only zero pages [rhel-9.8.z] (JIRA:Rocky Linux-249161)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:66180
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-72129 9.8

Record: UBUNTU-CVE-2026-72129
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVALSA-2026:64770 No score

Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:64770
Updated: 2026-11-02

OSVALSA-2026:65334 No score

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)
kernel: Bluetooth: virtio_bt: clamp rx length before skb_put (CVE-2026-46123)
kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)
kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)
kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072)
kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)
kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)
kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)
kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209)
kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
kernel: vfio/pci: Clean up DMABUFs before disabling function (CVE-2026-53322)
kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)
kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)
kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)
kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944)
kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946)
kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)
kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037)
kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)
kernel: vfio/pci: Check BAR resources before exporting a DMABUF (CVE-2026-64042)
kernel: accel/qaic: Add overflow check to remap_pfn_range during mmap (CVE-2026-64051)
kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255)
kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515)
kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
kernel: wifi: mt76: mt7925: fix crash in reset link replay (CVE-2026-68307)
kernel: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (CVE-2026-68193)
kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)
kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)

Bug Fix(es) and Enhancement(s):

rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [almalinux-10.2.z] (JIRA:AlmaLinux-193027)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:65334
Updated: 2026-11-02

OSVALSA-2026:66000 No score

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:66000
Updated: 2026-11-02

OSVALSA-2026:66180 No score

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)
kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)
kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366)
kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)
kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)
kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

Bug Fix(es) and Enhancement(s):

KSM to deduplicate only zero pages [almalinux-9.8.z] (JIRA:AlmaLinux-249161)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:66180
Updated: 2026-11-02

OSVCLSA-2026-1791132991 No score

Fix of 400 CVEs

CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2025-39827
- net: rose: include node references in rose_neigh refcount {CVE-2025-39827}
CVE-2026-93140
- udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
CVE-2026-90112
- net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112}
CVE-2026-90237
- netfilter: nft_ct: move custom expectation support to helper {CVE-2026-90237}
CVE-2026-93051
- misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051}
CVE-2026-90379
- wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash {CVE-2026-90379}
CVE-2026-90302
- ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
CVE-2026-90383
- misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
CVE-2026-90320
- ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
CVE-2026-93047
- drm/v3d: Associate BOs with every job that accesses them {CVE-2026-93047}
CVE-2026-93192
- drm/v3d: Clear queue->active_job when v3d_fence_create() fails {CVE-2026-93192}
CVE-2026-93050
- ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove {CVE-2026-93050}
CVE-2026-90311
- thermal: hwmon: Remove hwmon class device along with its parent {CVE-2026-90311}
CVE-2026-93191
- smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191}
CVE-2026-93042
- dmaengine: dw-edma: Terminate all descriptors without callbacks {CVE-2026-93042}
CVE-2026-93056
- usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056}
CVE-2026-93203
- batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203}
CVE-2026-93204
- batman-adv: dat: atomically update mac addresses {CVE-2026-93204}
CVE-2026-90000
- HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}
CVE-2026-90431
- remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
CVE-2026-93202
- i3c: master: Fix recursive locking during device registration {CVE-2026-93202}
CVE-2026-90347
- arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry {CVE-2026-90347}
CVE-2026-90267
- scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
CVE-2026-92500
- ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500}
CVE-2026-93196
- nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196}
CVE-2026-90207
- ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207}
CVE-2026-90307
- RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
CVE-2026-90110
- inetpeer: randomize RB-tree node comparison using SipHash {CVE-2026-90110}
CVE-2026-90293
- IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
CVE-2026-89838
- f2fs: limit recovery filename logging to stored length {CVE-2026-89838}
CVE-2026-93177
- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177}
CVE-2026-89823
- drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
CVE-2026-90041
- HID: sony: clean up device list on probe failure {CVE-2026-90041}
CVE-2026-90015
- xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
CVE-2026-93095 -…

Record: CLSA-2026-1791132991
Updated: 2026-11-02

OSVCLSA-2026-1791741836 No score

kernel: Fix of 127 CVEs

md/raid1,raid10: strip REQ_NOWAIT from member bios {CVE-2025-22125}
md/raid1: fix data lost for writemostly rdev {CVE-2025-22125}
md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT {CVE-2025-22125}
md/raid1,raid10: don't ignore IO flags {CVE-2025-22125}
net/sched: netem: fix queue limit check to include reordered packets {CVE-2026-52984}
netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() {CVE-2025-21703}
net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770}
drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818}
drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46199}
drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199}
drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46230}
drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230}
vhost: Allow null msg.size on VHOST_IOTLB_INVALIDATE {CVE-2022-48862}
vhost: handle error while adding split ranges to iotlb {CVE-2022-48862}
vhost: allow batching hint without size {CVE-2022-48862}
vhost: fix hung thread due to erroneous iotlb entries {CVE-2022-48862}
md raid: fix hang when stopping arrays with metadata through dm-raid {CVE-2026-43309}
dm raid: use proper md_ro_state enumerators {CVE-2026-43309}
i40e: When removing VF MAC filters, only check PF-set MAC {CVE-2024-26830}
i40e: Fix VF MAC filter removal {CVE-2024-26830}
i40e: Do not allow untrusted VF to remove administratively set MAC {CVE-2024-26830}
netlink: make sure we allow at least one dump skb {CVE-2025-38465}
netlink: avoid infinite retry looping in netlink_unicast() {CVE-2025-38465}
netlink: Fix rmem check in netlink_broadcast_deliver(). {CVE-2025-38465}
netlink: Fix wraparounds of sk->sk_rmem_alloc. {CVE-2025-38465}
ipv6: fix possible infinite loop in rt6_fill_node() {CVE-2024-56703}
ipv6: prevent infinite loop in rt6_nlmsg_size() {CVE-2024-56703}
ipv6: Fix soft lockups in fib6_select_path under high next hop churn {CVE-2024-56703}
qede: fix out-of-bounds check for cqe->len_list[] {CVE-2025-40252}
net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() {CVE-2025-40252}
scsi: lpfc: apply the HBA_SETUP dev_loss check to SLI4 only {CVE-2024-49891}
scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths {CVE-2024-49891}
ext4: fix string copying in parse_apply_sb_mount_options() {CVE-2025-71123}
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() {CVE-2025-40198}
openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-31678}
openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678}
blk-iolatency: Fix memory leak on add_disk() failures {CVE-2022-50550}
drm/vkms: Fix use after free and double free on init error {CVE-2025-22097}
iommu/amd: move wait_on_sem() out of spinlock {CVE-2026-43253}
fbdev: bitblit: bound-check glyph index in bit_cursor() {CVE-2026-74635}
KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page {CVE-2026-80726}
wifi: nl80211: reject beacons with bad HE operation {CVE-2026-97517}
sctp: prevent peer transport count overflow {CVE-2026-74469}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
sctp: validate embedded address parameter length {CVE-2026-74287}
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() {CVE-2026-98374}
ALSA: usb-audio: Fix a DMA to stack memory bug {CVE-2024-53197}
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices {CVE-2024-53197}
USB: core: Limit the length of unkillable synchronous timeouts {CVE-2026-43428}
ext4: refresh inline data size before write operations {CVE-2025-68264}
net, bpf: check master for NULL in xdp_master_redirect() {CVE-2026-64545}
iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() {CVE-2026-31505}
dm cache: fix…

Record: CLSA-2026-1791741836
Updated: 2026-11-02

OSVCLSA-2026-1791780738 No score

kernel: Fix of 72 CVEs

drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487}
nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
mpls: reload header after pskb_may_pull() {CVE-2026-89555}
net: tun: bound receive headroom {CVE-2026-81000}
netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
firewire: net: remove unused variable 'guid' {CVE-2023-53432}
gfs2: Fix slab-use-after-free in gfs2_qd_dealloc {CVE-2023-52760}
gfs2: fix kernel…

Record: CLSA-2026-1791780738
Updated: 2026-11-02

OSVCLSA-2026-1791852988 No score

kernel: Fix of 107 CVEs

netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
sctp: validate embedded address parameter length {CVE-2026-74287}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}
smb: client: reject overlapping data areas in SMB2 responses {CVE-2026-64257}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
crypto: qat - protect interrupt mask CSRs with a spinlock {CVE-2026-64438}
crypto: qat - remove intermediate tasklet for vf2pf {CVE-2026-64438}
usb: free iso schedules on failed submit {CVE-2026-64348}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
mpls: reload header after pskb_may_pull() {CVE-2026-89555}
net: tun: bound receive headroom {CVE-2026-81000}
bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
wifi: ath9k: hif_usb: don't dereference hif_dev after…

Record: CLSA-2026-1791852988
Updated: 2026-11-02

OSVCLSA-2026-1791858083 No score

kernel: Fix of 94 CVEs

netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
usb: free iso schedules on failed submit {CVE-2026-64348}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
net: tun: bound receive headroom {CVE-2026-81000}
bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
mpls: reload header after pskb_may_pull() {CVE-2026-89555}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet…

Record: CLSA-2026-1791858083
Updated: 2026-11-02

OSVCLSA-2026-1792234299 No score

kernel: Fix of 76 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
Squashfs: check block offset is not negative {CVE-2026-90203}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
dm array: validate array block headers on read {CVE-2026-89574}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
dmaengine: Fix possible use after free {CVE-2026-72476}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
sctp: validate embedded address parameter length {CVE-2026-74287}
netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
nvmet-rdma: handle inline…

Record: CLSA-2026-1792234299
Updated: 2026-11-02

OSVCLSA-2026-1792236238 No score

kernel: Fix of 74 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
Squashfs: check block offset is not negative {CVE-2026-90203}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
dm array: validate array block headers on read {CVE-2026-89574}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
dmaengine: Fix possible use after free {CVE-2026-72476}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
sctp: validate embedded address parameter length {CVE-2026-74287}
netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
nvmet-rdma: handle inline…

Record: CLSA-2026-1792236238
Updated: 2026-11-02

OSVCLSA-2026-1792236273 No score

kernel: Fix of 76 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
Squashfs: check block offset is not negative {CVE-2026-90203}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
dm array: validate array block headers on read {CVE-2026-89574}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
dmaengine: Fix possible use after free {CVE-2026-72476}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
sctp: validate embedded address parameter length {CVE-2026-74287}
netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
nvmet-rdma: handle inline…

Record: CLSA-2026-1792236273
Updated: 2026-11-02

OSVopenSUSE-SU-2026:22091-1 No score