CVE-2026-43038

In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and passed to icmp6_send(), it uses IP6CB(skb2). IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18. If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). This would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a fake TLV without checking if the remaining packet length can hold the full 18-byte struct ipv6_destopt_hao. Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the packet data into skb_shared_info? Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and ip6ip6_err() to prevent this? This patch implements the first suggestion. I am not sure if ip6ip6_err() needs to be changed. A separate patch would be better anyway.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

bcache: fix NULL pointer in cache_set_flush()

1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc().
2. LINE#2078 - LINE#2142 is some codes about function of register_cache_set().
3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098.

1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) 1795 { ... 1860 if (!(c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL)) || 1861 mempool_init_slab_pool(&c->search, 32, bch_search_cache) || 1862 mempool_init_kmalloc_pool(&c->bio_meta, 2, 1863 sizeof(struct bbio) + sizeof(struct bio_vec) * 1864 bucket_pages(c)) || 1865 mempool_init_kmalloc_pool(&c->fill_iter, 1, iter_size) || 1866 bioset_init(&c->bio_split, 4, offsetof(struct bbio, bio), 1867 BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) || 1868 !(c->uuids = alloc_bucket_pages(GFP_KERNEL, c)) || 1869 !(c->moving_gc_wq = alloc_workqueue("bcache_gc", 1870 WQ_MEM_RECLAIM, 0)) || 1871 bch_journal_alloc(c) || 1872 bch_btree_cache_alloc(c) || 1873 bch_open_buckets_alloc(c) || 1874 bch_bset_sort_state_init(&c->sort, ilog2(c->btree_pages))) 1875 goto err; ^^^^^^^^ 1876 ... 1883 return c; 1884 err: 1885 bch_cache_set_unregister(c); ^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1886 return NULL; 1887 } ... 2078 static const char *register_cache_set(struct cache *ca) 2079 { ... 2098 c = bch_cache_set_alloc(&ca->sb); 2099 if (!c) 2100 return err; ^^^^^^^^^^ ... 2128 ca->set = c; 2129 ca->set->cache[ca->sb.nr_this_dev] = ca; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ... 2138 return NULL; 2139 err: 2140 bch_cache_set_unregister(c); 2141 return err; 2142 }

(1) If LINE#1860 - LINE#1874 is true, then do 'goto err'(LINE#1875) and call bch_cache_set_unregister()(LINE#1885). (2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return. (3) As (2) has returned, LINE#2128 - LINE#2129 would do not give the value to c->cache[], it means that c->cache[] is NULL.

LINE#1624 - LINE#1665 is some codes about function of cache_set_flush(). As (1), in LINE#1885 call bch_cache_set_unregister() ---> bch_cache_set_stop() ---> closure_queue() -.-> cache_set_flush() (as below LINE#1624)

1624 static void cache_set_flush(struct closure *cl) 1625 { ... 1654 for_each_cache(ca, c, i) 1655 if (ca->alloc_thread) ^^ 1656 kthread_stop(ca->alloc_thread); ... 1665 }

(4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the kernel crash occurred as below: [ 846.712887] bcache: register_cache() error drbd6: cannot allocate memory [ 846.713242] bcache: register_bcache() error : failed to register device [ 846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered [ 846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8 [ 846.714790] PGD 0 P4D 0 [ 846.715129] Oops: 0000 [#1] SMP PTI [ 846.715472] CPU: 19 PID: 5057 Comm: kworker/19:16 Kdump: loaded Tainted: G OE --------- - - 4.18.0-147.5.1.el8_1.5es.3.x86_64 #1 [ 846.716082] Hardware name: ESPAN GI-25212/X11DPL-i, BIOS 2.1 06/15/2018 [ 846.716451] Workqueue: events cache_set_flush [bcache] [ 846.716808] RIP: 0010:cache_set_flush+0xc9/0x1b0 [bcache] […

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

iomap: Fix possible overflow condition in iomap_write_delalloc_scan

folio_next_index() returns an unsigned long value which left shifted by PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead use folio_pos(folio) + folio_size(folio), which does this correctly.(CVE-2023-54285)

In the Linux kernel, the following vulnerability has been resolved:

bcache: fix NULL pointer in cache_set_flush()

1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc().
2. LINE#2078 - LINE#2142 is some codes about function of register_cache_set().
3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098.

1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) 1795 { ... 1860 if (!(c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL)) || 1861 mempool_init_slab_pool(&c->search, 32, bch_search_cache) || 1862 mempool_init_kmalloc_pool(&c->bio_meta, 2, 1863 sizeof(struct bbio) + sizeof(struct bio_vec) * 1864 bucket_pages(c)) || 1865 mempool_init_kmalloc_pool(&c->fill_iter, 1, iter_size) || 1866 bioset_init(&c->bio_split, 4, offsetof(struct bbio, bio), 1867 BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) || 1868 !(c->uuids = alloc_bucket_pages(GFP_KERNEL, c)) || 1869 !(c->moving_gc_wq = alloc_workqueue("bcache_gc", 1870 WQ_MEM_RECLAIM, 0)) || 1871 bch_journal_alloc(c) || 1872 bch_btree_cache_alloc(c) || 1873 bch_open_buckets_alloc(c) || 1874 bch_bset_sort_state_init(&c->sort, ilog2(c->btree_pages))) 1875 goto err; ^^^^^^^^ 1876 ... 1883 return c; 1884 err: 1885 bch_cache_set_unregister(c); ^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1886 return NULL; 1887 } ... 2078 static const char *register_cache_set(struct cache *ca) 2079 { ... 2098 c = bch_cache_set_alloc(&ca->sb); 2099 if (!c) 2100 return err; ^^^^^^^^^^ ... 2128 ca->set = c; 2129 ca->set->cache[ca->sb.nr_this_dev] = ca; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ... 2138 return NULL; 2139 err: 2140 bch_cache_set_unregister(c); 2141 return err; 2142 }

(1) If LINE#1860 - LINE#1874 is true, then do 'goto err'(LINE#1875) and call bch_cache_set_unregister()(LINE#1885). (2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return. (3) As (2) has returned, LINE#2128 - LINE#2129 would do not give the value to c->cache[], it means that c->cache[] is NULL.

LINE#1624 - LINE#1665 is some codes about function of cache_set_flush(). As (1), in LINE#1885 call bch_cache_set_unregister() ---> bch_cache_set_stop() ---> closure_queue() -.-> cache_set_flush() (as below LINE#1624)

1624 static void cache_set_flush(struct closure *cl) 1625 { ... 1654 for_each_cache(ca, c, i) 1655 if (ca->alloc_thread) ^^ 1656 kthread_stop(ca->alloc_thread); ... 1665 }

(4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the kernel crash occurred as below: [ 846.712887] bcache: register_cache() error drbd6: cannot allocate memory [ 846.713242] bcache: register_bcache() error : failed to register device [ 846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered [ 846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8 [ 846.714790] PGD 0 P4D 0 [ 846.715129]…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gt: Fix timeline left held on VMA alloc error

The following error has been reported sporadically by CI when a test unbinds the i915 driver on a ring submission platform:

<4> [239.330153] ------------[ cut here ]------------ <4> [239.330166] i915 0000:00:02.0: [drm] drm_WARN_ON(dev_priv->mm.shrink_count) <4> [239.330196] WARNING: CPU: 1 PID: 18570 at drivers/gpu/drm/i915/i915_gem.c:1309 i915_gem_cleanup_early+0x13e/0x150 [i915] ... <4> [239.330640] RIP: 0010:i915_gem_cleanup_early+0x13e/0x150 [i915] ... <4> [239.330942] Call Trace: <4> [239.330944] <TASK> <4> [239.330949] i915_driver_late_release+0x2b/0xa0 [i915] <4> [239.331202] i915_driver_release+0x86/0xa0 [i915] <4> [239.331482] devm_drm_dev_init_release+0x61/0x90 <4> [239.331494] devm_action_release+0x15/0x30 <4> [239.331504] release_nodes+0x3d/0x120 <4> [239.331517] devres_release_all+0x96/0xd0 <4> [239.331533] device_unbind_cleanup+0x12/0x80 <4> [239.331543] device_release_driver_internal+0x23a/0x280 <4> [239.331550] ? bus_find_device+0xa5/0xe0 <4> [239.331563] device_driver_detach+0x14/0x20 ... <4> [357.719679] ---[ end trace 0000000000000000 ]---

If the test also unloads the i915 module then that's followed with:

<3> [357.787478] ============================================================================= <3> [357.788006] BUG i915_vma (Tainted: G U W N ): Objects remaining on __kmem_cache_shutdown() <3> [357.788031] ----------------------------------------------------------------------------- <3> [357.788204] Object 0xffff888109e7f480 @offset=29824 <3> [357.788670] Allocated in i915_vma_instance+0xee/0xc10 [i915] age=292729 cpu=4 pid=2244 <4> [357.788994] i915_vma_instance+0xee/0xc10 [i915] <4> [357.789290] init_status_page+0x7b/0x420 [i915] <4> [357.789532] intel_engines_init+0x1d8/0x980 [i915] <4> [357.789772] intel_gt_init+0x175/0x450 [i915] <4> [357.790014] i915_gem_init+0x113/0x340 [i915] <4> [357.790281] i915_driver_probe+0x847/0xed0 [i915] <4> [357.790504] i915_pci_probe+0xe6/0x220 [i915] ...

Closer analysis of CI results history has revealed a dependency of the error on a few IGT tests, namely:

• igt@api_intel_allocator@fork-simple-stress-signal,
• igt@api_intel_allocator@two-level-inception-interruptible,
• igt@gem_linear_blits@interruptible,
• igt@prime_mmap_coherency@ioctl-errors, which invisibly trigger the issue, then exhibited with first driver unbind attempt.

All of the above tests perform actions which are actively interrupted with signals. Further debugging has allowed to narrow that scope down to DRM_IOCTL_I915_GEM_EXECBUFFER2, and ring_context_alloc(), specific to ring submission, in particular.

If successful then that function, or its execlists or GuC submission equivalent, is supposed to be called only once per GEM context engine, followed by raise of a flag that prevents the function from being called again. The function is expected to unwind its internal errors itself, so it may be safely called once more after it returns an error.

In case of ring submission, the function first gets a reference to the engine's legacy timeline and then allocates a VMA. If the VMA allocation fails, e.g. when i915_vma_instance() called from inside is interrupted with a signal, then ring_context_alloc() fails, leaving the timeline held referenced. On next I915_GEM_EXECBUFFER2 IOCTL, another reference to the timeline is got, and only that last one is put on successful completion. As a consequence, the legacy timeline, with its underlying engine status page's VMA object, is still held and not released on driver unbind.

Get the legacy timeline only after successful allocation of the…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

parisc: Drop WARN_ON_ONCE() from flush_cache_vmap

I have observed warning to occassionally trigger.(CVE-2025-39781)

In the Linux kernel, the following vulnerability has been resolved:

MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits

Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used, and this macro can generate more than 2 instructions. At the same time, the code in ftrace assumes that no more than 2 instructions can be generated, which is why it stores them in an int[2] array. However, as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA) causes a buffer overflow when _mcount is beyond 32 bits. This leads to corruption of the variables located in the __read_mostly section.

This corruption was observed because the variable __cpu_primary_thread_mask was corrupted, causing a hang very early during boot.

This fix prevents the corruption by avoiding the generation of instructions if they could exceed 2 instructions in length. Fortunately, insn_la_mcount is only used if the instrumented code is located outside the kernel code section, so dynamic ftrace can still be used, albeit in a more limited scope. This is still preferable to corrupting memory and/or crashing the kernel.(CVE-2025-71109)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: Disable MMIO access during SMU Mode 1 reset

During Mode 1 reset, the ASIC undergoes a reset cycle and becomes temporarily inaccessible via PCIe. Any attempt to access MMIO registers during this window (e.g., from interrupt handlers or other driver threads) can result in uncompleted PCIe transactions, leading to NMI panics or system hangs.

To prevent this, set the no_hw_access flag to true immediately after triggering the reset. This signals other driver components to skip register accesses while the device is offline.

A memory barrier smp_mb() is added to ensure the flag update is globally visible to all cores before the driver enters the sleep/wait state.

(cherry picked from commit 7edb503fe4b6d67f47d8bb0dfafb8e699bb0f8a4)(CVE-2026-23213)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: reject new transactions if the fs is fully read-only

[BUG] There is a bug report where a heavily fuzzed fs is mounted with all rescue mount options, which leads to the following warnings during unmount:

BTRFS: Transaction aborted (error -22) Modules linked in: CPU: 0 UID: 0 PID: 9758 Comm: repro.out Not tainted 6.19.0-rc5-00002-gb71e635feefc #7 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:find_free_extent_update_loop fs/btrfs/extent-tree.c:4208 [inline] RIP: 0010:find_free_extent+0x52f0/0x5d20 fs/btrfs/extent-tree.c:4611 Call Trace: <TASK> btrfs_reserve_extent+0x2cd/0x790 fs/btrfs/extent-tree.c:4705 btrfs_alloc_tree_block+0x1e1/0x10e0 fs/btrfs/extent-tree.c:5157 btrfs_force_cow_block+0x578/0x2410 fs/btrfs/ctree.c:517 btrfs_cow_block+0x3c4/0xa80 fs/btrfs/ctree.c:708 btrfs_search_slot+0xcad/0x2b50 fs/btrfs/ctree.c:2130 btrfs_truncate_inode_items+0x45d/0x2350 fs/btrfs/inode-item.c:499 btrfs_evict_inode+0x923/0xe70 fs/btrfs/inode.c:5628 evict+0x5f4/0xae0 fs/inode.c:837 __dentry_kill+0x209/0x660 fs/dcache.c:670 finish_dput+0xc9/0x480 fs/dcache.c:879 shrink_dcache_for_umount+0xa0/0x170 fs/dcache.c:1661 generic_shutdown_super+0x67/0x2c0 fs/super.c:621 kill_anon_super+0x3b/0x70 fs/super.c:1289 btrfs_kill_super+0x41/0x50 fs/btrfs/super.c:2127 deactivate_locked_super+0xbc/0x130 fs/super.c:474 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1318 task_work_run+0x1d4/0x260 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] …

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)

• kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)

• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

• kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

• kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

• kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)

• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)

• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)

• kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)

• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

• kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

• kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

• kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)

• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)

• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636)

• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

• kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)

• kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)

• kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)

• kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)

• kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

• kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

Bug Fix(es) and Enhancement(s):

• Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:Rocky Linux-185117)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-43038 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-43038 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-43038 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)

• kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)

• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

• kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

• kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

• kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)

• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)

• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and passed to icmp6_send(), it uses IP6CB(skb2). IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18. If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). This would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a fake TLV without checking if the remaining packet length can hold the full 18-byte struct ipv6_destopt_hao. Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the packet data into skb_shared_info? Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and ip6ip6_err() to prevent this? This patch implements the first suggestion. I am not sure if ip6ip6_err() needs to be changed. A separate patch would be better anyway.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)
• kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)
• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
• kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)
• kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)
• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
• kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)
• kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)
• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
• kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)
• kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)
• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
• kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636)
• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
• kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
• kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
• kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)
• kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
• kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
• kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)
• kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)

Bug Fix(es) and Enhancement(s):

• Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488)
• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
• kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
• kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
• kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)
• kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)
• kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
• kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)
• kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)

Bug Fix(es) and Enhancement(s):

• [AlmaLinux-9.8.z]: Update the mlx5 drivers to v6.19 (JIRA:AlmaLinux-169057)
• iavf: during POD churn vlan filters may not be added for a vlan interface, spoofchk drops subsequent packets [almalinux-9.8.z] (JIRA:AlmaLinux-172993)
• nf_conntrack_sctp: vtag corruption with late INIT in ESTABLISHED state across conntrack zones [almalinux-9.8.z] (JIRA:AlmaLinux-178273)
• sched/fair: Skip sched_balance_running cmpxchg when balance is not due [almalinux-9.8.z] (JIRA:AlmaLinux-182776)
• [REGRESSION] ISST-Spyre: Jenkins workload causes soft lock warning to appear on screen. Workload hangs. [almalinux-9.8.z] (JIRA:AlmaLinux-183183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
• ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038}
• blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
• iommu: disable SVA when CONFIG_X86 is set {CVE-2025-71089}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• driver core: platform: use generic driver_override infrastructure {CVE-2026-31527}

• KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: add strict range checks while freeing blocks {CVE-2022-50021}
• ext4: add ext4_sb_block_valid() refactored out of ext4_inode_block_valid() {CVE-2022-50021}
• ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
• ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038}
• IB/mlx5: Fix initializing CQ fragments buffer {CVE-2021-47261}
• blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• KVM: x86/mmu: Don't advance iterator after restart due to yielding {CVE-2021-47094}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• net: bridge: fix vlan tunnel dst refcnt when egressing {CVE-2021-47222}
• iommu: disable SVA when CONFIG_X86 is set {CVE-2025-71089}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• net: bridge: fix vlan tunnel dst null pointer dereference {CVE-2021-47222}

• KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
• ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• raid1: fix use-after-free for original bio in raid1_write_request() {CVE-2024-35979}
• bpf: Use VM_MAP instead of VM_ALLOC for ringbuf {CVE-2022-48714}
• RDMA/irdma: avoid invalid read in irdma_net_event {CVE-2025-71133}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}

• CVE-2026-31607
  • usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• CVE-2026-31527
  • driver core: platform: use generic driver_override infrastructure {CVE-2026-31527}
• CVE-2026-43493
  • crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• CVE-2026-43038
  • ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038}
• CVE-2026-43037
  • ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
• CVE-2026-23083
  • fou: Don't allow 0 for FOU_ATTR_IPPROTO. {CVE-2026-23083}
• CVE-2024-57982
  • xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}
• CVE-2024-50115
  • KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115}
• CVE-2026-53166
  • futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• CVE-2026-43499
  • rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• CVE-2023-6546
  • tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux {CVE-2023-6546}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2023-53286
  • RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
• CVE-2023-53259
  • VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• CVE-2026-31500
  • Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• CVE-2023-52916
  • media: aspeed: Fix memory overwrite if timing is 1600x900 {CVE-2023-52916}
• CVE-2022-50021
  • ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• CVE-2022-49799
  • tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
• CVE-2022-49234
  • net: dsa: Avoid cross-chip syncing of VLAN filtering {CVE-2022-49234}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2026-23164
  • rocker: fix memory leak in rocker_world_port_post_fini() {CVE-2026-23164}
• CVE-2026-23150
  • nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). {CVE-2026-23150}
• CVE-2026-23133
  • wifi: ath10k: fix dma_free_coherent() pointer {CVE-2026-23133}
• CVE-2026-23121
  • mISDN: annotate data-race around dev->work {CVE-2026-23121}
• CVE-2026-23108
  • can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
• CVE-2026-23103
  • ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
• CVE-2026-23101
  • leds: led-class: Only Add LED to leds_list when it is fully ready {CVE-2026-23101}
• CVE-2026-23095
  • gue: Fix skb memleak with inner IP protocol 0. {CVE-2026-23095}
• CVE-2026-23084
  • be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list {CVE-2026-23084}
• CVE-2026-23080
  • can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23080}
• CVE-2026-23071
  • regmap: Fix race condition in hwspinlock irqsave routine {CVE-2026-23071}
• CVE-2026-23058
  • can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23058}
• CVE-2026-23038
  • pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
• CVE-2026-23011
  • ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
• CVE-2026-23003
  • ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003}
• CVE-2025-71194
  • btrfs: fix deadlock in wait_current_trans() due to ignored transaction type {CVE-2025-71194}
• CVE-2026-31417
  • net/x25: Fix overflow when accumulating packets {CVE-2026-31417}
• CVE-2026-31396
  • net: macb: fix use-after-free access to PTP clock…

• gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
• ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
• KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
• Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
• xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
• sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
• blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
• net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
• gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
• HID: betop: check shape of output reports {CVE-2023-53015}
• mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
• HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
• drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
• ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
• RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
• Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
• scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
• sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
• pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
• cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
• ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
• ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
• i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
• net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
• bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
• xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
• firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
• virtgpu: don't reset on shutdown {CVE-2025-38064}
• xen/netfront: fix crash when removing device {CVE-2022-48969}
• mptcp: do not fallback when OoO is present {CVE-2024-50185}
• can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
• xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
• ext4: fix racy may inline data check in dio write {CVE-2023-52786}
• drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
• macsec: fix UAF bug for real_dev {CVE-2022-49390}
• drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
• mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
• driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
• udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
• ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
• mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
• eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
• net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
• udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
• RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
• dlm: fix possible lkb_resource…

• Rebased onto Oracle UEK base 5.4.17-2136.357.2.el7uek
• sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
• ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison {CVE-2026-53309}
• ocfs2/dlm: validate qr_numregions in dlm_match_regions() {CVE-2026-53043}
• ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
• futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
• wifi: mac80211: fix NULL deref in mesh_matches_local() {CVE-2026-23396}
• icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
• HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
• net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
• wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
• drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() {CVE-2026-23356}
• batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• sysctl: Fix data races in proc_douintvec(). {CVE-2022-49641}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
• mm:…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-90413
  • IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• CVE-2026-53062
  • dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
  • dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
• CVE-2026-64237
  • Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
  • Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• CVE-2026-64109
  • af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2025-38512
  • wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2026-22980
  • nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-37885
  • KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2023-53039
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• CVE-2019-12456
  • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
• CVE-2024-46812
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• CVE-2026-31761
  • iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
• CVE-2026-53120
  • PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2026-31527
  • driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-23268
  • apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2025-21812
  • ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
• CVE-2026-46266
  • inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-53355
  • net: rds: clear i_sends on setup unwind {CVE-2026-53355}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2023-52922
  • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-90413
  • IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• CVE-2026-53062
  • dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
  • dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
• CVE-2026-64237
  • Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
  • Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• CVE-2026-64109
  • af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2025-38512
  • wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2026-22980
  • nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-37885
  • KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2023-53039
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• CVE-2019-12456
  • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
• CVE-2024-46812
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• CVE-2026-31761
  • iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
• CVE-2026-53120
  • PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2026-31527
  • driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-23268
  • apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2025-21812
  • ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
• CVE-2026-46266
  • inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-53355
  • net: rds: clear i_sends on setup unwind {CVE-2026-53355}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2023-52922
  • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• ALSA: virtio: reset device before deleting virtqueues {CVE-2026-98264}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
• ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• ALSA: caiaq: Fix potential double-free at error path {CVE-2026-98066}
• ASoC: Intel: avs: Disable periods-elapsed work when closing PCM {CVE-2025-40344}
• ALSA: timer: drain a slave's callback before its master detaches it {CVE-2026-68201}
• ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams {CVE-2026-53242}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• security/keys: fix missed RCU read section on lookup {CVE-2026-64015}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518}
• rcu: Fix rcu_read_unlock() deadloop due to softirq {CVE-2026-45957}
• bpf: Fix potential UAF in bpf_netns_link_update_prog {CVE-2026-90393}
• bpf: Fix use-after-free in offloaded map/prog info fill {CVE-2026-53089}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• tty: skip cdev_del() when no cdev is registered {CVE-2026-90335}
• scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847}
• scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue {CVE-2025-37861}
• scsi: csiostor: Fix dereference of null pointer rn {CVE-2026-45857}
• scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470}
• wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
• wifi: mwifiex: validate scan response extents {CVE-2026-98185}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• wifi: iwlwifi: mvm: add a check on the tid coming from the firmware {CVE-2026-93791}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
• net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015}
• net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830}
• net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list {CVE-2026-53230}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• veth: fix NAPI leak in XDP enable error path {CVE-2026-80613}
• RDMA/rxe: Fix double free in rxe_srq_from_init {CVE-2026-45852}
• RDMA/iwcm: Fix workqueue list corruption by removing work_list {CVE-2026-45898}
• ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261}
• svcrdma: Fix offset arithmetic in read_chunk_range {CVE-2026-89533}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• xprtrdma: Fix ep kref imbalance on ADDR_CHANGE {CVE-2026-72469}
• sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
• sctp: drop a chunk if its transport was removed {CVE-2026-89478}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• sctp: revalidate list cursor after…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of share_conf in compound request smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without validating tcon->t_state.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation().

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf.

In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers.

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container.)(CVE-2026-31431)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 'ksmbd: add support for read compound'), response buffer management was changed to use dynamic iov array.

In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc.

In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded.

In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by reference batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway's last reference while readers still follow the pointer.

In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry.

In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error).

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb.

In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...).

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide…

In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning: .

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs are sent from the pkt queue.

In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: <TASK> dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0 print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0 padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0 process_one_work+0x2ec/0x5a0 If 'mdelay(10)' is added before calling 'padata_find_next' in the 'padata_reorder' function, this issue could be reproduced easily with ltp test (pcrypt_aead01).

In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev().

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of the first channel.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by one compactly.

In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the 'end' entry.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __smb2_lease_break_noti() Move tcp_transport free to ksmbd_conn_free.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate frees sess->user and does not set the pointer to NULL.

In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.)(CVE-2025-37823).

In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not determined by sb->s_sequence .

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes.

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use local fence in error path of xe_migrate_clear The intent of the error path in xe_migrate_clear is to wait on locally generated fence and then return.

In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report .

In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report .

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted…

Upstream kernel version 6.6.137 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.