{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "ipv4: free inet_opt and ireq_opt after an RCU grace period {CVE-2026-98432}\n- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}\n- KVM: x86: Use active memslots for the per-vCPU MMIO cache {CVE-2026-99082}\n- gfs2: fix use-after-free in gfs2_qd_dealloc {CVE-2026-63804}\n- usb: typec: tcpm: Validate SVID index in svdm_consume_modes() {CVE-2026-64330}\n- drm/amdkfd: hold event_mutex while checkpointing CRIU events {CVE-2026-74446}\n- net: openvswitch: fix potential UAF on meter attach failure {CVE-2026-74465}\n- mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}\n- veth: fix NAPI leak in XDP enable error path {CVE-2026-80613}\n- nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482}\n- svcrdma: Fix offset arithmetic in read_chunk_range {CVE-2026-89533}\n- ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode {CVE-2026-89653}\n- libceph: validate banner payload length {CVE-2026-90067}\n- net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830}\n- wifi: nl80211: reject beacons with bad HE operation {CVE-2026-97517}\n- drm/virtio: release the GEM object on virtio_gpu_vram_create() errors {CVE-2026-98606}\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough {CVE-2026-98602}\n- bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc {CVE-2026-98588}\n- thunderbolt: Reject oversized XDomain properties responses {CVE-2026-98687}\n- Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739}", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos-stream8els/advisories/2026/clsa-2026_1793362651.json" } ], "tracking": { "current_release_date": "2026-10-30T12:20:53Z", "generator": { "date": "2026-10-30T12:20:53Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1793362651", "initial_release_date": "2026-10-30T12:20:53Z", "revision_history": [ { "date": "2026-10-30T12:20:53Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "kernel: Fix of 20 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 8", "product": { "name": "Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "product": { "name": "kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "product_id": "kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-cross-headers@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=i686" } } }, { "category": "product_version", "name": "kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "product": { "name": "kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "product_id": "kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-headers@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-cross-headers@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-modules-internal@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-tools-libs-devel@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-tools-libs@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-devel@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/perf@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-debug@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-modules-extra@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-selftests-internal@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-debug-modules-extra@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/bpftool@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-core@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-tools@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-ipaclones-internal@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/python3-perf@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-headers@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-debug-modules-internal@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-debug-modules@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-debug-devel@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-debug-core@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product": { "name": "kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_id": "kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-modules@4.18.0-553.6.1.el8_10.tuxcare.els34?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686" }, "product_reference": "kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686" }, "product_reference": "kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" }, "product_reference": "kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "relates_to_product_reference": "CentOS-Stream-8" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-89482", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone\n\nCommit 25e5cb780e62 (\"nvme-tcp: fix possible crash in write_zeroes\nprocessing\") established that blk_rq_payload_bytes() must not be read\nwithout first checking blk_rq_nr_phys_segments(), and recorded the\nresult in nvme_tcp_setup_cmd_pdu() as req->data_len. The receive side\nwas left as it was.\n\nThe two differ for REQ_OP_WRITE_ZEROES, which has no physical segments\nbut a non-zero blk_rq_bytes(), so setup leaves req->iter untouched\nwhile the receive gate lets a C2HData through and nvme_tcp_recv_data()\ncopies into whatever the previous command on that tag left there. The\ndriver-private area is zeroed only when the tag set is allocated.\n\nReproduced with a test target that leaves a residual iterator on a tag\nand then sends a C2HData for a WRITE_ZEROES command on the same tag:\n\nBUG: KASAN: wild-memory-access in _copy_to_iter+0x642/0x1330\nWrite of size 512 at addr ffe728c2175dfa81 by task kworker/0:1H/103\n\nCPU: 0 UID: 0 PID: 103 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy)\nHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nWorkqueue: nvme_tcp_wq nvme_tcp_io_work\nCall Trace:\n \n dump_stack_lvl+0x53/0x70\n kasan_report+0xce/0x100\n ? _copy_to_iter+0x642/0x1330\n kasan_check_range+0x105/0x1b0\n __asan_memcpy+0x3c/0x60\n _copy_to_iter+0x642/0x1330\n ? __pfx_sock_has_perm+0x10/0x10\n ? worker_thread+0x45b/0xd10\n ? __pfx__copy_to_iter+0x10/0x10\n ? _raw_spin_lock_bh+0x83/0xe0\n ? __pfx__raw_spin_lock_bh+0x10/0x10\n __skb_datagram_iter+0xf3/0x820\n ? __pfx_simple_copy_to_iter+0x10/0x10\n ? __asan_memcpy+0x3c/0x60\n ? skb_copy_bits+0x58d/0x830\n skb_copy_datagram_iter+0x37/0x120\n nvme_tcp_recv_skb+0xa07/0x4320\n ? __pfx_nvme_tcp_recv_skb+0x10/0x10\n __tcp_read_sock+0x1ab/0x810\n ? __pfx_nvme_tcp_recv_skb+0x10/0x10\n ? __pfx_lock_sock_nested+0x10/0x10\n ? __pfx___tcp_read_sock+0x10/0x10\n nvme_tcp_try_recv+0x152/0x1e0\n ? __pfx_nvme_tcp_try_recv+0x10/0x10\n ? __pfx_mutex_unlock+0x10/0x10\n nvme_tcp_io_work+0x1e4/0x6c0\n ? __schedule+0x181a/0x49f0\n ? __pfx_nvme_tcp_io_work+0x10/0x10\n process_one_work+0x633/0x1030\n\nKeep the blk_rq_payload_bytes() test and add req->data_len to it. The\nold test is what rejects a C2HData naming a tag that is no longer in\nflight, because blk_update_request() zeroes rq->__data_len on\ncompletion; req->data_len and req->curr_bio are driver-private and\nsurvive completion, so they cannot stand in for it. Setup initialises\nthe iterator only when both req->curr_bio and req->data_len are set, so\nthe gate now tests the same two.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89482" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/32ea8ce96b9bd797c59c351ce490ffd97adaa8c0", "url": "https://git.kernel.org/stable/c/32ea8ce96b9bd797c59c351ce490ffd97adaa8c0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3a4aa9e6ad3e35f8e24d5eaf38ee4d437075fb36", "url": "https://git.kernel.org/stable/c/3a4aa9e6ad3e35f8e24d5eaf38ee4d437075fb36" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/641ad3a30ba560f0a9a610376c568d7b75d2a2aa", "url": "https://git.kernel.org/stable/c/641ad3a30ba560f0a9a610376c568d7b75d2a2aa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6a01b58263108eaf9869bb6f82f07709240c6589", "url": "https://git.kernel.org/stable/c/6a01b58263108eaf9869bb6f82f07709240c6589" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7ed0b61bbc145988be292c4d3ec580aebd8d2bcd", "url": "https://git.kernel.org/stable/c/7ed0b61bbc145988be292c4d3ec580aebd8d2bcd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b36161701cb366f416afdcf70771d432a7c74753", "url": "https://git.kernel.org/stable/c/b36161701cb366f416afdcf70771d432a7c74753" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b96e1ff75e5c0ad6e077ac002b1d30b0a2b49528", "url": "https://git.kernel.org/stable/c/b96e1ff75e5c0ad6e077ac002b1d30b0a2b49528" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dd8906bb8f8d5bf1c9f861e1382c82b87bfe7cab", "url": "https://git.kernel.org/stable/c/dd8906bb8f8d5bf1c9f861e1382c82b87bfe7cab" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98432", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the\nchild socket (newinet->inet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt->optlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98432" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568", "url": "https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936", "url": "https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a", "url": "https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036", "url": "https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5", "url": "https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2", "url": "https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6", "url": "https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b", "url": "https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b" } ], "release_date": "2026-10-15T12:08:22Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-99082", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information. Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid. When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, support SMRAM address space\") added the SMM address space,\nthese helpers were not converted to use the active memslots.\n\nConsequently, an update to the SMM memslots can leave an entry from the old\nSMM address space apparently valid after the vCPU returns to the normal\naddress space. A guest can then cause an access to valid RAM at the same\nGFN to be returned to userspace as KVM_EXIT_MMIO.\n\nCompleting that exit through the VMM's RAM address space writes the backing\npage without going through KVM's write-tracking path. If the page backs a\nnested EPT table, KVM can continue using shadow translations derived from\nthe old contents. The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()\ncatches this invalid cache and memslot combination.\n\nUse the vCPU's active memslots when caching and validating the entry.\nMemslot generations are unique across address spaces, so the generation\nalso distinguishes the normal and SMM views. This matches the MMIO SPTE\ncache, which already uses kvm_vcpu_memslots().\n\nOn an unpatched current-mainline kernel, a regression test that fills the\ncache in SMM and updates only the SMM memslots fails the intended RAM write\nand triggers the kvm_mmu_write_protect_fault() warning. With this change,\nthe same test completes the RAM write without a warning. The x86/smm_test,\nset_memory_region_test, and memslot_modification_stress_test selftests also\npass.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-99082" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312", "url": "https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd", "url": "https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876", "url": "https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b3e6212dea2e4328a841ceb37f377583176dc735", "url": "https://git.kernel.org/stable/c/b3e6212dea2e4328a841ceb37f377583176dc735" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e792a9ace39d2812a5b342a1987186c7bc653204", "url": "https://git.kernel.org/stable/c/e792a9ace39d2812a5b342a1987186c7bc653204" } ], "release_date": "2026-10-23T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90067", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: validate banner payload length\n\nWhen parsing the Ceph messenger v2 protocol banner, the `payload_len` field\nis decoded from the banner prefix. If a client sends a banner with a\n`payload_len` of 0, the kernel sets up a 0-length socket read. This\nviolates an invariant in the state machine, triggering a warning in\n`populate_in_iter()`:\n\n------------[ cut here ]------------\n!iov_iter_count(&con->v2.in_iter)\nWARNING: net/ceph/messenger_v2.c:3129 at populate_in_iter\nnet/ceph/messenger_v2.c:3129 [inline], CPU#1: kworker/1:3/5070\nWARNING: net/ceph/messenger_v2.c:3129 at ceph_con_v2_try_read+0x6634/0x6810\nnet/ceph/messenger_v2.c:3159, CPU#1: kworker/1:3/5070\n...\nCall Trace:\n \n ceph_con_workfn+0x1f5/0x14a0 net/ceph/messenger.c:1575\n process_one_work kernel/workqueue.c:3322 [inline]\n process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486\n kthread+0x388/0x470 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \n\nAccording to the msgr2 protocol specification, the banner payload is\nexpected to contain at least two 64-bit integers (`server_feat` and\n`server_req_feat`). Therefore, `payload_len` must be at least 16 bytes.\n\nFix this by adding a check in `process_banner_prefix()` to reject a\n`payload_len` smaller than 16 bytes. This prevents the 0-length read and\ncorrectly aborts the connection with a protocol error.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90067" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/279c0852999fd2384f4a88155091a99e81f96873", "url": "https://git.kernel.org/stable/c/279c0852999fd2384f4a88155091a99e81f96873" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b2e62a7655d347a845a91155610ddae11daffc6", "url": "https://git.kernel.org/stable/c/3b2e62a7655d347a845a91155610ddae11daffc6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6cf666e47f2b51d5a887ec8a3226cde951757d27", "url": "https://git.kernel.org/stable/c/6cf666e47f2b51d5a887ec8a3226cde951757d27" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6d1c6f228854aa89844fd0152d7ed7ac72a55e89", "url": "https://git.kernel.org/stable/c/6d1c6f228854aa89844fd0152d7ed7ac72a55e89" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c1b937ff24b19e69aa7fb1b0f46a74d4c9668692", "url": "https://git.kernel.org/stable/c/c1b937ff24b19e69aa7fb1b0f46a74d4c9668692" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c77633a9595658210a6e216a071e5a396a0835a7", "url": "https://git.kernel.org/stable/c/c77633a9595658210a6e216a071e5a396a0835a7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f374967fcdf04001c9b66df1c19106fa83cd91f7", "url": "https://git.kernel.org/stable/c/f374967fcdf04001c9b66df1c19106fa83cd91f7" } ], "release_date": "2026-09-17T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-63804", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fix use-after-free in gfs2_qd_dealloc\n\ngfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(),\naccesses the superblock object sdp through qd->qd_sbd after freeing qd.\nIt does so to decrement sd_quota_count and wake up sd_kill_wait.\n\nHowever, by the time the RCU callback runs, gfs2_put_super() may have\nalready freed sdp via free_sbd(). This can happen when\ngfs2_quota_cleanup() is called during unmount: it disposes of quota\nobjects via call_rcu() and then waits on sd_kill_wait with a 60-second\ntimeout. If the timeout expires, or if gfs2_gl_hash_clear() triggers\nadditional qd_put() calls that schedule more RCU callbacks after the\nwait completes, gfs2_put_super() will proceed to free the superblock\nwhile RCU callbacks referencing it are still pending.\n\nAdd an rcu_barrier() before free_sbd() in gfs2_put_super() to ensure\nall pending RCU callbacks (including gfs2_qd_dealloc) have completed\nbefore the superblock is freed.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-63804" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4fe388218826df8607ae41a6305df67db08a9093", "url": "https://git.kernel.org/stable/c/4fe388218826df8607ae41a6305df67db08a9093" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8745d9f7e1682c39f0a1578895ac74205e2a6757", "url": "https://git.kernel.org/stable/c/8745d9f7e1682c39f0a1578895ac74205e2a6757" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9d0d5ba20cad661f7f287d4c66d2c19022ce2fd0", "url": "https://git.kernel.org/stable/c/9d0d5ba20cad661f7f287d4c66d2c19022ce2fd0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b85ef03f726b15047a6fa6d11b639bdf6c0ee4f0", "url": "https://git.kernel.org/stable/c/b85ef03f726b15047a6fa6d11b639bdf6c0ee4f0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f9c9ec2c319f843b70ecdf939d48b52d189bc081", "url": "https://git.kernel.org/stable/c/f9c9ec2c319f843b70ecdf939d48b52d189bc081" } ], "release_date": "2026-07-19T12:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-74481", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_reporting: use system_freezable_wq to fix UAF during suspend\n\nDuring PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like\nvirtio_balloon reset their underlying virtio devices and delete their\nvirtqueues via vdev->config->del_vqs().\n\nHowever, page reporting work (page_reporting_process) was scheduled on the\nglobal system_wq. Because system_wq lacks the WQ_FREEZABLE flag, the PM\nfreezer skips it, leaving page_reporting_process active during suspend.\n\nIf pages are freed into the buddy allocator while suspending (for example,\nwhen core MM invokes the balloon shrinker during S4 hibernation image\nsaving), page reporting triggers virtballoon_free_page_report() on deleted\nvirtqueues, resulting in a Use-After-Free / General Protection Fault:\n\n [ 196.795226] general protection fault, probably for non-canonical address 0xaa1436fe70dae6df: 0000 [#1] SMP NOPTI\n [ 196.825967] Workqueue: events page_reporting_process\n [ 196.831038] RIP: 0010:virtqueue_add_split+0x233/0x4c0 [virtio_ring]\n [ 196.927073] virtballoon_free_page_report+0x3a/0xe0 [virtio_balloon]\n [ 196.946943] page_reporting_process+0x370/0x4f0\n\nFix this by switching page reporting work to system_freezable_wq. This\nensures that the PM freezer pauses page_reporting_process before device\ndrivers destroy their reporting virtqueues. Because the reporting worker\nis frozen, memory reclamation/freeing (e.g. via shrinker execution) can\nsafely return pages to MM during freeze without triggering unfrozen\nreporting work on deleted virtqueues.\n\nThis aligns with the driver's existing design. The comment in\nvirtballoon_freeze() states:\n /*\n * The workqueue is already frozen by the PM core before this\n * function is called.\n */\n\nTesting:\nI have verified these fixes using Google’s virtualization infrastructure\nby running continuous suspend/resume iterations (40+ cycles) while\nchurning memory using stress-ng (`stress-ng --vm 4 --vm-bytes 60%\n--timeout 1`) to constantly create free pages for the buddy allocator. We\nalso set the `page_reporting_order` parameter to 0 to make the page\nreporting worker highly sensitive, forcing it to pick up any 4K free\npages. This confirmed that the UAF crashes are no longer reproducible.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74481" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0b45f6927a14914ff685fe0e6f9d11232a1e03df", "url": "https://git.kernel.org/stable/c/0b45f6927a14914ff685fe0e6f9d11232a1e03df" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/450f35f4d5a682a0796757e52295df58ddb63bc9", "url": "https://git.kernel.org/stable/c/450f35f4d5a682a0796757e52295df58ddb63bc9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/992f270fd808338fbae1f498a5e325e7e2e20368", "url": "https://git.kernel.org/stable/c/992f270fd808338fbae1f498a5e325e7e2e20368" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a4c60046052777ca1dcc83fe3ece2a5136b301f1", "url": "https://git.kernel.org/stable/c/a4c60046052777ca1dcc83fe3ece2a5136b301f1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b11907c905fa08eda925395f0724b7a409870f65", "url": "https://git.kernel.org/stable/c/b11907c905fa08eda925395f0724b7a409870f65" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b2c094e98f8bb823b3ae475f7169fe2091c40c6d", "url": "https://git.kernel.org/stable/c/b2c094e98f8bb823b3ae475f7169fe2091c40c6d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f978048326570047e8216e81a67f9c71ef2bb1b1", "url": "https://git.kernel.org/stable/c/f978048326570047e8216e81a67f9c71ef2bb1b1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/faf439b5fa7b231120eac4f7a617e0bfd4f6f5c7", "url": "https://git.kernel.org/stable/c/faf439b5fa7b231120eac4f7a617e0bfd4f6f5c7" } ], "release_date": "2026-08-15T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-93830", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: xgmac2: disable RBUE in default RX interrupt mask\n\nEnabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive\nand can trigger a MAC interrupt storm under heavy RX pressure. When the\nDMA runs out of RX descriptors it fires RBUE continuously until software\nrefills the ring.\n\nHowever, RBUE is redundant: the normal RX completion interrupt (RIE)\nalready triggers NAPI, which processes completed descriptors and refills\nthe ring, causing the DMA to resume. The RBUE handler itself only sets\nhandle_rx - the same outcome as RIE.\n\nOn Agilex5 under heavy RX pressure, the MAC interrupt (which includes\nRBUE) was observed firing 1,821,811,555 times against only 2,618,627\nactual RX completions - a ~695x ratio - confirming the severity of the\nstorm.\n\nRBUE does not provide OOM recovery. If page_pool is exhausted,\nstmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays\nsuspended, and RBUE fires again on the next NAPI completion - a storm\nwith no forward progress. This patch trades that storm for a clean\nstall with the same RX outcome. Proper OOM recovery is a pre-existing\ngap outside the scope of this fix.\n\nNote: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool\ncounter will always read 0 on XGMAC2 devices. This behaviour is already\ninconsistent across DWMAC core versions.\n\nRemove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX\nto prevent the interrupt storm while keeping normal RX handling intact.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-93830" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce", "url": "https://git.kernel.org/stable/c/0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b3b91433d5f4eae6865cdaa96f40cd67849e1f6", "url": "https://git.kernel.org/stable/c/6b3b91433d5f4eae6865cdaa96f40cd67849e1f6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/74dbb85a6a254b5fc1f265a6cd61b2ba9d9221d7", "url": "https://git.kernel.org/stable/c/74dbb85a6a254b5fc1f265a6cd61b2ba9d9221d7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a10e54e42a8f73a8d731f5a281fc06bb41b9250", "url": "https://git.kernel.org/stable/c/7a10e54e42a8f73a8d731f5a281fc06bb41b9250" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/87e2826ed2058747ddf014c082569a46bfadd96b", "url": "https://git.kernel.org/stable/c/87e2826ed2058747ddf014c082569a46bfadd96b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c9d57b5dc098b84631d0b3559c84c499ea2170a", "url": "https://git.kernel.org/stable/c/8c9d57b5dc098b84631d0b3559c84c499ea2170a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d3265c19b35d036bba327b36b5366bee76b0157c", "url": "https://git.kernel.org/stable/c/d3265c19b35d036bba327b36b5366bee76b0157c" } ], "release_date": "2026-09-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-74465", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix potential UAF on meter attach failure\n\nWhile attaching a newly created meter attach_meter() function makes\nthe new meter visible to other CPUs but can still fail afterwards.\nOn failure, it detaches the meter back and returns an error.\n\nHowever, this is an unexpected behavior for the ovs_meter_cmd_set()\nthat uses a plain kfree(meter) on attach failure without waiting for\nRCU readers to stop using it, assuming it was never visible.\n\nThis is never a problem for ovs-vswitchd as it always creates meters\nbefore creating any flows that use them. But the UAF can be triggered\nwith a custom application using uAPI:\n\n BUG: KASAN: slab-use-after-free in ovs_meter_execute (net/openvswitch/meter.c:653)\n Read of size 8 at addr ffff88810d152650 by task meter/2508\n\n Call Trace:\n ovs_meter_execute (net/openvswitch/meter.c:653)\n do_execute_actions (net/openvswitch/actions.c:1407)\n ovs_execute_actions (net/openvswitch/actions.c:1584)\n ovs_packet_cmd_execute (net/openvswitch/datapath.c:703)\n ...\n netlink_sendmsg (af_netlink.c:1900)\n\n Allocated by task 2519:\n __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)\n ovs_meter_cmd_set (net/openvswitch/meter.c:422)\n ...\n netlink_sendmsg (af_netlink.c:1900)\n\n Freed by task 2519:\n kfree (mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)\n ovs_meter_cmd_set (net/openvswitch/meter.c:479)\n ...\n netlink_sendmsg (af_netlink.c:1900)\n\nFix that by making sure attach_meter() doesn't make the meter visible\nuntil all the checks are done and the function can't fail anymore.\n\nThis also makes sure the \"hash\" value is calculated after the potential\nre-sizing of the table.\n\nReported by Trend Micro's Zero Day Initiative as ZDI-CAN-31642.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74465" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0310d1fa7f9debd0d89629e9f14c7975a47eaa9a", "url": "https://git.kernel.org/stable/c/0310d1fa7f9debd0d89629e9f14c7975a47eaa9a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/431a295d93f76fbdb6a7cfce92a9e3dfee1e5d61", "url": "https://git.kernel.org/stable/c/431a295d93f76fbdb6a7cfce92a9e3dfee1e5d61" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/496f3013c6ff759249abcfb2da2361c1a3e2e66d", "url": "https://git.kernel.org/stable/c/496f3013c6ff759249abcfb2da2361c1a3e2e66d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4d03e5fa3fbb1df15258a1eb3d6963f0d65659b3", "url": "https://git.kernel.org/stable/c/4d03e5fa3fbb1df15258a1eb3d6963f0d65659b3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/90623c9499627803ef3f04fa25a3199402d4fb95", "url": "https://git.kernel.org/stable/c/90623c9499627803ef3f04fa25a3199402d4fb95" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a58a2b0ce354df531ebc71fc870058c2feb59f6b", "url": "https://git.kernel.org/stable/c/a58a2b0ce354df531ebc71fc870058c2feb59f6b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b0de3b58dac3b02b528f72ee0397728aed11f993", "url": "https://git.kernel.org/stable/c/b0de3b58dac3b02b528f72ee0397728aed11f993" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ddc0ef4217cc697c6ba1a295cc1ea42423ec68ac", "url": "https://git.kernel.org/stable/c/ddc0ef4217cc697c6ba1a295cc1ea42423ec68ac" } ], "release_date": "2026-08-15T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98588", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc\n\nsock_map_alloc() only rejects max_entries == 0 and otherwise allows any\nu32 value. sock_map_free() then walks the sks[] array with a signed int\niterator:\n\n\tint i;\n\tfor (i = 0; i < stab->map.max_entries; i++)\n\t\tstruct sock **psk = &stab->sks[i];\n\nWhen a SOCKMAP is created with max_entries = 0xffffffff (UINT_MAX), the\nallocation of 32 GiB can succeed on large-memory hosts. During free the\ncounter reaches 0x80000000, wraps to INT_MIN, is sign-extended by movslq\nand turned into a ~16 GiB negative offset from stab->sks, pointing far\nbelow the allocation.\n\nThe faulting access is an xchg() write in sock_map_free(). Without\nKASAN, the same out-of-bounds write can fault on an unmapped vmalloc page\nor corrupt an unrelated allocation if that vmalloc address is populated.\nOn a KASAN kernel with CONFIG_KASAN_VMALLOC=y, the shadow check for that\naddress hits an unmapped shadow page and oopses first:\n\n BUG: unable to handle page fault for address: fffff521b59c5a00\n RIP: 0010:kasan_check_range+0x107/0x190\n Call Trace:\n sock_map_free+0x93/0x190\n map_create+0x68d/0xb30\n __sys_bpf+0x21e/0x2e70\n\nVmcore confirmed stab->map.max_entries == 0xffffffff, stab->sks ==\n0xffffc911ace2d000, and the faulting address sks + (s64)INT_MIN * 8\nexactly at 0xffffc90dace2d000. The same buggy path is reached on the\nnormal close()/bpf_map_free_deferred() path whenever such a map is\ndestroyed.\n\nsock_map_alloc() used to bound its allocation size through\nbpf_map_charge_init(), but the bound was dropped when rlimit-based memory\naccounting was removed. Reject max_entries > INT_MAX at creation time so\nthe signed iterator in sock_map_free() never sees a value that would\noverflow.\n\nTriggered by syzkaller and reproduced on both a 6.6-based KASAN kernel\nand the upstream v7.3-rc2 kernel.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98588" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/814a81c842bd88f6bd8a4ce550d560df071a5d03", "url": "https://git.kernel.org/stable/c/814a81c842bd88f6bd8a4ce550d560df071a5d03" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/909f761868fda329dc69130ef9eb5b5795bcdf00", "url": "https://git.kernel.org/stable/c/909f761868fda329dc69130ef9eb5b5795bcdf00" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ba7d627dbc67d62df2fa66d7b41e743c3ace0ec8", "url": "https://git.kernel.org/stable/c/ba7d627dbc67d62df2fa66d7b41e743c3ace0ec8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c56191af3a578b9cc265fa3bd5fc0752c59c1781", "url": "https://git.kernel.org/stable/c/c56191af3a578b9cc265fa3bd5fc0752c59c1781" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cc70972ddbf0e3398f2f32624d31db78594d50d8", "url": "https://git.kernel.org/stable/c/cc70972ddbf0e3398f2f32624d31db78594d50d8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cea597519b9ca6d691c98d92460ead8ece2a07af", "url": "https://git.kernel.org/stable/c/cea597519b9ca6d691c98d92460ead8ece2a07af" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f4a73f49e256bd835368504462be3b57b03febff", "url": "https://git.kernel.org/stable/c/f4a73f49e256bd835368504462be3b57b03febff" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98573", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()\n\nskb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max\nargument and passes the result to __pskb_pull_tail() as a signed int. The\nfunction does not ensure that max is at least skb_headlen(skb).\n\nThis can happen while parsing IPv6 extension headers when an skb already\nhas a linear area larger than MAX_IPV6_HDR_LEN. Once the parser needs data\nbeyond the linear area, max - skb_headlen(skb) wraps and is converted to a\nnegative delta. __pskb_pull_tail() then passes that negative length to\nskb_copy_bits(), where it can become a very large copy length.\n\nPass the requested length itself as the pull bound at the three\nextension-header call sites, so the delta can no longer go negative.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98573" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b4e0b0c008a8c1b474730248cd5b873026c74bd", "url": "https://git.kernel.org/stable/c/3b4e0b0c008a8c1b474730248cd5b873026c74bd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b", "url": "https://git.kernel.org/stable/c/6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/718747afa5463d9cc5fd9a09f03b2a492edd9b78", "url": "https://git.kernel.org/stable/c/718747afa5463d9cc5fd9a09f03b2a492edd9b78" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9c4e432132a97b82edf28fa172c39f743e6bfb26", "url": "https://git.kernel.org/stable/c/9c4e432132a97b82edf28fa172c39f743e6bfb26" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a0ad0473c09d2e947aecac5c82e637ec85924b12", "url": "https://git.kernel.org/stable/c/a0ad0473c09d2e947aecac5c82e637ec85924b12" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b2da5ed3d8c75e1b729a21b6d3beaed415e263f6", "url": "https://git.kernel.org/stable/c/b2da5ed3d8c75e1b729a21b6d3beaed415e263f6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962", "url": "https://git.kernel.org/stable/c/cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d7f474226809471dc7877435e9c492cc914df0bf", "url": "https://git.kernel.org/stable/c/d7f474226809471dc7877435e9c492cc914df0bf" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98687", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Reject oversized XDomain properties responses\n\ntb_xdp_properties_request() allocates room for 45 data dwords in its\n252-byte response buffer. The XDomain length field is six bits wide,\nhowever, and a malicious peer can set it to 63. After the fixed response\nfields are subtracted, the driver treats this as 48 data dwords.\n\nCommit 322e93448d90 (\"thunderbolt: Clamp XDomain response data copy to\nallocation size\") only bounds the copy against data_len. If data_len is\nat least 48, memcpy() reads 192 bytes from the 180-byte res->data array,\ncausing a 12-byte heap out-of-bounds read. Commit 4db2bd2ed478\n(\"thunderbolt: Limit XDomain response copy to actual frame size\") limits\nthe earlier copy but does not constrain this header-derived length.\n\nReject response data lengths that exceed the allocated source buffer\nbefore copying them into the assembled property block.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98687" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2f97f929dad9eb3e1f63b721d2dd49bf9bc68efa", "url": "https://git.kernel.org/stable/c/2f97f929dad9eb3e1f63b721d2dd49bf9bc68efa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/737a1d2e9642d5f718bd29aa4a98b9eef3832f0a", "url": "https://git.kernel.org/stable/c/737a1d2e9642d5f718bd29aa4a98b9eef3832f0a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/80756e263846ab694984e749e8c626897331438f", "url": "https://git.kernel.org/stable/c/80756e263846ab694984e749e8c626897331438f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a766a86ff48acee76aeb8e2575771040749e509d", "url": "https://git.kernel.org/stable/c/a766a86ff48acee76aeb8e2575771040749e509d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b270c1074860de74da0d6b5250fb06b359b9d509", "url": "https://git.kernel.org/stable/c/b270c1074860de74da0d6b5250fb06b359b9d509" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80613", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: fix NAPI leak in XDP enable error path\n\nDuring XDP enablement in veth, if xdp_rxq_info_reg() or\nxdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.\n\nHowever, the rollback loop:\n\tfor (i--; i >= start; i--) {\n\ndecrements the loop index 'i' before the first iteration. This\ncorrectly skips unregistering the rxq for the failed index 'i' (as\nregistration failed or was already cleaned up), but it also\nerroneously skips calling netif_napi_deli() for rq[i].xdp_napi.\n\nSince netif_napi_add() was already called for index 'i', this leaves\na dangling napi_struct in the device's napi_list. When the veth\ndevice is later destroyed, the freed queue memory (which contains the\nleaked NAPI structure) can be reused.\n\nThe subsequent device teardown iterates the NAPI list and\ncorrupts the reallocated memory, leading to UAF.\n\nFix this by explicitly deleting the NAPI association for the failed\nindex 'i' before rolling back the successfully configured queues.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80613" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4559770b2a241344d762719e674241fcc8528f02", "url": "https://git.kernel.org/stable/c/4559770b2a241344d762719e674241fcc8528f02" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4bd2e5dbe62334aae1182d0f0d260f334a49d739", "url": "https://git.kernel.org/stable/c/4bd2e5dbe62334aae1182d0f0d260f334a49d739" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6739027cb72da26890edd424c77080d187b2a92e", "url": "https://git.kernel.org/stable/c/6739027cb72da26890edd424c77080d187b2a92e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/83090f5e7b54721d71875a6c224d2490b9e73050", "url": "https://git.kernel.org/stable/c/83090f5e7b54721d71875a6c224d2490b9e73050" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a9e6707322ef215d39d4655b176c094f45f0ab52", "url": "https://git.kernel.org/stable/c/a9e6707322ef215d39d4655b176c094f45f0ab52" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d3eb258ad398cc9402bab3a5e730cd7c5b34efad", "url": "https://git.kernel.org/stable/c/d3eb258ad398cc9402bab3a5e730cd7c5b34efad" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fc51373345e7e6ea73da2650cb497309c50b077a", "url": "https://git.kernel.org/stable/c/fc51373345e7e6ea73da2650cb497309c50b077a" } ], "release_date": "2026-08-28T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98606", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: release the GEM object on virtio_gpu_vram_create() errors\n\nvirtio_gpu_vram_create() frees the object with a bare kfree(vram) on\nboth error paths after drm_gem_private_object_init() has run, and on the\nsecond one after drm_gem_create_mmap_offset() has linked obj->vma_node\ninto the device's VMA offset manager. The freed object stays in that\ninterval tree, so a later lookup or insertion walks freed memory, and\nthe dma_resv and gpuva lock are never destroyed.\n\nCall drm_gem_object_release() before kfree() on both paths.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98606" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/036d28db1818af2f9d80db771f5405da84d7732d", "url": "https://git.kernel.org/stable/c/036d28db1818af2f9d80db771f5405da84d7732d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/03bdbf182082694ab2add620d85f1a8b8f51bbbc", "url": "https://git.kernel.org/stable/c/03bdbf182082694ab2add620d85f1a8b8f51bbbc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5118b5fdf1eb9922a0cdd2afd25252081e2d4302", "url": "https://git.kernel.org/stable/c/5118b5fdf1eb9922a0cdd2afd25252081e2d4302" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5c2cb3dd1447752b73d4f44d6b7434bc5259bfec", "url": "https://git.kernel.org/stable/c/5c2cb3dd1447752b73d4f44d6b7434bc5259bfec" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c8deb77d05bcc8f79e255f669d82ec6ce91be12", "url": "https://git.kernel.org/stable/c/7c8deb77d05bcc8f79e255f669d82ec6ce91be12" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/977c2934064969503cabf98b1135d202ff62822e", "url": "https://git.kernel.org/stable/c/977c2934064969503cabf98b1135d202ff62822e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a9bb8f8fd5694185c2f71ff91869afb300aab392", "url": "https://git.kernel.org/stable/c/a9bb8f8fd5694185c2f71ff91869afb300aab392" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98602", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough\n\nFix multiple out-of-bounds reads in Bluetooth BNEP frame processing:\n\n1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c),\n use pskb_may_pull() to verify the BNEP header, control type byte,\n filter count, and extension headers exist before reading them, and\n return 0 after handling BNEP_CONTROL instead of falling through to\n Ethernet frame submission when no extension headers follow.\n2. In bnep_net_xmit() (net/bluetooth/bnep/netdev.c), verify skb->len >=\n ETH_HLEN with pskb_may_pull() before reading the 14-byte Ethernet\n header to prevent an out-of-bounds heap read and infoleak on short\n AF_PACKET TX frames.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98602" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/035f9b1809861967e58ce652680d70ea1502058f", "url": "https://git.kernel.org/stable/c/035f9b1809861967e58ce652680d70ea1502058f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1e7aebc188f889b56c3aaeb6133ef6d77022c887", "url": "https://git.kernel.org/stable/c/1e7aebc188f889b56c3aaeb6133ef6d77022c887" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3e605ff5932afe0970c2beca66f2f1ba2babe4dd", "url": "https://git.kernel.org/stable/c/3e605ff5932afe0970c2beca66f2f1ba2babe4dd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/667aa703e11cdc237d169393bc6a5ea9acbb33c2", "url": "https://git.kernel.org/stable/c/667aa703e11cdc237d169393bc6a5ea9acbb33c2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7af80ad2cebfe2f1879d6a39a1aaa061d9c4e1ca", "url": "https://git.kernel.org/stable/c/7af80ad2cebfe2f1879d6a39a1aaa061d9c4e1ca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f31031326994d1abfcc6ebb6927ef96e51fb9ff", "url": "https://git.kernel.org/stable/c/8f31031326994d1abfcc6ebb6927ef96e51fb9ff" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ad0d2d4ada51321db787262ef343193c712b76b5", "url": "https://git.kernel.org/stable/c/ad0d2d4ada51321db787262ef343193c712b76b5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f0ca020cbb9bb7f3f4ea8ba1dfcf30a282aec91e", "url": "https://git.kernel.org/stable/c/f0ca020cbb9bb7f3f4ea8ba1dfcf30a282aec91e" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64330", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: Validate SVID index in svdm_consume_modes()\n\nIn svdm_consume_modes(), the SVID value is read from pmdata->svids using\npmdata->svid_index as an array index without bounds validation:\n\n paltmode->svid = pmdata->svids[pmdata->svid_index];\n\nIf pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results\nin an out-of-bounds read of the pmdata->svids array. Because pd_mode_data\nis embedded inside struct tcpm_port, indexing past svids reads into\nadjacent fields. In particular:\n- At index 16, it reads the altmodes count.\n- At index 18 and beyond, it reads into altmode_desc[], which contains\n partner-supplied SVDM Discovery Modes VDOs.\n\nBy injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index\nto 20, the partner can force paltmode->svid to be loaded with an arbitrary,\npartner- chosen SVID, which is then registered via\ntypec_partner_register_altmode().\n\nFix this by validating that pmdata->svid_index is non-negative and strictly\nless than pmdata->nsvids before accessing the pmdata->svids array inside\nsvdm_consume_modes().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64330" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407", "url": "https://git.kernel.org/stable/c/012406f89abc52d1d5f07aa5653b519ebf6d2407" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b", "url": "https://git.kernel.org/stable/c/313ca06e7e224ca1dfadd5722fe71fb8bc276b8b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4", "url": "https://git.kernel.org/stable/c/3e1b1ac47e8163627f159f30d80d51b914620dd4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491", "url": "https://git.kernel.org/stable/c/7b681dd5fbf60b24a13c14661e5b7735759fb491" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53", "url": "https://git.kernel.org/stable/c/89ff289cbf5d3b659a2babc5ccaae4eaf7e7cf53" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f", "url": "https://git.kernel.org/stable/c/c6d2af3b217a525741c472f0ab45d7d274b8468f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c", "url": "https://git.kernel.org/stable/c/d638ec188e95fe60f4b01106ffd41958f8fb3c2c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad", "url": "https://git.kernel.org/stable/c/f8163c414de8640f2ca82ce4dc93409d4cdc2fad" } ], "release_date": "2026-07-25T10:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-74446", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: hold event_mutex while checkpointing CRIU events\n\nkfd_criu_checkpoint_events() counts the entries in p->event_idr via\nkfd_get_num_events(), allocates an array sized to that count, and then\nwalks the same IDR to fill it. Neither the count nor the walk holds\np->event_mutex.\n\nThe CRIU checkpoint caller holds only p->mutex. Event create and destroy\n(kfd_event_create()/kfd_event_destroy()) take p->event_mutex and do not\ntake p->mutex, so a second thread in the same process can insert or remove\nevents between the count and the walk. If an event is inserted, the walk\niterates more entries than were counted and writes past the end of the\nev_privs allocation; if an event is removed, the walk dereferences an\nentry that is being freed.\n\nHold p->event_mutex across the count and the walk so both observe a\nconsistent view of p->event_idr. The lock is released before\ncopy_to_user(), which only touches the local buffer. The caller already\nholds p->mutex and the create/destroy paths never take p->mutex, so the\np->mutex -> p->event_mutex order is not inverted and no deadlock is\nintroduced.\n\n(cherry picked from commit ff57e223ab105795b05d3ef3f3c35a5a441bcbaa)", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74446" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2040b7e39027cb83bb8c7b84a4c95c2f6053c32f", "url": "https://git.kernel.org/stable/c/2040b7e39027cb83bb8c7b84a4c95c2f6053c32f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6a52f48157fa7fb81e0c146937fd6c8b0c1cfdbd", "url": "https://git.kernel.org/stable/c/6a52f48157fa7fb81e0c146937fd6c8b0c1cfdbd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f7196f25b14f4290738639a50459b56a5ff2784", "url": "https://git.kernel.org/stable/c/8f7196f25b14f4290738639a50459b56a5ff2784" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9a7f765985f64fd4a7a58f7bc9cd80a1f4230628", "url": "https://git.kernel.org/stable/c/9a7f765985f64fd4a7a58f7bc9cd80a1f4230628" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bed80be08c0bee47fa242a4256ac873477c815f8", "url": "https://git.kernel.org/stable/c/bed80be08c0bee47fa242a4256ac873477c815f8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2", "url": "https://git.kernel.org/stable/c/ff8bc5a68a9a70bdc38d61a72c7a49c56063f9d2" } ], "release_date": "2026-08-15T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98739", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix initial port reference race\n\nFor RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and\n__rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the\ninitial tty_port reference. The release path tests the bit separately\nfrom the install path setting it, so both can drop that reference.\n\nThe synchronous hangup does not prevent this race: port->tty is not\nassigned until tty_port_open(), after installation. The following\ninterleaving is possible:\n\n 1. Install and release each obtain a reference with rfcomm_dev_get().\n 2. Release observes RFCOMM_TTY_OWNED clear.\n 3. Install sets RFCOMM_TTY_OWNED and drops the initial reference.\n 4. Release drops the same initial reference again.\n 5. TTY cleanup drops its reference and frees the device.\n 6. Release performs its final tty_port_put() on the freed port.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190\n Write of size 4 at addr ffff8881001d3d5c by task poc/92\n\n Call Trace:\n tty_port_put+0x22/0x190\n rfcomm_dev_ioctl+0x1d4/0x1930\n sock_do_ioctl+0x110/0x260\n sock_ioctl+0x380/0x590\n __x64_sys_ioctl+0x134/0x1c0\n\n Allocated by task 88:\n rfcomm_dev_ioctl+0x8f6/0x1930\n sock_do_ioctl+0x110/0x260\n sock_ioctl+0x380/0x590\n __x64_sys_ioctl+0x134/0x1c0\n\n Freed by task 65:\n kfree+0x131/0x3c0\n rfcomm_dev_destruct+0x23b/0x2f0\n release_one_tty+0xc1/0x370\n process_one_work+0x661/0x1090\n\nUse test_and_set_bit() in both paths so that only the caller that changes\nRFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path\nkeeps its own lookup reference until release or TTY cleanup, preserving\nthe existing callback ordering and error handling.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98739" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0a554901bd227537f79220443b2b36d585d62893", "url": "https://git.kernel.org/stable/c/0a554901bd227537f79220443b2b36d585d62893" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2d696c1ed3468dcb62578a3911e687110d463520", "url": "https://git.kernel.org/stable/c/2d696c1ed3468dcb62578a3911e687110d463520" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9", "url": "https://git.kernel.org/stable/c/55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a03ccf1ab77380d4c4a3c56552e12de4a83efa21", "url": "https://git.kernel.org/stable/c/a03ccf1ab77380d4c4a3c56552e12de4a83efa21" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b", "url": "https://git.kernel.org/stable/c/e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-97517", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: reject beacons with bad HE operation\n\nThe HE operation element not only needs to be longer than\nthe fixed part, but also have an appropriate size for the\nvariable part inside of it. Check this.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97517" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0d635f0b4a634eb599ed13a87ece0b5f129f9900", "url": "https://git.kernel.org/stable/c/0d635f0b4a634eb599ed13a87ece0b5f129f9900" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6c4bb5450b9d9111faaaba581ea45a3a79844e50", "url": "https://git.kernel.org/stable/c/6c4bb5450b9d9111faaaba581ea45a3a79844e50" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6e24f72985782013bf2feb0f0712b2ac9390e909", "url": "https://git.kernel.org/stable/c/6e24f72985782013bf2feb0f0712b2ac9390e909" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8b9a100e1a76c52988b31099b349fd95a58c8768", "url": "https://git.kernel.org/stable/c/8b9a100e1a76c52988b31099b349fd95a58c8768" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8fe5eb7b68d76b3801409ada7365c67696e7af84", "url": "https://git.kernel.org/stable/c/8fe5eb7b68d76b3801409ada7365c67696e7af84" } ], "release_date": "2026-09-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89533", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Fix offset arithmetic in read_chunk_range\n\nsvc_rdma_read_chunk_range() walks a Read chunk's segment list to\nbuild a sub-range starting at byte offset and spanning length bytes\nfor a Position-Zero or Call chunk. Two arithmetic defects in the\nper-segment loop produce wrong DMA lengths and a u32 underflow:\n\n pcl_for_each_segment(segment, chunk) {\n if (offset > segment->rs_length) {\n offset -= segment->rs_length;\n continue;\n }\n\n dummy.rs_handle = segment->rs_handle;\n dummy.rs_length = min_t(u32, length,\n segment->rs_length) - offset;\n dummy.rs_offset = segment->rs_offset + offset;\n\nFirst, the skip predicate uses '>' instead of '>='. When offset\nequals the segment's full rs_length, the segment is fully consumed\nand should be skipped, but the loop falls through into the body.\nThe resulting dummy.rs_length is min_t(u32, length, rs_length) -\nrs_length, which underflows to a near-UINT_MAX u32 when length is\nsmaller than rs_length, or is zero otherwise.\n\nSecond, the length formula subtracts offset from the min_t() result\nrather than from segment->rs_length before the cap. For offset > 0\nthe segment's residual is rs_length - offset, not rs_length, so the\ncap must be applied to the residual. With the current bracketing,\nwhenever length is smaller than rs_length - offset the per-segment\nlength becomes length - offset instead of length, silently dropping\noffset bytes from the rebuilt chunk. Combined with the boundary\ncase above it also enables the u32 underflow path, which propagates\na huge nr_bvec into svc_rdma_build_read_segment() and a multi-MiB\nkmalloc_array_node() in svc_rdma_get_rw_ctxt().\n\nAdditionally, svc_rdma_read_call_chunk() can invoke this function\nwith length == 0 when the last Read chunk ends exactly at the end\nof the Call chunk. With the corrected >= predicate, every segment\nis skipped and the function returns the initial -EINVAL, rejecting\na valid request. Return success immediately when length is zero.\nAlso break out of the loop once length is fully consumed to avoid\npassing zero-length segments to svc_rdma_build_read_segment().\n\nFix by using '>=' so a fully-consumed segment is skipped, by\nmoving '- offset' inside min_t() so the cap is applied to the\nsegment's residual length, by returning success for zero-length\nrequests, and by stopping iteration when the requested range has\nbeen consumed.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89533" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/10873311f91db9454e2fadbf9866bc819e0646d9", "url": "https://git.kernel.org/stable/c/10873311f91db9454e2fadbf9866bc819e0646d9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4493c96bbd0068fadf69cbae8d13426202e34cdc", "url": "https://git.kernel.org/stable/c/4493c96bbd0068fadf69cbae8d13426202e34cdc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e", "url": "https://git.kernel.org/stable/c/4a44c140cc2f3643a39e258bb0c0ab9d0f494f5e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6ee4dc7476b3abc92ec1d444533a559f33f59561", "url": "https://git.kernel.org/stable/c/6ee4dc7476b3abc92ec1d444533a559f33f59561" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a46b35f213c2426f5d6a0458a8f7e873fc59cdfd", "url": "https://git.kernel.org/stable/c/a46b35f213c2426f5d6a0458a8f7e873fc59cdfd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/addbf02dfe3b25e7e38e03bbd4e2a6ed86a14be7", "url": "https://git.kernel.org/stable/c/addbf02dfe3b25e7e38e03bbd4e2a6ed86a14be7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cba8543c18cf42fd80fd63effb6df6ff4f7e73ce", "url": "https://git.kernel.org/stable/c/cba8543c18cf42fd80fd63effb6df6ff4f7e73ce" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89653", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode\n\nMDSMap export_targets entries are monitor controlled. check_new_map()\nuses each entry as a bit number in a fixed stack bitmap, so a rank\noutside the protocol namespace can make set_bit() write past the end of\nthe array.\n\nReject ranks outside CEPH_MAX_MDS while decoding the map. Do not\nvalidate against possible_max_rank here because maps may legitimately\nreference ranks beyond a temporarily reduced max_mds.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89653" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3740c88ca9cb2210a8dbdd55ea4cec119fbe86fe", "url": "https://git.kernel.org/stable/c/3740c88ca9cb2210a8dbdd55ea4cec119fbe86fe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4d298880f82c42383b36946bafde7ccf4d804c9b", "url": "https://git.kernel.org/stable/c/4d298880f82c42383b36946bafde7ccf4d804c9b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/736adee11af36e407ed902264f8b2fb5cf94b62f", "url": "https://git.kernel.org/stable/c/736adee11af36e407ed902264f8b2fb5cf94b62f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c823bbab3c24e657469a84db96902ba82d4e8bb", "url": "https://git.kernel.org/stable/c/8c823bbab3c24e657469a84db96902ba82d4e8bb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/96c3f5fbb0d5386e7111426f047f98cec4586674", "url": "https://git.kernel.org/stable/c/96c3f5fbb0d5386e7111426f047f98cec4586674" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aedc9053d909508a5f56c3f49f885fc030df4730", "url": "https://git.kernel.org/stable/c/aedc9053d909508a5f56c3f49f885fc030df4730" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c4addccd05bacbef2144b4db14853d0308a218ac", "url": "https://git.kernel.org/stable/c/c4addccd05bacbef2144b4db14853d0308a218ac" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T12:17:33.001748Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651", "product_ids": [ "CentOS-Stream-8:bpftool-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-cross-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-core-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-debug-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.i686", "CentOS-Stream-8:kernel-headers-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-ipaclones-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-extra-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-modules-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-selftests-internal-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:kernel-tools-libs-devel-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64", "CentOS-Stream-8:python3-perf-0:4.18.0-553.6.1.el8_10.tuxcare.els34.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793362651" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }