{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}\n- media: av7110: prevent underflow in write_ts_to_decoder() {CVE-2023-54284}\n- usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}\n- usb: usbfs: fix use-after-free of usb_device in usbdev_release() {CVE-2026-80824}\n- HID: alps: fix use-after-free on input2 registration failure {CVE-2026-98501}\n- scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() {CVE-2023-53754}\n- net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494}\n- net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read {CVE-2026-98488}\n- net: atl1c: fix soft lockup on out-of-range tpd_cons read {CVE-2026-98489}\n- net: ena: fix MMIO read buffer leak on probe failure {CVE-2026-98486}\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}\n- net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015}\n- RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}\n- net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351}\n- dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}\n- ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}\n- NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}\n- btrfs: fix race when deleting free space root from the dirty cow roots list {CVE-2023-54067}\n- libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}\n- nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965}\n- NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}\n- vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}\n- ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}\n- net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377}\n- RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}\n- ALSA: usbusx2y: validate URB actual_length in interrupt callback {CVE-2026-97929}\n- ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf {CVE-2026-97930}\n- udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}\n- PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}\n- wifi: iwlwifi: mvm: validate TX_CMD response layout {CVE-2026-93793}\n- smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid {CVE-2026-97561}\n- wifi: brcmfmac: fix P2P action frame handling without device vif {CVE-2026-90345}\n- IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}\n- IB/isert: delay the final Login Response until the session is registered {CVE-2026-90294}\n- NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151}\n- sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}\n- RDMA/core: Reject unregistering netdevs in ib_get_eth_speed {CVE-2026-98359}\n- ipv6: mcast: use rcu_assign_pointer() for __rcu list updates {CVE-2026-98099}\n- wifi: cfg80211: reject duplicate wiphy cipher suite entries {CVE-2026-97518}\n- IB/iser: reject a remote invalidation of an unregistered direction {CVE-2026-98358}\n- ext4: validate readdir offset before accessing dirent {CVE-2026-92499}\n- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048}\n- misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}\n- ACPI: bus: Introduce acpi_bus_get_primary_device() {CVE-2026-93251}\n- scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}\n- smb: client: reject a tree connect response whose byte count is too small {CVE-2026-89631}\n- tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847}\n- fsnotify: Fix stale object mask after concurrent mark updates {CVE-2026-89595}\n- smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions {CVE-2026-89638}\n- sunrpc: init gssp_lock before publishing proc entry {CVE-2026-89540}\n- selinux: reject an unclaimed class value in security_get_classes() {CVE-2026-80912}\n- net: skbuff: don't touch shared zerocopy state in skb_tx_error() {CVE-2026-80977}\n- xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783}\n- PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() {CVE-2026-89722}\n- svcrdma: Use svc_xprt_put to free listener on create failure {CVE-2026-89527}\n- ALSA: usb-audio: Complete cleanup after system-resume errors {CVE-2026-80828}\n- media: av7110: fix a spectre vulnerability {CVE-2024-50289}\n- net: read sk->sk_family once in sk_mc_loop() {CVE-2023-53831}\n- vt: prevent kernel-infoleak in con_font_get() {CVE-2024-50076}\n- hwrng: amd - Fix PCI device refcount leak {CVE-2022-50868}\n- configfs: fix possible memory leak in configfs_create_dir() {CVE-2022-50751}\n- pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP {CVE-2022-50849}\n- nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops {CVE-2026-89666}\n- wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function {CVE-2023-53802}\n- wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() {CVE-2022-50709}\n- Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept {CVE-2026-80819}\n- ipvs: use parsed transport offset in TCP state lookup {CVE-2026-80875}\n- USB: serial: option: fix slab OOB read in interrupt URB callback {CVE-2026-80827}\n- lockd: pin next file across nlm_inspect_file lock-drop {CVE-2026-89485}\n- scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() {CVE-2026-89515}\n- SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784}\n- nfsd: gate nfs2 setacl by argp->mask {CVE-2026-89672}\n- SUNRPC: harden gss_unwrap_resp_priv length checks {CVE-2026-89541}\n- HID: picolcd: clamp eeprom debugfs read to bytes actually received {CVE-2026-89628}\n- ALSA: 6fire: bound the MIDI event length from the device {CVE-2026-80973}\n- NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}\n- net: macb: drop in-flight Tx SKBs on close {CVE-2026-72017}\n- KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs {CVE-2026-72284}\n- power: supply: core: fix supplied_from allocations {CVE-2026-74271}\n- tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions {CVE-2026-80689}\n- binfmt_misc: reject a flag character as the field delimiter {CVE-2026-74485}\n- fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}\n- drm/radeon: fix integer overflow in radeon_align_pitch() {CVE-2026-74417}\n- bonding: refuse to enslave CAN devices {CVE-2026-63990}\n- selinux: check connect-related permissions on TCP Fast Open {CVE-2026-72243}\n- configfs: fix lockless traversals of ->s_children {CVE-2026-74330}\n- ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump {CVE-2026-72392}\n- net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds {CVE-2026-74544}\n- netfilter: nf_nat_sip: reload possible stale data pointer {CVE-2026-72251}\n- ipvs: ensure inner headers in ICMP errors are in headroom {CVE-2026-72319}\n- ipvs: use parsed transport offset in SCTP state lookup {CVE-2026-72021}\n- ipvs: pass parsed transport offset to state handlers {CVE-2026-72021}\n- HID: hyperv: validate initial device info bounds {CVE-2026-80765}\n- HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() {CVE-2026-80783}\n- ALSA: seq: oss: Serialize readq reset state with q->lock {CVE-2026-80628}\n- ipv4: fib: Don't ignore error route in local/main tables. {CVE-2026-72421}\n- netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag {CVE-2026-72250}\n- netfilter: xt_nat: reject unsupported target families {CVE-2026-80664}\n- netfilter: xt_u32: reject invalid shift counts {CVE-2026-72350}\n- can: softing: fw_parse(): validate firmware record spans {CVE-2026-80706}\n- mmc: vub300: defer reset until cmd_mutex is unlocked {CVE-2026-80659}\n- usb: xhci: Fix sleep in atomic context in xhci_free_streams() {CVE-2026-64465}\n- x86/boot: Validate console=uart8250 baud rate to fix early boot hang {CVE-2026-72238}\n- net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF {CVE-2026-72390}\n- ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}\n- ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() {CVE-2026-72321}\n- ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}\n- drm/amdkfd: Avoid integer underflow in EOP ring size calculation. {CVE-2026-98177}\n- dm thin metadata: fix metadata snapshot consistency on commit failure {CVE-2026-72108}\n- tcp: challenge ACK for non-exact RST in SYN-RECEIVED {CVE-2026-68118}\n- sctp: avoid auth_enable sysctl UAF during netns teardown {CVE-2026-68162}\n- drm/amd/display: use kvzalloc to allocate struct dc {CVE-2026-68436}\n- KVM: x86/mmu: Fix use-after-free on vendor module reload {CVE-2026-68428}\n- ftrace: Add global mutex to serialize trace_parser access {CVE-2026-68146}\n- wifi: mwifiex: bound uAP association event IEs to the event buffer {CVE-2026-68326}\n- IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357}\n- reboot: fix cad_pid use-after-free race {CVE-2026-97938}\n- wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock {CVE-2026-68405}\n- wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() {CVE-2024-47713}\n- wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length {CVE-2026-98186}\n- Update to kernel 3.10.0-1160.167.2.el7 (its only change, CVE-2026-99999, is already carried)", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos7els/advisories/2026/clsa-2026_1792976962.json" } ], "tracking": { "current_release_date": "2026-10-30T02:03:22Z", "generator": { "date": "2026-10-30T02:03:22Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1792976962", "initial_release_date": "2026-10-26T01:09:24Z", "revision_history": [ { "date": "2026-10-26T01:09:24Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-30T02:03:22Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "kernel: Fix of 118 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 7", "product": { "name": "Community Enterprise Operating System 7", "product_id": "CentOS-7", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product": { "name": "kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_id": "kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-debug-devel@3.10.0-1160.167.2.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product": { "name": "kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_id": "kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel@3.10.0-1160.167.2.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product": { "name": "kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_id": "kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-tools-libs-devel@3.10.0-1160.167.2.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product": { "name": "kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_id": "kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-tools-libs@3.10.0-1160.167.2.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product": { "name": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_id": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-headers@3.10.0-1160.167.2.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product": { "name": "kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_id": "kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-devel@3.10.0-1160.167.2.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product": { "name": "perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_id": "perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/perf@3.10.0-1160.167.2.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product": { "name": "python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_id": "python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/python-perf@3.10.0-1160.167.2.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product": { "name": "kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_id": "kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-debug@3.10.0-1160.167.2.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product": { "name": "bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_id": "bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/bpftool@3.10.0-1160.167.2.el7.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product": { "name": "kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_id": "kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-tools@3.10.0-1160.167.2.el7.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "product": { "name": "kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "product_id": "kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-doc@3.10.0-1160.167.2.el7.tuxcare.els1?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "product": { "name": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "product_id": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-headers@3.10.0-1160.167.2.el7.tuxcare.els1?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" }, "product_reference": "kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" }, "product_reference": "kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" }, "product_reference": "kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch" }, "product_reference": "kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" }, "product_reference": "kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" }, "product_reference": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686" }, "product_reference": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" }, "product_reference": "kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" }, "product_reference": "perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" }, "product_reference": "python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" }, "product_reference": "kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" }, "product_reference": "bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" }, "product_reference": "kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "relates_to_product_reference": "CentOS-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-89722", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()\n\npci_write_legacy_io() loads 4 bytes from the kernfs write buffer\nregardless of how many bytes userspace wrote:\n\n if (count != 1 && count != 2 && count != 4)\n return -EINVAL;\n\n return pci_legacy_write(bus, off, *(u32 *)buf, count);\n\nkernfs_fop_write_iter() allocates the buffer with kmalloc(len + 1),\nso a 1-byte write to the legacy_io sysfs file allocates 2 bytes and\nthe unconditional u32 load reads up to 2 bytes past the end of the\nallocation, which KASAN reports as a slab-out-of-bounds read.\nSimilarly, a 2-byte write overreads by 1 byte.\n\nThus, read only the number of bytes requested using get_unaligned_le16()\nand get_unaligned_le32() for the 2 and 4 byte cases, interpreting the\nbuffer as little-endian to match the byte ordering of PCI I/O port\nspace.\n\nThe PowerPC implementation previously compensated for the generic\ncode's native-endian 32-bit load by shifting the value into place\nfor the 1 and 2 byte cases. The shifts were only correct on\nbig-endian kernels.\n\nOn little-endian PowerPC (POWER8 and later), they extracted the wrong\nbytes, so a 1-byte write wrote an out-of-bounds byte instead of the\nrequested value. On big-endian, the native load also caused out_le16()\nand out_le32() to reverse the user's bytes on the wire for 2 and 4 byte\nwrites. The little-endian helpers resolve both issues, so the shifts\nare removed.\n\nNo changes are needed for the Alpha platform.\n\nThe legacy_io file is root-only and exists only on Alpha and PowerPC,\nthe two architectures that define HAVE_PCI_LEGACY.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89722" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a99e9c7011905734cc2739038f2a224b6be0d1f", "url": "https://git.kernel.org/stable/c/7a99e9c7011905734cc2739038f2a224b6be0d1f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dc76258d0132df1d831a5a29758bd448ca9c566e", "url": "https://git.kernel.org/stable/c/dc76258d0132df1d831a5a29758bd448ca9c566e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e892f05f1f790d5721cd8e3c561ed76da7e08bae", "url": "https://git.kernel.org/stable/c/e892f05f1f790d5721cd8e3c561ed76da7e08bae" } ], "release_date": "2026-09-11T20:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80827", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: option: fix slab OOB read in interrupt URB callback\n\nThe interrupt URB buffer is allocated in setup_port_interrupt_in() based\non the endpoint's wMaxPacketSize:\n\n buffer_size = usb_endpoint_maxp(epd);\n port->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL);\n\nWhen a USB device declares wMaxPacketSize = 8 on its interrupt IN\nendpoint, the buffer is allocated from kmalloc-8 cache (exactly\n8 bytes).\n\nIf the device sends a short packet (actual_length < wMaxPacketSize),\nthe URB completes with status == 0 and the callback proceeds to read:\n\n data[sizeof(struct usb_ctrlrequest)]\n\nwhich evaluates to data[8], accessing 1 byte beyond the allocated 8-byte\nbuffer. This results in a slab out-of-bounds read.\n\nFix this by adding the missing bounds check: first verify that the\nactual length is large enough to contain the struct usb_ctrlrequest\nheader before accessing req_pkt->bRequestType and req_pkt->bRequest,\nand then verify that there is an additional byte for the modem signal\nstate before reading data[sizeof(struct usb_ctrlrequest)] inside the\nconditional. Use sizeof(*req_pkt) instead of sizeof(struct\nusb_ctrlrequest) for consistency.\n\n[ johan: use dev_err(); split signals declaration and initialisation ]", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80827" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/030e3a73d3c3aa67c44454649e984d6383cdb7d3", "url": "https://git.kernel.org/stable/c/030e3a73d3c3aa67c44454649e984d6383cdb7d3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/060db7d48af1e650643c8b8319111a9ea2ce4486", "url": "https://git.kernel.org/stable/c/060db7d48af1e650643c8b8319111a9ea2ce4486" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2ef5560387f2c0713cee975be2b24b281bd90f3e", "url": "https://git.kernel.org/stable/c/2ef5560387f2c0713cee975be2b24b281bd90f3e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b8cf5422c7e96ed5b22a8368eff663f3f98b8ec", "url": "https://git.kernel.org/stable/c/6b8cf5422c7e96ed5b22a8368eff663f3f98b8ec" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/885d802f544ca7bfa8f3984d94233cce715bb6b3", "url": "https://git.kernel.org/stable/c/885d802f544ca7bfa8f3984d94233cce715bb6b3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/94e5525697b9e91ddc4071129874120a50a4f342", "url": "https://git.kernel.org/stable/c/94e5525697b9e91ddc4071129874120a50a4f342" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a72a13c83a652516a0e469d275b81d29a7429049", "url": "https://git.kernel.org/stable/c/a72a13c83a652516a0e469d275b81d29a7429049" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d762aef4eba354066be21a5d88eb2066e282f4c9", "url": "https://git.kernel.org/stable/c/d762aef4eba354066be21a5d88eb2066e282f4c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fbe60fd2abc8a5561f39719a41ad9a01b5d8e567", "url": "https://git.kernel.org/stable/c/fbe60fd2abc8a5561f39719a41ad9a01b5d8e567" } ], "release_date": "2026-09-04T16:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89666", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops\n\nA client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD\ncarrying an atime or mtime whose nseconds field is out of range. The\nvalue is well-formed on the wire and decodes cleanly into a valid\nuint32, but it is not a valid timespec64: tv_nsec must be less than\nNSEC_PER_SEC.\n\nNothing in the setattr path clamps it. notify_change() runs the time\nthrough timestamp_truncate(), which does not reduce tv_nsec below\nNSEC_PER_SEC when the filesystem supports nanosecond granularity\n(s_time_gran == 1), and the inode atime/mtime setters store it verbatim\n(only ctime is normalized, via inode_set_ctime_to_ts()). The\nun-normalized value then corrupts on-disk metadata: ext4's\next4_encode_extra_time() shifts tv_nsec left by EXT4_EPOCH_BITS, which\noverflows the 32-bit extra field and clobbers the seconds-epoch bits, so\nthe stored seconds (and thus the year) are wrong on read-back. XFS with\nbigtime mis-stores the timestamp for the same reason.\n\nValidate the client-supplied atime/mtime in the proc handlers and return\nNFS3ERR_INVAL before anything is changed. RFC 1813 lists NFS3ERR_INVAL\nfor SETATTR and describes it as the error for a value the server 'can\nnot store ... in its own representation'; the client maps it to EINVAL.\n\nChecking in the proc handlers, rather than in nfsd_setattr(), keeps the\nrejection in front of object creation. The create operations create the\nobject before nfsd_create_setattr() runs, so a late failure would leave\nthe new object behind and turn a non-idempotent request into a namespace\nchange that reports failure. The check is therefore done up front, for\nthe create operations before the object is created.\n\ntv_nsec is a long, so the comparison casts it to unsigned long (the same\nwidth) rather than to u32, matching timespec64_valid(). A u32 cast would\ntruncate on 64-bit; the unsigned long cast also rejects a value that\nbecame negative when an out-of-range u32 wire nseconds was assigned to a\n32-bit long.\n\nOnly client-supplied times are checked: SET_TO_SERVER_TIME requests\ncarry no client value. The sattrguard3 ctime is deliberately left alone:\nan out-of-range guard simply never matches the object's ctime and yields\nNFS3ERR_NOT_SYNC via the existing guardtime comparison, which is the\nprotocol-correct outcome rather than rejecting the request.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89666" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/54e02f5e32c52fb395f2ee02986a6c6d5608d22b", "url": "https://git.kernel.org/stable/c/54e02f5e32c52fb395f2ee02986a6c6d5608d22b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/55341d8a5a0f5853e70d46f5a55cf06007808f1d", "url": "https://git.kernel.org/stable/c/55341d8a5a0f5853e70d46f5a55cf06007808f1d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/98fc1d21a7b80324ba64b949ac6bcc00364dd068", "url": "https://git.kernel.org/stable/c/98fc1d21a7b80324ba64b949ac6bcc00364dd068" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e2543852152bcf9aeb57da17d9f9219f7df8aafb", "url": "https://git.kernel.org/stable/c/e2543852152bcf9aeb57da17d9f9219f7df8aafb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eb0eca7720662ba5847df1510e73801f7f473094", "url": "https://git.kernel.org/stable/c/eb0eca7720662ba5847df1510e73801f7f473094" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98099", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: use rcu_assign_pointer() for __rcu list updates\n\nSeveral places in net/ipv6/mcast.c update RCU-protected lists\n(np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer\nassignments instead of rcu_assign_pointer():\n\n1. In __ipv6_dev_mc_dec(), unlinking a group from idev->mc_list did:\n *map = ma->next;\n without rcu_assign_pointer() while concurrent readers traverse\n idev->mc_list locklessly under rcu_read_lock().\n2. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group\n from np->ipv6_mc_list directly assigned *lnk = mc_lst->next and\n np->ipv6_mc_list = mc_lst->next without rcu_assign_pointer(), racing\n with lockless readers in inet6_mc_check().\n3. In __ipv6_sock_mc_join(), mc_lst->next was initialized to\n np->ipv6_mc_list via raw assignment before publishing mc_lst.\n4. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers\n passed into rcu_assign_pointer() lacked explicit dereference helpers.\n\nFix these by consistently using rcu_assign_pointer() along with\nmc_dereference() / sock_dereference().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98099" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315", "url": "https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e3e3cec28c4d1bf29948da40b4e9e5d44f7852b", "url": "https://git.kernel.org/stable/c/0e3e3cec28c4d1bf29948da40b4e9e5d44f7852b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6", "url": "https://git.kernel.org/stable/c/2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/49d7e1b456ba2f3ee08b3e264d999c09992cde8e", "url": "https://git.kernel.org/stable/c/49d7e1b456ba2f3ee08b3e264d999c09992cde8e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/afca229b39acc2590976b3e4f6e0fe76cededc60", "url": "https://git.kernel.org/stable/c/afca229b39acc2590976b3e4f6e0fe76cededc60" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-68326", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: bound uAP association event IEs to the event buffer\n\nmwifiex_process_uap_event() handles EVENT_UAP_STA_ASSOC by exposing the\n(re)association request IEs that the firmware copies into the event:\n\n\tsinfo->assoc_req_ies = &event->data[len];\n\tlen = (u8 *)sinfo->assoc_req_ies - (u8 *)&event->frame_control;\n\tsinfo->assoc_req_ies_len = le16_to_cpu(event->len) - (u16)len;\n\nevent->len is supplied by the device firmware and is never validated,\nand the subtraction is unchecked. assoc_req_ies points into\nadapter->event_body[MAX_EVENT_SIZE], a fixed-size array embedded in the\nkmalloc()'d struct mwifiex_adapter.\n\nOn the ap_11n_enabled path mwifiex_set_sta_ht_cap() walks these IEs with\ncfg80211_find_ie(), whose for_each_element() loop dereferences each\nelement header. A firmware-reported event->len larger than the bytes\nactually received makes assoc_req_ies_len describe IEs that extend past\nevent_body, so the walk reads out of the adapter slab object, a\nslab-out-of-bounds read (KASAN: slab-out-of-bounds in cfg80211_find_ie).\nAn event->len smaller than the header instead makes the int subtraction\nnegative, which wraps to a huge size_t when stored in assoc_req_ies_len.\nThe same length is handed to cfg80211_new_sta(), so a more modest\nover-claim can also copy stale event_body bytes into the\nNL80211_CMD_NEW_STATION notification.\n\nA malicious or malfunctioning mwifiex device (USB/SDIO/PCIe) can deliver\nsuch an event while the interface is in AP/uAP mode.\n\nValidate event->len before use: reject a length that underflows the\nheader or that would place the IEs outside the event_body[] buffer the\nevent was copied into. event->len here is struct mwifiex_assoc_event.len,\na payload field internal to this event, not the transport frame length,\nso it is validated in this handler rather than at the generic\nMWIFIEX_TYPE_EVENT receive path, which only sees the event cause and the\ntransport frame length. The bound is against event_body[MAX_EVENT_SIZE]\nrather than the actually-received length because the transports store the\nevent differently (USB and SDIO leave the 4-byte event header in\nevent_skb, PCIe strips it via skb_pull), whereas event_body is the single\nfixed buffer all of them copy the event into. This is the event-path\nanalogue of the receive-path bounds checks added in commit 119585281617\n(\"wifi: mwifiex: Fix OOB and integer underflow when rx packets\").", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68326" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1ae00b6d9a6c82eb3de151d9b04ed59e06cc100f", "url": "https://git.kernel.org/stable/c/1ae00b6d9a6c82eb3de151d9b04ed59e06cc100f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a3f47d7c75ddad1a14621a309286f9fae3cba191", "url": "https://git.kernel.org/stable/c/a3f47d7c75ddad1a14621a309286f9fae3cba191" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a616616b938f7922a93e79bef16b4643c57c0922", "url": "https://git.kernel.org/stable/c/a616616b938f7922a93e79bef16b4643c57c0922" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ad26c75ae25749313248f06510ebe43b5bf4adcc", "url": "https://git.kernel.org/stable/c/ad26c75ae25749313248f06510ebe43b5bf4adcc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b6766d7ea43edf5de9d5a572bc58b631d09efe4b", "url": "https://git.kernel.org/stable/c/b6766d7ea43edf5de9d5a572bc58b631d09efe4b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d21464d93f8ba464dc3d7b4b31c6e0adcd9f659c", "url": "https://git.kernel.org/stable/c/d21464d93f8ba464dc3d7b4b31c6e0adcd9f659c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e7e93d3e8c240bdb70c41e79d169d74dfb442843", "url": "https://git.kernel.org/stable/c/e7e93d3e8c240bdb70c41e79d169d74dfb442843" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f0858bfc7d3cab411a447b88e3ef970e575032c9", "url": "https://git.kernel.org/stable/c/f0858bfc7d3cab411a447b88e3ef970e575032c9" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-50868", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: amd - Fix PCI device refcount leak\n\nfor_each_pci_dev() is implemented by pci_get_device(). The comment of\npci_get_device() says that it will increase the reference count for the\nreturned pci_dev and also decrease the reference count for the input\npci_dev @from if it is not NULL.\n\nIf we break for_each_pci_dev() loop with pdev not NULL, we need to call\npci_dev_put() to decrease the reference count. Add the missing\npci_dev_put() for the normal and error path.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-50868" } ], "release_date": "2025-12-30T12:15:39Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-68436", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: use kvzalloc to allocate struct dc\n\nstruct dc has grown large over time (most of it the two inlined\ndc_scratch_space copies) and now sits close to the page allocator's 4 MiB\ncontiguous allocation limit. Its actual size is not fixed by the source\nalone, it also depends on the compiler and the .config, so it can easily\ncross 4 MiB, e.g. with a newer GCC or a config change.\n\ndc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the\nrequest is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER,\nso the page allocator warns and returns NULL. dc_create() then fails, DM\ninit fails and amdgpu probe aborts with -EINVAL:\n\n WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380\n dc_create+0x38/0x660 [amdgpu]\n amdgpu_dm_init+0x2d9/0x510 [amdgpu]\n dm_hw_init+0x1b/0x90 [amdgpu]\n amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu]\n amdgpu_driver_load_kms+0x19/0x80 [amdgpu]\n amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu]\n\ndc_create() then returns NULL and DM init fails, which aborts the whole\nGPU init and makes amdgpu probe fail with -EINVAL (\"hw_init of IP block\n failed -22\"), leaving the display unusable. The subsequent\namdgpu_irq_put() warnings during teardown are just fallout of unwinding\na half-initialized device.\n\nstruct dc is a software-only bookkeeping structure that is never handed\nto hardware DMA and is only ever kept as an opaque pointer, so it does\nnot require physically contiguous memory. Allocate it with kvzalloc()\n(and free it with kvfree()) so that the allocator can fall back to\nvmalloc() when a contiguous allocation of that size is not available,\nwhich also avoids the MAX_PAGE_ORDER warning entirely.\n\nv2:\n - Rebase to amd-staging-drm-next.\n\n(cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575)", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68436" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/75050390151a14802be433c3856ddcb483cecd24", "url": "https://git.kernel.org/stable/c/75050390151a14802be433c3856ddcb483cecd24" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c59a693fbd213f8f27942509b48b1a4111fdd40d", "url": "https://git.kernel.org/stable/c/c59a693fbd213f8f27942509b48b1a4111fdd40d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dbad70d40cad9c5e7586953275287fe7531fb811", "url": "https://git.kernel.org/stable/c/dbad70d40cad9c5e7586953275287fe7531fb811" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dd8506091e9f1e111d9964f5ec2348d7d5157bf2", "url": "https://git.kernel.org/stable/c/dd8506091e9f1e111d9964f5ec2348d7d5157bf2" } ], "release_date": "2026-08-12T00:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72350", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_u32: reject invalid shift counts\n\nu32_match_it() executes rule-supplied shift operands on a 32-bit\nvalue. A malformed u32 rule can provide a shift count of 32 or more,\ntriggering an undefined shift out-of-bounds during packet evaluation.\n\nValidate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in\nu32_mt_checkentry() and reject malformed rules before they reach the\npacket path.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72350" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/00d034fe8230dfc5832fe011ff2d81c1a2cc7a29", "url": "https://git.kernel.org/stable/c/00d034fe8230dfc5832fe011ff2d81c1a2cc7a29" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0a8b7a6d763775709c601f584e709ae48bcc000a", "url": "https://git.kernel.org/stable/c/0a8b7a6d763775709c601f584e709ae48bcc000a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/64cdf7d30ac18e43df6c48004435febb965809a8", "url": "https://git.kernel.org/stable/c/64cdf7d30ac18e43df6c48004435febb965809a8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/728f479dc0447ae7eaef87926ff49142e415a811", "url": "https://git.kernel.org/stable/c/728f479dc0447ae7eaef87926ff49142e415a811" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a597a722fb71a534138c20359b655726622b5f17", "url": "https://git.kernel.org/stable/c/a597a722fb71a534138c20359b655726622b5f17" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b33b44250d57ab0e5a1e2571b5285fb0d0a7f382", "url": "https://git.kernel.org/stable/c/b33b44250d57ab0e5a1e2571b5285fb0d0a7f382" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ca7c92d9701249e6daf132087756a88cbf2bb2a3", "url": "https://git.kernel.org/stable/c/ca7c92d9701249e6daf132087756a88cbf2bb2a3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cce42014415cecd98aa49b3950e7b02ee7c81268", "url": "https://git.kernel.org/stable/c/cce42014415cecd98aa49b3950e7b02ee7c81268" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80912", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: reject an unclaimed class value in security_get_classes()\n\nsecurity_get_classes() sizes an array by p_classes.nprim and fills it at\nvalue - 1, so a class value the policy never defines leaves a NULL.\nsel_make_classes() passes every entry to sel_make_dir(), reaching the same\nd_alloc_name() dereference as the permission array. The class symbol table\nis allowed to be sparse (policydb_class_isvalid() exists to absorb that),\nbut this getter builds its own array straight from the hash table and has\nno such predicate.\n\nFail the lookup when a value went unclaimed instead of handing out the\nNULL. Conforming policies define every class they declare and are\nunaffected.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80912" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/099869e9343a5f8c22b58497f074b34f63cbf856", "url": "https://git.kernel.org/stable/c/099869e9343a5f8c22b58497f074b34f63cbf856" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd", "url": "https://git.kernel.org/stable/c/22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3480c081c23d559fd9a6921b76955664f2e95153", "url": "https://git.kernel.org/stable/c/3480c081c23d559fd9a6921b76955664f2e95153" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/841aea4d5a25e16273d04cd07a74142b4687e03b", "url": "https://git.kernel.org/stable/c/841aea4d5a25e16273d04cd07a74142b4687e03b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d2e7f7035d6f407119ba5467f7218cc4370844fc", "url": "https://git.kernel.org/stable/c/d2e7f7035d6f407119ba5467f7218cc4370844fc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d8a10899ea3c84b80de72ca8ee9039e9a5156c9a", "url": "https://git.kernel.org/stable/c/d8a10899ea3c84b80de72ca8ee9039e9a5156c9a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e0285bb152211c00900136b66d4b420c14a59094", "url": "https://git.kernel.org/stable/c/e0285bb152211c00900136b66d4b420c14a59094" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f38a71868888285efc9c0ab5b032e23919c5a0a1", "url": "https://git.kernel.org/stable/c/f38a71868888285efc9c0ab5b032e23919c5a0a1" } ], "release_date": "2026-09-04T18:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72321", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()\n\nWhen a timer is deleted and not re-armed in igmp_mod_timer(), or stopped\nin igmp_stop_timer(), the code currently decrements the reference counter\nof the multicast list entry @im using refcount_dec(&im->refcnt).\n\nHowever, both functions can be called from the RCU reader path:\n- igmp_mod_timer() via igmp_heard_query() -> for_each_pmc_rcu()\n- igmp_stop_timer() via igmp_rcv() -> igmp_heard_report()\n\nIf the group im was concurrently removed from the list by ip_mc_dec_group(),\nits reference count might have already been decremented to 1.\n\nIn this case, timer_delete() succeeds, and refcount_dec() decrements\nthe refcount from 1 to 0. Since refcount_dec() does not free the object\nwhen it hits 0 (unlike ip_ma_put()), the im structure is leaked.\n\nFix this by using ip_ma_put(im) instead of refcount_dec(&im->refcnt),\nand deferring the put until after the spinlock is released.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72321" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2d0effadf8d2cc9d006e4c4ab0ab6737aed28d77", "url": "https://git.kernel.org/stable/c/2d0effadf8d2cc9d006e4c4ab0ab6737aed28d77" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36", "url": "https://git.kernel.org/stable/c/3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/40d6360ccf9bcbe17b5cb248a84e8e004aac2faa", "url": "https://git.kernel.org/stable/c/40d6360ccf9bcbe17b5cb248a84e8e004aac2faa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/95128dc74425ec19ed4f2077ccc651e791ff4b75", "url": "https://git.kernel.org/stable/c/95128dc74425ec19ed4f2077ccc651e791ff4b75" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f60ec3058a85447008b88b762c859d336163acb3", "url": "https://git.kernel.org/stable/c/f60ec3058a85447008b88b762c859d336163acb3" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-54284", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: av7110: prevent underflow in write_ts_to_decoder()\n\nThe buf[4] value comes from the user via ts_play(). It is a value in\nthe u8 range. The final length we pass to av7110_ipack_instant_repack()\nis \"len - (buf[4] + 1) - 4\" so add a check to ensure that the length is\nnot negative. It's not clear that passing a negative len value does\nanything bad necessarily, but it's not best practice.\n\nWith the new bounds checking the \"if (!len)\" condition is no longer\npossible or required so remove that.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-54284" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/423350af9e27f005611bd881b1df2cab66de943d", "url": "https://git.kernel.org/stable/c/423350af9e27f005611bd881b1df2cab66de943d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/620b983589e0223876bf1463b01100a9c67b56ba", "url": "https://git.kernel.org/stable/c/620b983589e0223876bf1463b01100a9c67b56ba" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6606e2404ee9e20a3ae5b42fc3660d41b739ed3e", "url": "https://git.kernel.org/stable/c/6606e2404ee9e20a3ae5b42fc3660d41b739ed3e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6680af5be9f08d830567e9118f76d3e64684db8f", "url": "https://git.kernel.org/stable/c/6680af5be9f08d830567e9118f76d3e64684db8f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/77eeb4732135c18c2fdfab80839645b393f3e774", "url": "https://git.kernel.org/stable/c/77eeb4732135c18c2fdfab80839645b393f3e774" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7b93ab60fe9ed04be0ff155bc30ad39dea23e22b", "url": "https://git.kernel.org/stable/c/7b93ab60fe9ed04be0ff155bc30ad39dea23e22b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/86ba65e5357bfbb6c082f68b265a292ee1bdde1d", "url": "https://git.kernel.org/stable/c/86ba65e5357bfbb6c082f68b265a292ee1bdde1d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ca4ce92e3ec9fd3c7c936b912b95c53331d5159c", "url": "https://git.kernel.org/stable/c/ca4ce92e3ec9fd3c7c936b912b95c53331d5159c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eed9496a0501357aa326ddd6b71408189ed872eb", "url": "https://git.kernel.org/stable/c/eed9496a0501357aa326ddd6b71408189ed872eb" } ], "release_date": "2025-12-30T13:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80977", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: don't touch shared zerocopy state in skb_tx_error()\n\nskb_tx_error() completes the zerocopy uarg and clears\nSKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears\nSKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone\nshares, while the caller only owns the reference it is about to drop.\nThrough a clone it tells the producer its pages are free and drops\nSKBFL_SHARED_FRAG for an skb that is still in flight.\n\nOpen vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC:\nclone_execute() sends a skb_clone() into ovs_dp_process_packet() while\ndo_execute_actions() keeps forwarding the original, and skb_clone()\ndoes not privatise the frags here -- skb_orphan_frags() returns early\non SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker\nfrom the packet still being forwarded, and a later local ESP delivery\ndecrypts in place over frags it does not own privately.\n\nSkip it for a cloned skb. Nothing is lost: skb_release_data() clears\nthe zerocopy state once the last reference to the shared data goes.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80977" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0370da114a9bc044e248b85c6809d1b5e0c1f7f9", "url": "https://git.kernel.org/stable/c/0370da114a9bc044e248b85c6809d1b5e0c1f7f9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/15aa81b390d401abf4b8211042470e9e92e3b7fb", "url": "https://git.kernel.org/stable/c/15aa81b390d401abf4b8211042470e9e92e3b7fb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/288f9970670841044ab030104fa6b6ed159949d0", "url": "https://git.kernel.org/stable/c/288f9970670841044ab030104fa6b6ed159949d0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/363c4252ffc473a0203e91b83ede5519dfb8bd07", "url": "https://git.kernel.org/stable/c/363c4252ffc473a0203e91b83ede5519dfb8bd07" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6493165034bca14033bf49c9cec7b45e97a91497", "url": "https://git.kernel.org/stable/c/6493165034bca14033bf49c9cec7b45e97a91497" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6ec22afc82a3cae07ade0a6ec361ae2532128ff5", "url": "https://git.kernel.org/stable/c/6ec22afc82a3cae07ade0a6ec361ae2532128ff5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4452349dcf4d561e13be768d5d278de58248930", "url": "https://git.kernel.org/stable/c/b4452349dcf4d561e13be768d5d278de58248930" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f66bdb1cc0fcd227a062378f8be0b5873aa5600a", "url": "https://git.kernel.org/stable/c/f66bdb1cc0fcd227a062378f8be0b5873aa5600a" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80824", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbfs: fix use-after-free of usb_device in usbdev_release()\n\nusbdev_release() drops its reference to the struct usb_device before\ndraining the list of completed async URBs, but that drain path reads back\nthrough the same object: free_async() calls dec_usb_memory_use_count()\nfor any URB whose buffer came from the usbfs mmap() region, and its first\nstatement is bus_to_hcd(ps->dev->bus).\n\nAfter a disconnect the usbfs reference can be the last one, in which case\nusb_put_dev() frees the device and the subsequent loop reads offset 80 of\nfreed memory and uses the result as a struct usb_hcd *, which\nhcd_buffer_free_pages() then dereferences.\n\nThis is reachable by an unprivileged process that has read/write access to\na /dev/bus/usb node: mmap() the fd, submit one URB with a buffer inside the\nmapping, wait for the device to be unplugged, then munmap() and close().\nIt reproduces on every attempt rather than being a race, because a live\nMAP_SHARED vma holds a reference on the struct file, so usbdev_release()\ncannot run until the last vma is gone and the freeing branch of\ndec_usb_memory_use_count() is always taken.\n\n BUG: KASAN: slab-use-after-free in dec_usb_memory_use_count+0x3ae/0x410\n Read of size 8 at addr ffff8880122ee050 by task poc/769\n CPU: 1 UID: 1000 PID: 769 Comm: poc Tainted: G B 6.12.94 #3\n\n Call Trace:\n dec_usb_memory_use_count+0x3ae/0x410\n free_async+0x2aa/0x4f0\n usbdev_release+0x375/0x460\n __fput+0x3ea/0xb50\n __x64_sys_close+0x86/0x100\n\n Allocated by task 11:\n usb_alloc_dev+0x55/0xd90\n hub_event+0x2524/0x43d0\n\n Freed by task 769:\n kfree+0x121/0x360\n device_release+0xd2/0x280\n usb_put_dev+0x23/0x30\n usbdev_release+0x2d8/0x460\n\nRelease the device reference after the drain loop instead. Nothing between\nthe two points requires it to have been dropped.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80824" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0a960b88c5979f853019d4dc4957dfbeeb193440", "url": "https://git.kernel.org/stable/c/0a960b88c5979f853019d4dc4957dfbeeb193440" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0dd68b5d01d022fc9c5e71c82a82b0a94d3d0671", "url": "https://git.kernel.org/stable/c/0dd68b5d01d022fc9c5e71c82a82b0a94d3d0671" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/47a7f98fbb5006d46d15a3a210ffdc61448a4f19", "url": "https://git.kernel.org/stable/c/47a7f98fbb5006d46d15a3a210ffdc61448a4f19" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5f08c45bdcfd28d1171de38c5ef29fc89a76eedc", "url": "https://git.kernel.org/stable/c/5f08c45bdcfd28d1171de38c5ef29fc89a76eedc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/65879e0a452ca2a234b9475e0c11aff7a4343738", "url": "https://git.kernel.org/stable/c/65879e0a452ca2a234b9475e0c11aff7a4343738" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7f0278e474c4d1c4457974ff1137cc385c944ab3", "url": "https://git.kernel.org/stable/c/7f0278e474c4d1c4457974ff1137cc385c944ab3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/96f5520fc9a5e4bbf77ac93c9d5ce502f597e6cf", "url": "https://git.kernel.org/stable/c/96f5520fc9a5e4bbf77ac93c9d5ce502f597e6cf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b3cde26a66b04f1d90ed0b675899c88b4e49d424", "url": "https://git.kernel.org/stable/c/b3cde26a66b04f1d90ed0b675899c88b4e49d424" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bd4bffc621a8cb2f4d9ed9b6447415de524a3bef", "url": "https://git.kernel.org/stable/c/bd4bffc621a8cb2f4d9ed9b6447415de524a3bef" } ], "release_date": "2026-09-04T16:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72322", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: Fix potential UAF in MLD delayed work\n\nA race condition exists between device teardown and incoming MLD query\nprocessing, leading to a Use-After-Free in the MLD delayed work.\n\nDuring device destruction, the primary reference to inet6_dev is dropped,\nwhich can drop its refcount to 0. The actual freeing of inet6_dev memory\nis deferred via RCU.\n\nConcurrently, the packet receive path runs under RCU read lock and obtains\nthe inet6_dev pointer. Because the memory is RCU-protected, CPU-0 can\nsafely dereference inet6_dev even if its refcount has hit 0.\n\nHowever, if CPU-0 calls igmp6_event_query() and schedules delayed work, it\nattempts to acquire a reference using in6_dev_hold(). This increments the\nrefcount from 0 to 1, triggering a \"refcount_t: addition on 0\" warning.\nSince the inet6_dev memory is still scheduled to be freed after the RCU\ngrace period, the device is freed while the work is still scheduled.\nWhen the work runs, it accesses the freed memory, causing a kernel panic.\n\nFix this by using refcount_inc_not_zero() (via a new helper\nin6_dev_hold_safe()) to prevent acquiring a reference if the device is\nalready being destroyed. If the refcount is 0, we do not schedule the work.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72322" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0401d6cf7877c9be36652385dfcbf7f891b8b590", "url": "https://git.kernel.org/stable/c/0401d6cf7877c9be36652385dfcbf7f891b8b590" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0458ba1cda830ba4ccfcd9e19c0891438bcdbe4e", "url": "https://git.kernel.org/stable/c/0458ba1cda830ba4ccfcd9e19c0891438bcdbe4e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9815e834f5ff8b39e0ea9f0dbd532f4a3b8f0785", "url": "https://git.kernel.org/stable/c/9815e834f5ff8b39e0ea9f0dbd532f4a3b8f0785" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9b26518b6896a16b809b1e42986f4ebac7bccc1e", "url": "https://git.kernel.org/stable/c/9b26518b6896a16b809b1e42986f4ebac7bccc1e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9ce741c22df4fd9546e30306317ac7df3607e48f", "url": "https://git.kernel.org/stable/c/9ce741c22df4fd9546e30306317ac7df3607e48f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ebbebf6cee950d7f1c81990256c0eae9e62572ae", "url": "https://git.kernel.org/stable/c/ebbebf6cee950d7f1c81990256c0eae9e62572ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f03b0a45535d49bdab7e502efaacee205b2a7865", "url": "https://git.kernel.org/stable/c/f03b0a45535d49bdab7e502efaacee205b2a7865" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f12b63ef26a035c5a29b3ef56401e38199010d4a", "url": "https://git.kernel.org/stable/c/f12b63ef26a035c5a29b3ef56401e38199010d4a" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89631", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject a tree connect response whose byte count is too small\n\nCIFSTCon() bounds its strnlen() over the byte area with the server's\nByteCount minus two, which for ByteCount 0 or 1 goes negative as an int\nand converts to a huge size_t. The later subtraction wraps the __u16\nbytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of\nup to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the\nslab object, and the bytes reach userspace through tcon->nativeFileSystem\nin /proc/fs/cifs/DebugData.\n\nReject a byte area too small for what the parser consumes. Two bytes is\nthe least it can consume, and no conformant response carries fewer. The\nnew trace point is the 129th smb_eio_trace entry, which __mode(byte)\ncannot represent, so the attribute goes with it.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89631" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2ae219762ebac929bf6ab3473681f10ed566af08", "url": "https://git.kernel.org/stable/c/2ae219762ebac929bf6ab3473681f10ed566af08" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d", "url": "https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a", "url": "https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7", "url": "https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d837645a719151ed392d4d9cab4571c2753dab12", "url": "https://git.kernel.org/stable/c/d837645a719151ed392d4d9cab4571c2753dab12" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89638", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions\n\nWhen a file has the setuid or setgid bit set and is written to, the VFS\nstrips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID\ntogether with an ATTR_MODE carrying the already-cleared mode.\n\nBoth cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped\nATTR_MODE in that case:\n\n\t/* skip mode change if it's just for clearing setuid/setgid */\n\tif (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))\n\t\tattrs->ia_valid &= ~ATTR_MODE;\n\nThis is fine for the default mount, where the mode is only emulated via\nthe DOS read-only attribute and cannot represent the setuid/setgid bits\nanyway. However, with the \"cifsacl\" or \"modefromsid\" mount options the\nmode is stored on the server through an ACL (id_mode_to_cifs_acl()), with\nthe SMB3.1.1 POSIX extensions the mode is sent to the server directly,\nand with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent\nvia CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means\nthe cleared mode is never pushed to the server, so the setuid/setgid bit\nsurvives the write.\n\nThis is a security issue: on local filesystems the setuid bit is stripped\nwhen a file is written, but over these cifs.ko mounts the bit persists on\nthe server, potentially allowing an unexpected privilege escalation on\nsubsequent execution.\n\nFix this in two places:\n\n 1. cifs_setattr_nounix(): only take the \"skip mode change\" shortcut\n when the mode is emulated via the DOS read-only attribute (i.e.\n neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are\n in effect), so that the cleared mode is propagated to the server\n in the ACL / POSIX cases.\n\n 2. cifs_setattr_unix(): this function is only called when Unix\n extensions are in effect, so the mode is always stored on the\n server. Remove the shortcut entirely so that the cleared mode is\n always pushed.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89638" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/58b23fc9fb580432470d6c5da3c1e5660dba9fbc", "url": "https://git.kernel.org/stable/c/58b23fc9fb580432470d6c5da3c1e5660dba9fbc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/69bfe810ecd1e0387d8975d711cd326341d13c6e", "url": "https://git.kernel.org/stable/c/69bfe810ecd1e0387d8975d711cd326341d13c6e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7ceb6f7cb8f8f2b094e0dcdaf75757775d231378", "url": "https://git.kernel.org/stable/c/7ceb6f7cb8f8f2b094e0dcdaf75757775d231378" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b10015807e4c628095d1d1d1c9307efc8cdd9e1b", "url": "https://git.kernel.org/stable/c/b10015807e4c628095d1d1d1c9307efc8cdd9e1b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b8e5dc4f95e5484159b343903f302eb6d783f2e6", "url": "https://git.kernel.org/stable/c/b8e5dc4f95e5484159b343903f302eb6d783f2e6" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89485", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: pin next file across nlm_inspect_file lock-drop\n\nnlm_traverse_files() pins the current file with f_count++ across\na mutex_unlock for nlm_inspect_file(), but nothing pins the saved\nnext pointer. A concurrent nlm_release_file() can kfree the next\nfile during the unlock window, and the iterator dereferences freed\nmemory on the next loop step.\n\nPin both current and next before the lock-drop. Advance by\nswapping the pinned cursors at the end of each iteration so next\nis always held alive across the unlock.\n\nAlways call nlm_file_release() after dropping the iteration pin,\nregardless of whether the file matched the predicate. Use\nnlm_file_inuse(), which does a live walk of the inode lock list,\nrather than the cached f_locks field, so skipped files that never\nran nlm_inspect_file() are evaluated correctly.\n\nBecause every file in a hash bucket is now pinned and released,\nfiles skipped by the is_failover_file predicate that have no\nlocks, blocks, shares, or external references are deleted during\ntraversal. The old code never evaluated skipped files for\ncleanup. The new behavior is intentional: such files are stale\nand should not persist in the table.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89485" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/08a455f87b14c7ff22ae3fdadda62a796a3a5572", "url": "https://git.kernel.org/stable/c/08a455f87b14c7ff22ae3fdadda62a796a3a5572" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/350087f231c11efcd288c310707c40eab63ca583", "url": "https://git.kernel.org/stable/c/350087f231c11efcd288c310707c40eab63ca583" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/41f0a6d31615fcae261bf28a0aa50050dc93a401", "url": "https://git.kernel.org/stable/c/41f0a6d31615fcae261bf28a0aa50050dc93a401" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/526c49cff3f72c3ec74752016380c7567040581b", "url": "https://git.kernel.org/stable/c/526c49cff3f72c3ec74752016380c7567040581b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/550c19222c7132c888e23c9d89079ba1c9bc4cca", "url": "https://git.kernel.org/stable/c/550c19222c7132c888e23c9d89079ba1c9bc4cca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c24bdb7df2f34bdc38ca8a73796f5acb40f1830c", "url": "https://git.kernel.org/stable/c/c24bdb7df2f34bdc38ca8a73796f5acb40f1830c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3c413f789eaf0170275c7eba523ead73d963f30", "url": "https://git.kernel.org/stable/c/e3c413f789eaf0170275c7eba523ead73d963f30" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e999a88133654c6dfc68487fb49da5f20dfa2d4f", "url": "https://git.kernel.org/stable/c/e999a88133654c6dfc68487fb49da5f20dfa2d4f" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80785", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: serialize mode sysfs access with lock_fb_info()\n\nshow_mode(), show_modes(), and store_mode() access fb_info->modelist\nand fb_info->mode without holding lock_fb_info(). store_modes() takes\nlock_fb_info() while replacing the modelist and freeing the old one.\n\nA concurrent reader or writer can load a pointer to an old modelist\nentry before store_modes() frees it, then dereference freed memory or\nstore a stale freed pointer in fb_info->mode.\n\nTake lock_fb_info() in show_mode(), show_modes(), and store_mode() to\nserialize with store_modes(). In show_mode(), copy the mode to the\nstack and format after dropping the lock. In store_mode(), split\nactivate() into a _locked variant to avoid double-locking, and hold\nthe locks for the modelist walk, mode conversion, activation, and\nfb_info->mode assignment together.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80785" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2", "url": "https://git.kernel.org/stable/c/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26135631ed8e487bc6aef70cc41934e258d09bbe", "url": "https://git.kernel.org/stable/c/26135631ed8e487bc6aef70cc41934e258d09bbe" } ], "release_date": "2026-09-04T16:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-92499", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: validate readdir offset before accessing dirent\n\nA corrupted directory can trigger the following KASAN report when\next4_readdir() resumes from an invalid position:\n\n BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820\n Read of size 2 at addr ffff88810a646000 by task repro_linear/509\n\n Call Trace:\n \n dump_stack_lvl+0x53/0x70\n print_report+0xd0/0x630\n kasan_report+0xce/0x100\n __ext4_check_dir_entry+0x5ef/0x820\n ext4_readdir+0xcde/0x2b70\n iterate_dir+0x1a1/0x520\n __x64_sys_getdents64+0x12b/0x220\n do_syscall_64+0xf9/0x540\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n\nKASAN reports use-after-free because the out-of-bounds access lands in an\nadjacent freed page. The directory buffer itself is still referenced.\n\next4_dir_llseek() invalidates the directory cookie so that ext4_readdir()\nrescans directory entries from the start of the block. The rescan checks\nonly the lower bound of rec_len before advancing. A corrupted rec_len can\ntherefore place the offset where the block has insufficient space for a\ncomplete directory entry. The rescan itself may dereference that truncated\nentry, or the main loop may pass it to __ext4_check_dir_entry(). The latter\nreads de->rec_len before validating the range. For example:\n\n block offset 0 4092 4096\n |---- de1.rec_len = 4092 -----|----|\n de2.inode\n | de2.rec_len\n ^ OOB, reported as UAF\n\nde2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in\nthe block, but its rec_len starts at offset 4096 and crosses the boundary.\n\nThe minimum safe length is inode-dependent. Encrypted and casefolded\ndirectory entries need eight additional hash bytes, while a valid metadata\nchecksum tail is only 12 bytes.\n\nCache the metadata checksum feature state and derive the minimum directory\nentry length from the on-disk format. Use it to bound both the rescan and\nthe offset passed to the main loop. Report an offset in a truncated block\ntail and skip the remainder of the block, while continuing to accept an\noffset exactly at the block boundary.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-92499" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/64d445d40e5ea4c4d4d88880db753b370cb69161", "url": "https://git.kernel.org/stable/c/64d445d40e5ea4c4d4d88880db753b370cb69161" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4c728577933753180e3e97f08424d5bcaff705e", "url": "https://git.kernel.org/stable/c/b4c728577933753180e3e97f08424d5bcaff705e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8", "url": "https://git.kernel.org/stable/c/bc4b7b0414c33b2c8898eb04386df0d21a13dad8" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-74271", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: core: fix supplied_from allocations\n\nIf dts property power-supplies has multiple values, then accessing to\npsy->supplied_from[i-1] in __power_supply_populate_supplied_from will\noverrun supplied_from array.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74271" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14357ba006e1586e4b4e809c074b21baf0aa4c4b", "url": "https://git.kernel.org/stable/c/14357ba006e1586e4b4e809c074b21baf0aa4c4b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/23a29ee1d9de38b7d6226b27653bc736b28ff05a", "url": "https://git.kernel.org/stable/c/23a29ee1d9de38b7d6226b27653bc736b28ff05a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae55e4bf18ee0c4c170797dd65e17dbdf644fcf2", "url": "https://git.kernel.org/stable/c/ae55e4bf18ee0c4c170797dd65e17dbdf644fcf2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ba61aed9a34671222d1149acfc2f0179a9ce7e80", "url": "https://git.kernel.org/stable/c/ba61aed9a34671222d1149acfc2f0179a9ce7e80" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0503357653ee62188987a26baa2d7f3689f367e", "url": "https://git.kernel.org/stable/c/d0503357653ee62188987a26baa2d7f3689f367e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fefc9dad30d545be288d50a0b10d00465015fcfe", "url": "https://git.kernel.org/stable/c/fefc9dad30d545be288d50a0b10d00465015fcfe" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-45920", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix dirtyclusters double decrement on fs shutdown\n\nfstests test generic/388 occasionally reproduces a warning in\next4_put_super() associated with the dirty clusters count:\n\n WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]\n\nTracing the failure shows that the warning fires due to an\ns_dirtyclusters_counter value of -1. IOW, this appears to be a\nspurious decrement as opposed to some sort of leak. Further tracing\nof the dirty cluster count deltas and an LLM scan of the resulting\noutput identified the cause as a double decrement in the error path\nbetween ext4_mb_mark_diskspace_used() and the caller\next4_mb_new_blocks().\n\nFirst, note that generic/388 is a shutdown vs. fsstress test and so\nproduces a random set of operations and shutdown injections. In the\nproblematic case, the shutdown triggers an error return from the\next4_handle_dirty_metadata() call(s) made from\next4_mb_mark_context(). The changed value is non-zero at this point,\nso ext4_mb_mark_diskspace_used() does not exit after the error\nbubbles up from ext4_mb_mark_context(). Instead, the former\ndecrements both cluster counters and returns the error up to\next4_mb_new_blocks(). The latter falls into the !ar->len out path\nwhich decrements the dirty clusters counter a second time, creating\nthe inconsistency.\n\nTo avoid this problem and simplify ownership of the cluster\nreservation in this codepath, lift the counter reduction to a single\nplace in the caller. This makes it more clear that\next4_mb_new_blocks() is responsible for acquiring cluster\nreservation (via ext4_claim_free_clusters()) in the !delalloc case\nas well as releasing it, regardless of whether it ends up consumed\nor returned due to failure.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-45920" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3924aea2c33df3864929c1acd178bfc29d8f005f", "url": "https://git.kernel.org/stable/c/3924aea2c33df3864929c1acd178bfc29d8f005f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/523d5a4df3c649fa305c89efb552ec62a1ce9d3d", "url": "https://git.kernel.org/stable/c/523d5a4df3c649fa305c89efb552ec62a1ce9d3d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/55576fa14771d33994c29a9ae960e07bb3f56c20", "url": "https://git.kernel.org/stable/c/55576fa14771d33994c29a9ae960e07bb3f56c20" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/61e372122b6d95aec940fdaea0a16f988f359897", "url": "https://git.kernel.org/stable/c/61e372122b6d95aec940fdaea0a16f988f359897" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/81982a11406c5da6c6e2b188028e7056e16b7128", "url": "https://git.kernel.org/stable/c/81982a11406c5da6c6e2b188028e7056e16b7128" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/94a8cea54cd935c54fa2fba70354757c0fc245e3", "url": "https://git.kernel.org/stable/c/94a8cea54cd935c54fa2fba70354757c0fc245e3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ca408af08544d96769c93a3d81a7f63f61129e95", "url": "https://git.kernel.org/stable/c/ca408af08544d96769c93a3d81a7f63f61129e95" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dbc4e10619ed87a50e637b96f2e574df36a7a769", "url": "https://git.kernel.org/stable/c/dbc4e10619ed87a50e637b96f2e574df36a7a769" } ], "release_date": "2026-05-27T14:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89540", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: init gssp_lock before publishing proc entry\n\ncreate_use_gss_proxy_proc_entry() publishes /proc/net/rpc/use-gss-proxy\nvia proc_create_data() before init_gssp_clnt() runs mutex_init() on\nsn->gssp_lock. Once the dentry is linked under proc_subdir_lock it is\nimmediately reachable from userspace, so a write that lands in the\nwindow drives set_gssp_clnt() into mutex_lock() on a zero-initialized\nstruct mutex.\n\n create_use_gss_proxy_proc_entry(net)\n proc_create_data(\"use-gss-proxy\", ...) /* dentry live */\n init_gssp_clnt(sn)\n mutex_init(&sn->gssp_lock) /* too late */\n\n write_gssp()\n set_gssp_clnt(net)\n mutex_lock(&sn->gssp_lock) /* uninitialized */\n gssp_rpc_create(...)\n sn->gssp_clnt = clnt\n mutex_unlock(&sn->gssp_lock)\n\nThe window spans only the two statements between proc_create_data()\nreturning and init_gssp_clnt(), so a writer reaches it only if the\nregistering thread is preempted there while another task is already\nopening the freshly published file. register_pernet_subsys() runs in\npreemptible context under pernet_ops_rwsem, so that preemption is\npossible, and the window widens on auth_rpcgss module load, when the\nproc entry is created for every live net namespace whose tasks are\nalready running. A writer that wins the race locks a zero-filled\nstruct mutex. On CONFIG_DEBUG_MUTEXES the missing magic value trips a\n\"lock used without init\" splat; on a production kernel the fast path\nacquires the lock via CMPXCHG(owner, 0, current). In the latter case\na second writer that arrives before init_gssp_clnt() re-zeroes owner\ncan enter set_gssp_clnt() concurrently, shut down the first writer's\nclnt while it is still in use, and leak the loser's clnt.\n\nFix by initializing sn->gssp_lock in sunrpc_init_net() so its lifetime\nmatches the sunrpc_net it lives in. sn->gssp_clnt is already NULL from\nthe kzalloc that backs net_generic storage, so the lazy helper is no\nlonger needed; drop init_gssp_clnt(), its prototype, and the call from\ncreate_use_gss_proxy_proc_entry(). sunrpc.ko is a build-time\ndependency of auth_rpcgss.ko, so sunrpc_init_net() has always run on\nevery netns before any auth_gss pernet init can publish the proc\nentry.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89540" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/159a4fab7170badd6c4a553aef81cac079d6f4ee", "url": "https://git.kernel.org/stable/c/159a4fab7170badd6c4a553aef81cac079d6f4ee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f019571928b269feebcff59926ec13294215e0e", "url": "https://git.kernel.org/stable/c/3f019571928b269feebcff59926ec13294215e0e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5ce1ed6159731a41fdd0b03eedbed4e147036a5a", "url": "https://git.kernel.org/stable/c/5ce1ed6159731a41fdd0b03eedbed4e147036a5a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7f5bcdc8da15077ebe846c2756a5a17741021410", "url": "https://git.kernel.org/stable/c/7f5bcdc8da15077ebe846c2756a5a17741021410" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/89c8e0733e8c46b7973503f15b1b31a8587d8030", "url": "https://git.kernel.org/stable/c/89c8e0733e8c46b7973503f15b1b31a8587d8030" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b3526ae3351968f6726bcbe25d8d09973ad79109", "url": "https://git.kernel.org/stable/c/b3526ae3351968f6726bcbe25d8d09973ad79109" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/edeefb111d6181a4aa278f415b005efe284b9489", "url": "https://git.kernel.org/stable/c/edeefb111d6181a4aa278f415b005efe284b9489" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f15b87521168c2a92cb1931f532cba422f856f01", "url": "https://git.kernel.org/stable/c/f15b87521168c2a92cb1931f532cba422f856f01" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-74417", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix integer overflow in radeon_align_pitch()\n\nradeon_align_pitch() has the same kind of overflow issue as the old\namdgpu helper: both the alignment round-up add and the final\n'aligned * cpp' calculation can overflow signed int.\n\nIf that wraps, radeon_mode_dumb_create() can end up returning an\ninvalid pitch or creating a zero-sized dumb buffer.\n\nFix this by using check_add_overflow() for the alignment round-up and\ncheck_mul_overflow() for the final pitch calculation, returning 0 on\noverflow. Also reject zero pitch and size in\nradeon_mode_dumb_create().\n\nFound via AST-based call-graph analysis using sqry.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74417" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/415bb9893e249e46aa5159f7363a11512cf06fa9", "url": "https://git.kernel.org/stable/c/415bb9893e249e46aa5159f7363a11512cf06fa9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b7b44937c548c2c987fcdd129f8896741004bed6", "url": "https://git.kernel.org/stable/c/b7b44937c548c2c987fcdd129f8896741004bed6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ce3b24eb3ee8f82de851535f516bf21f83e82259", "url": "https://git.kernel.org/stable/c/ce3b24eb3ee8f82de851535f516bf21f83e82259" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d9dfa176899d488e48bb7342d2c43ddd36e66318", "url": "https://git.kernel.org/stable/c/d9dfa176899d488e48bb7342d2c43ddd36e66318" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dfc7b5b5599472277e71e5bd2712740651c7c5be", "url": "https://git.kernel.org/stable/c/dfc7b5b5599472277e71e5bd2712740651c7c5be" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53802", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function\n\nIt is stated that ath9k_htc_rx_msg() either frees the provided skb or\npasses its management to another callback function. However, the skb is\nnot freed in case there is no another callback function, and Syzkaller was\nable to cause a memory leak. Also minor comment fix.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53802" } ], "release_date": "2025-12-09T00:00:58Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-74485", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: reject a flag character as the field delimiter\n\nThe registration string starts with a user chosen delimiter that\nseparates the individual fields. So that the field parsers terminate\neven on a truncated string create_entry() pads the buffer with that\nsame delimiter:\n\n\tmemset(buf + count, del, 8);\n\nMost fields are scanned for the delimiter with strchr()/scanarg() and\nhappily stop on the padding. The flags field is different: instead of\nscanning for the delimiter check_special_flags() consumes the flag\ncharacters 'P', 'O', 'C' and 'F' and stops at the first byte that is\nnone of them, relying on the trailing delimiter to end the scan.\n\nIf the delimiter is itself a flag character the padding no longer acts\nas a terminator. The scan swallows all eight padding bytes and keeps\nreading past the end of the allocation until it hits a byte that is\nnot a flag character. For example registering\n\n\tPaPEPPxPPiP\n\nwith 'P' as the delimiter (name \"a\", type extension, magic \"x\",\ninterpreter \"i\", empty flags) leaves the flag scan running off the end\nof the buffer. The registration is rejected in the end because the\nparser does not stop exactly at buf + count, but only after the out of\nbounds read has already happened. With an unlucky allocation layout the\nscan can walk into an unmapped page; under KASAN it is reported as a\nslab out of bounds read. binfmt_misc mounts are available to\nunprivileged users in a user namespace so the read is reachable without\nprivileges.\n\nReject a delimiter that is one of the flag characters up front. Such a\nregistration was always rejected anyway, only after the out of bounds\nread, so no valid registration string changes meaning.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74485" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1819f82dee766c58295ecaacdac02cdf6837d7a4", "url": "https://git.kernel.org/stable/c/1819f82dee766c58295ecaacdac02cdf6837d7a4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1853e95c9bfe69ef1dd862b3f551e68f4a1b76cc", "url": "https://git.kernel.org/stable/c/1853e95c9bfe69ef1dd862b3f551e68f4a1b76cc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/840bb9c49c3e75fb32b593d67ab32f6b77122262", "url": "https://git.kernel.org/stable/c/840bb9c49c3e75fb32b593d67ab32f6b77122262" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8e85d50ba1117fd446bf9a250bd8a97d48384bdc", "url": "https://git.kernel.org/stable/c/8e85d50ba1117fd446bf9a250bd8a97d48384bdc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/96bd5d4fea2970b9b08265293ca7a10b9b27c0fd", "url": "https://git.kernel.org/stable/c/96bd5d4fea2970b9b08265293ca7a10b9b27c0fd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9970e094e5d60f0d66914bf9a97d1ef19107ebf5", "url": "https://git.kernel.org/stable/c/9970e094e5d60f0d66914bf9a97d1ef19107ebf5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9a2d87db3898b5993b64fd258d0334e0eba9ee0d", "url": "https://git.kernel.org/stable/c/9a2d87db3898b5993b64fd258d0334e0eba9ee0d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b29e3c1f375c1296362d219ff38bceddf2d2a88a", "url": "https://git.kernel.org/stable/c/b29e3c1f375c1296362d219ff38bceddf2d2a88a" } ], "release_date": "2026-08-15T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64276", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count\n\nrmi_f30_map_gpios() allocates gpioled_key_map with\nmin(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f30_attention() iterates the full f30->gpioled_count (device query\nregister, range 0..31) and dereferences gpioled_key_map[i], and\ninput->keycodemax is set to the full gpioled_count while input->keycode\npoints at the 6-entry allocation.\n\nA device that reports gpioled_count > 6 with GPIO support enabled\ntherefore causes an out-of-bounds read on the attention interrupt and\nout-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,\nwhich bound the index only against keycodemax. This is the same defect\nas the F3A handler, which was copied from F30.\n\nSize the keymap for the full gpioled_count; the mapping loop still\nassigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64276" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8", "url": "https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00", "url": "https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9", "url": "https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50", "url": "https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded", "url": "https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c", "url": "https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119", "url": "https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954", "url": "https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954" } ], "release_date": "2026-07-25T10:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-93793", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: validate TX_CMD response layout\n\nTX_CMD parsing uses frame_count to walk status entries and then\nread the trailing SCD SSN. Make the minimum-length check follow\nthat exact runtime layout calculation before parsing the payload.\n\nFor new TX API, reject TX_CMD responses with frame_count != 1 and\nwarn/return in the aggregation handler to document that aggregated\naccounting is expected via BA notifications.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-93793" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4d942dfc13aec393e003ab28ff58db744c26e6eb", "url": "https://git.kernel.org/stable/c/4d942dfc13aec393e003ab28ff58db744c26e6eb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5e871c03506c529d5fe372d099c1ad1465c7bc38", "url": "https://git.kernel.org/stable/c/5e871c03506c529d5fe372d099c1ad1465c7bc38" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8d70881707b47353359df57df12f6de67fdacdd2", "url": "https://git.kernel.org/stable/c/8d70881707b47353359df57df12f6de67fdacdd2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fc14f5fe8a4374ed1088cfbddc1dae4d16c9935b", "url": "https://git.kernel.org/stable/c/fc14f5fe8a4374ed1088cfbddc1dae4d16c9935b" } ], "release_date": "2026-09-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72251", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_nat_sip: reload possible stale data pointer\n\nquoting sashiko:\n ------------------------------------------------------------------------\n [..] noticed a potential memory bug and header corruption involving the\n SIP NAT helper.\n\n In net/netfilter/nf_nat_sip.c:nf_nat_sip():\n\tif (skb_ensure_writable(skb, skb->len)) {\n\t\tnf_ct_helper_log(skb, ct, \"cannot mangle packet\");\n\t\treturn NF_DROP;\n\t}\n\tuh = (void *)skb->data + protoff;\n\tuh->dest = ct_sip_info->forced_dport;\n\tif (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,\n\t\t\t\t 0, 0, NULL, 0)) {\n\n If a cloned or fragmented SKB is reallocated by skb_ensure_writable(), the\n old data buffer is freed. However, nf_nat_sip() fails to update *dptr to\n point to the new buffer.\n\n It also appears to use nf_nat_mangle_udp_packet() on what could be a TCP\n packet, which would overwrite the sequence number with a checksum update.\n ------------------------------------------------------------------------\n\nnf_conntrack_sip linerizes skbs, hence no fragmented skb can be seen.\nBut clones are possible, so rebuild dptr.\n\nDisable nf_nat_mangle_udp_packet() branch for TCP streams.\nIt doesn't look like this can ever happen, else we should have received\nbug reports about this, so just check the conntrack is UDP and drop\notherwise.\n\nThe calling conntrack_sip set ->forced_dport for SIP_HDR_VIA_UDP messages,\nso I don't think this is ever expected to be true for a TCP stream.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72251" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e76e3e886cc9ee027337d5ad39cb96f57b7bdc7", "url": "https://git.kernel.org/stable/c/0e76e3e886cc9ee027337d5ad39cb96f57b7bdc7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2bcf2c5052fb5e73e255140ab43f056aef409c27", "url": "https://git.kernel.org/stable/c/2bcf2c5052fb5e73e255140ab43f056aef409c27" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/57e4e29644ec054d7021d296407e7ddd844afea2", "url": "https://git.kernel.org/stable/c/57e4e29644ec054d7021d296407e7ddd844afea2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68", "url": "https://git.kernel.org/stable/c/77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bded21a4bf9bf86a79148be735723a97ca9a7532", "url": "https://git.kernel.org/stable/c/bded21a4bf9bf86a79148be735723a97ca9a7532" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dc11f26685aa850f237226f0f463647aea58ab7c", "url": "https://git.kernel.org/stable/c/dc11f26685aa850f237226f0f463647aea58ab7c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e38143c9b477f2968024c47c647dd4456a40aff1", "url": "https://git.kernel.org/stable/c/e38143c9b477f2968024c47c647dd4456a40aff1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eae9c6ccb5af69c713a65f8ae219f5c1aa32cd17", "url": "https://git.kernel.org/stable/c/eae9c6ccb5af69c713a65f8ae219f5c1aa32cd17" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46294", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix a buffer overflow in ioctl processing\n\nTony Asleson (using Claude) found a buffer overflow in dm-ioctl in the\nfunction retrieve_status:\n\n1. The code in retrieve_status checks that the output string fits into\n the output buffer and writes the output string there\n2. Then, the code aligns the \"outptr\" variable to the next 8-byte\n boundary:\n\toutptr = align_ptr(outptr);\n3. The alignment doesn't check overflow, so outptr could point past the\n buffer end\n4. The \"for\" loop is iterated again, it executes:\n\tremaining = len - (outptr - outbuf);\n5. If \"outptr\" points past \"outbuf + len\", the arithmetics wraps around\n and the variable \"remaining\" contains unusually high number\n6. With \"remaining\" being high, the code writes more data past the end of\n the buffer\n\nLuckily, this bug has no security implications because:\n1. Only root can issue device mapper ioctls\n2. The commonly used libraries that communicate with device mapper\n (libdevmapper and devicemapper-rs) use buffer size that is aligned to\n 8 bytes - thus, \"outptr = align_ptr(outptr)\" can't overshoot the input\n buffer and the bug can't happen accidentally", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46294" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159", "url": "https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c", "url": "https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d", "url": "https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5af6a879e915ae7bcd83695c316ebb32e1c61bc2", "url": "https://git.kernel.org/stable/c/5af6a879e915ae7bcd83695c316ebb32e1c61bc2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8daa6c708ef524089ae43f2aed9190acb26d7df8", "url": "https://git.kernel.org/stable/c/8daa6c708ef524089ae43f2aed9190acb26d7df8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c8c5311237448f6ffeecc9aec2362e3692623668", "url": "https://git.kernel.org/stable/c/c8c5311237448f6ffeecc9aec2362e3692623668" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d271631023cbe1cbe7c31a0275ab797883be6e0a", "url": "https://git.kernel.org/stable/c/d271631023cbe1cbe7c31a0275ab797883be6e0a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a", "url": "https://git.kernel.org/stable/c/f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" } ], "release_date": "2026-06-08T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89595", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsnotify: Fix stale object mask after concurrent mark updates\n\nWhen a mark gets a new event bit, fanotify and inotify may avoid\nrecalculating the object mask if the cached aggregate already contains that\nbit. This is racy with a recalculation triggered by a concurrent update to\nanother mark on the same connector.\n\nThe concurrent scan can read the mark before the new bit is added, while\nthe updater reads the old aggregate before that scan publishes its result.\nThe updater then skips recalculation and the scan publishes a mask without\nthe bit, leaving the object mask stale after both updates complete.\n\nThis can be reproduced with two fanotify groups watching the same inode:\none thread removes FAN_MODIFY from one existing mark while another thread\nadds FAN_MODIFY to the other mark. After both fanotify_mark() calls return,\nwrites can fail to produce FAN_MODIFY for the group whose mark now contains\nthe bit. This was reproduced on an unmodified v6.12.95 kernel. The\nequivalent inotify interleaving loses IN_MODIFY events.\n\nFor normal fanotify additions, recalculate whenever the raw mark mask\nchanges. The normal mask is not cleared asynchronously, so an unchanged\naddition cannot introduce missing interest. Always recalculate ignore-mask\nupdates because FS_MODIFY handling may clear the ignore mask without taking\nmark->lock, making snapshot comparisons unreliable.\n\nAlways recalculate after updating an existing inotify watch. Its replace\npath temporarily sets mark->mask to zero, so a concurrent scan can observe\nzero even when the old and final masks are equal. Assigning the replacement\nmask directly would avoid the transient zero, but existing-watch updates\nare infrequent, so unconditional recalculation is simpler.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89595" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/27d172b60eeca5c8fd51b246f9fb959067cf102b", "url": "https://git.kernel.org/stable/c/27d172b60eeca5c8fd51b246f9fb959067cf102b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2f09f08d602647fc4e328fc27ecb4c3008d10338", "url": "https://git.kernel.org/stable/c/2f09f08d602647fc4e328fc27ecb4c3008d10338" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/343ae18e960f6c5f1d34d58a69750c62cd463228", "url": "https://git.kernel.org/stable/c/343ae18e960f6c5f1d34d58a69750c62cd463228" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/92289e66639f62abc754c6f3bce5ead7e98e4ee2", "url": "https://git.kernel.org/stable/c/92289e66639f62abc754c6f3bce5ead7e98e4ee2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/947400af98b9e63841929d079a2c3ea0a8ba227b", "url": "https://git.kernel.org/stable/c/947400af98b9e63841929d079a2c3ea0a8ba227b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ac8d8b599d466a129122bded77db3d0f8b96b461", "url": "https://git.kernel.org/stable/c/ac8d8b599d466a129122bded77db3d0f8b96b461" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/de75382d6e354b2b055df4896d12a91969f12090", "url": "https://git.kernel.org/stable/c/de75382d6e354b2b055df4896d12a91969f12090" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e422777fdd4746de1109575c51e65038d4c5c1be", "url": "https://git.kernel.org/stable/c/e422777fdd4746de1109575c51e65038d4c5c1be" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72108", "cwe": { "id": "CWE-672", "name": "Operation on a Resource after Expiration or Release" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm thin metadata: fix metadata snapshot consistency on commit failure\n\n__reserve_metadata_snap() and __release_metadata_snap() modify the\nsuperblock's held_root directly in the block_manager's buffer. If the\nsubsequent metadata commit fails, the held_root gets flushed to disk\nthrough the abort_transaction path, resulting in inconsistent metadata.\n\nReproducer 1: __reserve_metadata_snap()\n\n1. Create a 2 MiB metadata device and make the region after the 14th\n block inaccessible, to trigger metadata commit failure in the\n subsequent reserve_metadata_snap operation. The 14th block will be\n the shadow destination for the index block.\n\ndmsetup create tmeta --table \"0 112 linear /dev/sdc 0\n112 3984 error\"\n\n2. Create a 16 MiB thin-pool\n\ndmsetup create tdata --table \"0 32768 zero\"\ndd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1\ndmsetup create tpool --table \"0 32768 thin-pool /dev/mapper/tmeta \\\n/dev/mapper/tdata 128 0 1 skip_block_zeroing\"\n\n3. Take a metadata snapshot to trigger metadata commit failure and\n transaction abort. However, the held_root is written to disk,\n breaking metadata consistency.\n\ndmsetup message tpool 0 \"reserve_metadata_snap\"\n\nthin_check v1.2.2 result:\n\nBad reference count for metadata block 6. Expected 2, but space map contains 1.\nBad reference count for metadata block 7. Expected 2, but space map contains 1.\nBad reference count for metadata block 13. Expected 1, but space map contains 0.\n\nReproducer 2: __release_metadata_snap()\n\n1. Create a 2 MiB metadata device and make the region after the 16th\n block inaccessible, to trigger metadata commit failure in the\n subsequent release_metadata_snap operation. The 16th block will be\n the shadow destination for the index block.\n\ndmsetup create tmeta --table \"0 128 linear /dev/sdc 0\n128 3968 error\"\n\n2. Create a 16 MiB thin-pool\n\ndmsetup create tdata --table \"0 32768 zero\"\ndd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1\ndmsetup create tpool --table \"0 32768 thin-pool /dev/mapper/tmeta \\\n/dev/mapper/tdata 128 0 1 skip_block_zeroing\"\n\n3. Reserve then release the metadata snapshot, to trigger metadata\n commit failure and transaction abort. The held_root gets removed\n from the on-disk superblock, causing inconsistent metadata.\n\ndmsetup message tpool 0 \"reserve_metadata_snap\"\ndmsetup message tpool 0 \"release_metadata_snap\"\n\nthin_check v1.2.2 result:\n\nBad reference count for metadata block 6. Expected 1, but space map contains 2.\nBad reference count for metadata block 7. Expected 1, but space map contains 2.\n1 metadata blocks have leaked.\n\nFix by deferring the held_root update to commit time.\n\nAdditionally, move the existing-snapshot check in __reserve_metadata_snap\nbefore the shadow operation to avoid unnecessary work. In\n__release_metadata_snap, clear pmd->held_root before btree deletion so\npartial failure leaks blocks rather than leaving a stale reference, and\nunlock the snapshot block before decrementing its refcount.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72108" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3dc9ae1029320d77472c44965e572f176949cd63", "url": "https://git.kernel.org/stable/c/3dc9ae1029320d77472c44965e572f176949cd63" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4af993468193cf4cd32ba5748786e7801945f7d2", "url": "https://git.kernel.org/stable/c/4af993468193cf4cd32ba5748786e7801945f7d2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5bcd4d3058ebaf46ad2e163829d87dd4870c7a45", "url": "https://git.kernel.org/stable/c/5bcd4d3058ebaf46ad2e163829d87dd4870c7a45" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5efb1a7734ed4035fa4fdc3716bdb84621f27cf6", "url": "https://git.kernel.org/stable/c/5efb1a7734ed4035fa4fdc3716bdb84621f27cf6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7f76245960a332f39b08cc556e675d1765dc5bbb", "url": "https://git.kernel.org/stable/c/7f76245960a332f39b08cc556e675d1765dc5bbb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9f1a0d27586ceab055e6b050e3731ce3c6b2c4f0", "url": "https://git.kernel.org/stable/c/9f1a0d27586ceab055e6b050e3731ce3c6b2c4f0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/abf2fae92cbe68945028987d498cc72f8f0e23a8", "url": "https://git.kernel.org/stable/c/abf2fae92cbe68945028987d498cc72f8f0e23a8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b5f9a31c51cbb374a1713c3494f8660ab070f035", "url": "https://git.kernel.org/stable/c/b5f9a31c51cbb374a1713c3494f8660ab070f035" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80689", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions\n\nmmio_trace_rw() and mmio_trace_mapping() retrieve mmio_trace_array into\ntr and pass it to __trace_mmiotrace_rw() and __trace_mmiotrace_map().\nIf these functions are invoked while mmio_trace_array is NULL (e.g. before\ninitialization or after disabled), accessing tr->array_buffer.buffer will\nresult in a NULL pointer dereference crash.\n\nFix this by adding an explicit NULL check for tr at the beginning of\n__trace_mmiotrace_rw() and __trace_mmiotrace_map().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80689" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/12b80cdbc54cf615b4717a4e8180063408091ea2", "url": "https://git.kernel.org/stable/c/12b80cdbc54cf615b4717a4e8180063408091ea2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2df964d141270c40f07547b0c2e0a51e2573d46d", "url": "https://git.kernel.org/stable/c/2df964d141270c40f07547b0c2e0a51e2573d46d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4e4ab09db7899d7f2d2293a18adf0fa200a27e73", "url": "https://git.kernel.org/stable/c/4e4ab09db7899d7f2d2293a18adf0fa200a27e73" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/60234845142fddb27db89ebc00a65178421fb3a4", "url": "https://git.kernel.org/stable/c/60234845142fddb27db89ebc00a65178421fb3a4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6aee2d478545c089dd5d055d3c9f0c7ea034fb80", "url": "https://git.kernel.org/stable/c/6aee2d478545c089dd5d055d3c9f0c7ea034fb80" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/876014b4eeb927146430e7591cf959a7ceb8d64a", "url": "https://git.kernel.org/stable/c/876014b4eeb927146430e7591cf959a7ceb8d64a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a20a0010eb6485f60cd64e15ebc85a4bd388642e", "url": "https://git.kernel.org/stable/c/a20a0010eb6485f60cd64e15ebc85a4bd388642e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dc1b1a057b3bb901f83433700e604fe0ae67c5f2", "url": "https://git.kernel.org/stable/c/dc1b1a057b3bb901f83433700e604fe0ae67c5f2" } ], "release_date": "2026-08-28T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-68118", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: challenge ACK for non-exact RST in SYN-RECEIVED\n\nThe SYN-RECEIVED request-socket path in tcp_check_req() accepts an\nin-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A\nnon-exact RST therefore removes the request instead of eliciting a\nchallenge ACK.\n\nRFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in\nSYN-RECEIVED: an exact RST resets the connection, while a non-exact\nin-window RST must trigger a challenge ACK and be dropped.\n\nApply that check before the ACK-field validation, following the RFC\nsequence-number, RST, then ACK processing order. Factor the per-netns\nchallenge ACK quota out of tcp_send_challenge_ack() so request sockets\ncan share it. Use the request socket's send_ack() callback and its own\nout-of-window ACK timestamp to send and rate-limit the response.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68118" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0fe4636665d14a258de70b4f3e8248e6d42038f1", "url": "https://git.kernel.org/stable/c/0fe4636665d14a258de70b4f3e8248e6d42038f1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/22cec809b048495310f206d9abbcdbbfbdce3ae3", "url": "https://git.kernel.org/stable/c/22cec809b048495310f206d9abbcdbbfbdce3ae3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/234f9ffbd9b2c1b24ec67200ea3cff07401bec48", "url": "https://git.kernel.org/stable/c/234f9ffbd9b2c1b24ec67200ea3cff07401bec48" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49", "url": "https://git.kernel.org/stable/c/8b0a3a094f4cae2fb92e4d08d4eef7246a9d9c49" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a28c4fcbf774e23b4779cae468e3497a5ad1f4a1", "url": "https://git.kernel.org/stable/c/a28c4fcbf774e23b4779cae468e3497a5ad1f4a1" } ], "release_date": "2026-08-10T13:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-52515", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: Do not call scsi_done() from srp_abort()\n\nAfter scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler\ncallback, it performs one of the following actions:\n* Call scsi_queue_insert().\n* Call scsi_finish_command().\n* Call scsi_eh_scmd_add().\nHence, SCSI abort handlers must not call scsi_done(). Otherwise all\nthe above actions would trigger a use-after-free. Hence remove the\nscsi_done() call from srp_abort(). Keep the srp_free_req() call\nbefore returning SUCCESS because we may not see the command again if\nSUCCESS is returned.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-52515" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc", "url": "https://git.kernel.org/stable/c/05a10b316adaac1f322007ca9a0383b410d759cc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a", "url": "https://git.kernel.org/stable/c/26788a5b48d9d5cd3283d777d238631c8cd7495a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206", "url": "https://git.kernel.org/stable/c/2b298f9181582270d5e95774e5a6c7a7fb5b1206" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5", "url": "https://git.kernel.org/stable/c/b9bdffb3f9aaeff8379c83f5449c6b42cb71c2b5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb", "url": "https://git.kernel.org/stable/c/e193b7955dfad68035b983a0011f4ef3590c85eb" } ], "release_date": "2024-03-02T21:52:25Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98186", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length\n\nmwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a\nbeacon/probe-response RSN or WPA information element and then walks that\nmany 4-byte OUIs, comparing each with memcmp(). The count comes straight\nfrom the (attacker-supplied) IE and is never checked against the\nelement's own length, and the callers admit the element on element_id\nalone (has_ieee_hdr() / has_vendor_hdr(), no length check). A crafted\nRSN/WPA IE with a large pairwise count therefore makes the walk read up\nto 255 * 4 bytes past the element -- an out-of-bounds read of the\nkmemdup()'d beacon buffer, reachable from any AP whose beacon/probe\nresponse is processed during scan-result parsing.\n\nPass the number of IE bytes available at the OUI list and bound the walk\nto the element. Keep the length signed and reject a negative value\nbefore any unsigned arithmetic, so a small or zero IE length cannot\nunderflow to a large size_t and defeat the bound.\n\nFound by 0sec automated security-research tooling (https://0sec.ai).", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98186" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2402c9e2644b7e10c7aaaf87bf12743d7e363559", "url": "https://git.kernel.org/stable/c/2402c9e2644b7e10c7aaaf87bf12743d7e363559" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df", "url": "https://git.kernel.org/stable/c/46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/54a9cc5bd70b0d77a5069d4c46998c679a10c857", "url": "https://git.kernel.org/stable/c/54a9cc5bd70b0d77a5069d4c46998c679a10c857" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/58767b41f87244eebaa5a475b9d276c83b89b933", "url": "https://git.kernel.org/stable/c/58767b41f87244eebaa5a475b9d276c83b89b933" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/77e642af7f2f6029e12a35c847c56cbd0466e799", "url": "https://git.kernel.org/stable/c/77e642af7f2f6029e12a35c847c56cbd0466e799" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960", "url": "https://git.kernel.org/stable/c/8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed", "url": "https://git.kernel.org/stable/c/982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e667aee1c192d67d27c803007bfa9c6e0873e959", "url": "https://git.kernel.org/stable/c/e667aee1c192d67d27c803007bfa9c6e0873e959" } ], "release_date": "2026-10-06T09:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90294", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: delay the final Login Response until the session is registered\n\nisert_put_login_tx() puts the final Login Response on the wire before\n__transport_register_session(), which iscsi_post_login_handler() reaches\nonly after iscsi_target_do_login() returns. An initiator that issues a\nSCSI command as soon as it sees that response can have it executed against\nan se_session whose se_tpg is still NULL, and the ib-comp-wq worker oopses\non the NULL dereference.\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]\n CPU: 0 UID: 0 PID: 178 Comm: kworker/0:1H Not tainted 7.2.0-rc5-V2CTL-gf5098b6bae76 #10 PREEMPT(lazy)\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Workqueue: ib-comp-wq ib_cq_poll_work\n RIP: 0010:target_submit+0xbe/0x390\n Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 89 02 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 64 24 18 49 8d 7c 24 78 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5a 02 00 00 48 8d 7b 78 4d 8b 6c 24 78 48 b8 00\n RSP: 0018:ffff8881058cfa78 EFLAGS: 00010206\n RAX: dffffc0000000000 RBX: ffff88810c78c6f0 RCX: ffffffff964bb363\n RDX: 000000000000000f RSI: 00000000fffffe00 RDI: 0000000000000078\n RBP: 1ffff11020b19f52 R08: 0000000000000001 R09: ffffed1020b19f52\n R10: 0000000000000003 R11: ffff88810596c000 R12: 0000000000000000\n R13: ffff88810c61b000 R14: ffff88810c6a3400 R15: ffff88810c61b044\n FS: 0000000000000000(0000) GS:ffff8881822b2000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f1f1b83c000 CR3: 000000006fe72001 CR4: 0000000000770ef0\n PKRU: 55555554\n Call Trace:\n \n ? __pfx__raw_spin_lock_bh+0x10/0x10\n ? __pfx_target_submit+0x10/0x10\n ? mutex_lock+0x81/0xe0\n ? __pfx_mutex_lock+0x10/0x10\n ? iscsit_execute_cmd+0x650/0x850\n iscsit_sequence_cmd+0x186/0x3d0\n iscsit_process_scsi_cmd+0x87/0x300\n isert_recv_done+0x1002/0x2390\n ? __pfx_isert_recv_done+0x10/0x10\n ? rxe_poll_cq+0x253/0x3d0\n ? finish_task_switch.isra.0+0x1dc/0xa70\n __ib_process_cq+0xe1/0x390\n ib_cq_poll_work+0x46/0x150\n process_one_work+0x633/0x1030\n ? assign_work+0x11d/0x370\n worker_thread+0x45b/0xd10\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2c6/0x3b0\n ? recalc_sigpending+0x15c/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x36e/0x5a0\n ? __pfx_ret_from_fork+0x10/0x10\n ? __switch_to+0x572/0xdd0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \n Modules linked in:\n ---[ end trace 0000000000000000 ]---\n\nDelay the final Login Response instead. isert_get_rx_pdu() runs from\niscsi_target_rx_thread() after conn->rx_login_comp, completed by\niscsi_post_login_handler() after __transport_register_session(); iscsi-TCP\nand cxgbit already take PDUs from that thread, isert alone does not. The\nbuffers are still posted first, so the initiator's first command does not\nmeet an empty receive queue and nothing depends on RNR flow control, and\nthe header and payload live in isert_conn, not in the struct iscsi_login\nthat iscsi_target_nego_release() frees first.\n\nOver rxe, 400 login cycles per run, the oops appeared in 10 of 20\nunpatched runs and in none of 20 runs with this patch. An\ninitiator that never waits is handled by the next patch.\n\nNot tested: iWARP, discovery sessions over iSER, and real HCAs.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90294" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0d2efc355982064855f24f73f9fbb6c65ca4a5c7", "url": "https://git.kernel.org/stable/c/0d2efc355982064855f24f73f9fbb6c65ca4a5c7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11694889c4bab47047a60690ceb70d7551ed5b2e", "url": "https://git.kernel.org/stable/c/11694889c4bab47047a60690ceb70d7551ed5b2e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4397ea31e3b0d017c2b9b876b326df0b3eb845bf", "url": "https://git.kernel.org/stable/c/4397ea31e3b0d017c2b9b876b326df0b3eb845bf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/464f5afa92d071a226f88424803b0fcf88093ede", "url": "https://git.kernel.org/stable/c/464f5afa92d071a226f88424803b0fcf88093ede" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a18fb8d540b3e631cb7e50e55f3c462c05b3a114", "url": "https://git.kernel.org/stable/c/a18fb8d540b3e631cb7e50e55f3c462c05b3a114" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a6c19af05c170f267eca1d01c3c72c84ba7860ae", "url": "https://git.kernel.org/stable/c/a6c19af05c170f267eca1d01c3c72c84ba7860ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e148dbac43308d9e4313070bfc5b355d03134809", "url": "https://git.kernel.org/stable/c/e148dbac43308d9e4313070bfc5b355d03134809" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f84e9adf4d9f4c0c79ef4a7d9e0c5c08b1337033", "url": "https://git.kernel.org/stable/c/f84e9adf4d9f4c0c79ef4a7d9e0c5c08b1337033" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-63917", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_changelink().\n\nip netns add ns1\nip netns add ns2\nip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7\nip -n ns1 link set vti6_test netns ns2\nip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9\nip netns del ns2\nip netns del ns1\n[ 132.495484] ------------[ cut here ]------------\n[ 132.497609] kernel BUG at net/core/dev.c:12376!\n\nCommit 61220ab34948 (\"vti6: Enable namespace changing\") dropped\nNETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then\nmove through IFLA_NET_NS_FD. After the move dev_net(dev) points\nat the new netns while t->net stays at the creation netns.\n\nvti6_changelink() and vti6_update() still use dev_net(dev) and\ndev_net(t->dev). They unlink from one per netns hash and relink\ninto another. The creation netns is left with a stale entry.\ncleanup_net() of that netns later walks freed memory.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-63917" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0cdce7618464f7fb06f461e8f4ad575cb1d570f4", "url": "https://git.kernel.org/stable/c/0cdce7618464f7fb06f461e8f4ad575cb1d570f4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe", "url": "https://git.kernel.org/stable/c/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21", "url": "https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d9c5eecdb3c740e65038651db7c686b10d76d1bc", "url": "https://git.kernel.org/stable/c/d9c5eecdb3c740e65038651db7c686b10d76d1bc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee1778ba0f5cb53be771f97017d01eb356c797bf", "url": "https://git.kernel.org/stable/c/ee1778ba0f5cb53be771f97017d01eb356c797bf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1e89a943ee574d0f2f16246eb3f2d7330fdeb03", "url": "https://git.kernel.org/stable/c/f1e89a943ee574d0f2f16246eb3f2d7330fdeb03" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f5c68875e25f331e497ddfbe81e2d8163a87f136", "url": "https://git.kernel.org/stable/c/f5c68875e25f331e497ddfbe81e2d8163a87f136" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fc32be9ac2788524c6b24efd681cce7a6e731a92", "url": "https://git.kernel.org/stable/c/fc32be9ac2788524c6b24efd681cce7a6e731a92" } ], "release_date": "2026-07-19T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-68428", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Fix use-after-free on vendor module reload\n\nmmu_destroy_caches() destroys pte_list_desc_cache and\nmmu_page_header_cache, but leaves both pointers unchanged. The pointers\nlive in kvm.ko, and therefore survive when a vendor module is unloaded\nwhile kvm.ko remains loaded.\n\nIf creation of pte_list_desc_cache fails during a subsequent vendor\nmodule load, its assignment sets pte_list_desc_cache to NULL and the\nerror path calls mmu_destroy_caches(). mmu_page_header_cache still\npoints to the cache destroyed during the preceding vendor module\nunload. Passing that stale pointer to kmem_cache_destroy() causes a\nslab use-after-free.\n\nReproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y,\nCONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A\none-shot test hook forces pte_list_desc_cache to NULL on the second\ninvocation of kvm_mmu_vendor_module_init():\n\n 1. Load kvm.ko and kvm-intel.ko, creating both caches.\n 2. Unload only kvm_intel, leaving kvm.ko loaded.\n 3. Reload kvm_intel and force initialization through the -ENOMEM path.\n\nKASAN reports:\n\n BUG: KASAN: slab-use-after-free in\n kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]\n ...\n kmem_cache_destroy+0x21/0x1d0\n kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]\n ...\n Allocated by task 16817:\n __kmem_cache_create_args+0x12c/0x3b0\n __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm]\n kvm_mmu_vendor_module_init+0x13b/0x170 [kvm]\n ...\n Freed by task 16820:\n kmem_cache_destroy+0x117/0x1d0\n kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]\n\nClear both pointers immediately after destroying their caches so that\nthe stored state reflects the caches' lifetime and repeated cleanup is\nsafe.\n\nWith the fix applied, the same injected vendor module reload fails with\n-ENOMEM as expected and produces no KASAN report.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68428" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/034b7fa1f5846d69eb51f12ce6d1c71871e83c2d", "url": "https://git.kernel.org/stable/c/034b7fa1f5846d69eb51f12ce6d1c71871e83c2d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/32b9f89ed9e6d7a45075d64089c254a7f6e13695", "url": "https://git.kernel.org/stable/c/32b9f89ed9e6d7a45075d64089c254a7f6e13695" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/42272b0f239f3a89f9c26a01cc37aee06138b1b7", "url": "https://git.kernel.org/stable/c/42272b0f239f3a89f9c26a01cc37aee06138b1b7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/43cfb20d62ffe49626d62beecfc32eb6f262191c", "url": "https://git.kernel.org/stable/c/43cfb20d62ffe49626d62beecfc32eb6f262191c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/52f2f7c30126037975389aa04d24c506a5177c35", "url": "https://git.kernel.org/stable/c/52f2f7c30126037975389aa04d24c506a5177c35" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6f4be73880302d5642c83a0813fdfe1f5fd4b6e3", "url": "https://git.kernel.org/stable/c/6f4be73880302d5642c83a0813fdfe1f5fd4b6e3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/940950d5cd86f250dca578279ad5ca63b4e0986b", "url": "https://git.kernel.org/stable/c/940950d5cd86f250dca578279ad5ca63b4e0986b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ec9daa8fd1b6f45545c9839dca55bd867fad9e13", "url": "https://git.kernel.org/stable/c/ec9daa8fd1b6f45545c9839dca55bd867fad9e13" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72319", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: ensure inner headers in ICMP errors are in headroom\n\nSashiko points out that after stripping the outer headers\nwith pskb_pull() we should ensure the inner IP headers\nin ICMP errors from tunnels are present in the skb headroom\nfor functions like ipv4_update_pmtu(), icmp_send() and\nIP_VS_DBG().\n\nAlso, add more checks for the length of the inner headers.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72319" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/19657b3a17b774ae4e2f2635b5ae8638c9344a40", "url": "https://git.kernel.org/stable/c/19657b3a17b774ae4e2f2635b5ae8638c9344a40" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f7a535ff0fa627a0132803e4c2f903ceffcbc1c", "url": "https://git.kernel.org/stable/c/3f7a535ff0fa627a0132803e4c2f903ceffcbc1c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f48cfe657409fb5c7ba0521b14da6d47546d9cf", "url": "https://git.kernel.org/stable/c/8f48cfe657409fb5c7ba0521b14da6d47546d9cf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/92185d6f7819bc558939ae83de7b1abe90e3b5c2", "url": "https://git.kernel.org/stable/c/92185d6f7819bc558939ae83de7b1abe90e3b5c2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9bc9b95aee2b2e3f1301a16a67ee504960402875", "url": "https://git.kernel.org/stable/c/9bc9b95aee2b2e3f1301a16a67ee504960402875" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a735f9964a3d9ed97daf9b08507f8b5bcafe6326", "url": "https://git.kernel.org/stable/c/a735f9964a3d9ed97daf9b08507f8b5bcafe6326" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dac813101914c21219ac221a60a31a11bc90e7ec", "url": "https://git.kernel.org/stable/c/dac813101914c21219ac221a60a31a11bc90e7ec" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dd22f74a09e25ca298ced0a3763ef353242cb78d", "url": "https://git.kernel.org/stable/c/dd22f74a09e25ca298ced0a3763ef353242cb78d" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53831", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: read sk->sk_family once in sk_mc_loop()\n\nsyzbot is playing with IPV6_ADDRFORM quite a lot these days,\nand managed to hit the WARN_ON_ONCE(1) in sk_mc_loop()\n\nWe have many more similar issues to fix.\n\nWARNING: CPU: 1 PID: 1593 at net/core/sock.c:782 sk_mc_loop+0x165/0x260\nModules linked in:\nCPU: 1 PID: 1593 Comm: kworker/1:3 Not tainted 6.1.40-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023\nWorkqueue: events_power_efficient gc_worker\nRIP: 0010:sk_mc_loop+0x165/0x260 net/core/sock.c:782\nCode: 34 1b fd 49 81 c7 18 05 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 25 36 6d fd 4d 8b 37 eb 13 e8 db 33 1b fd <0f> 0b b3 01 eb 34 e8 d0 33 1b fd 45 31 f6 49 83 c6 38 4c 89 f0 48\nRSP: 0018:ffffc90000388530 EFLAGS: 00010246\nRAX: ffffffff846d9b55 RBX: 0000000000000011 RCX: ffff88814f884980\nRDX: 0000000000000102 RSI: ffffffff87ae5160 RDI: 0000000000000011\nRBP: ffffc90000388550 R08: 0000000000000003 R09: ffffffff846d9a65\nR10: 0000000000000002 R11: ffff88814f884980 R12: dffffc0000000000\nR13: ffff88810dbee000 R14: 0000000000000010 R15: ffff888150084000\nFS: 0000000000000000(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000180 CR3: 000000014ee5b000 CR4: 00000000003506e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\n[] ip6_finish_output2+0x33f/0x1ae0 net/ipv6/ip6_output.c:83\n[] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline]\n[] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211\n[] NF_HOOK_COND include/linux/netfilter.h:298 [inline]\n[] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232\n[] dst_output include/net/dst.h:444 [inline]\n[] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161\n[] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline]\n[] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline]\n[] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\n[] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677\n[] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229\n[] netdev_start_xmit include/linux/netdevice.h:4925 [inline]\n[] xmit_one net/core/dev.c:3644 [inline]\n[] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660\n[] sch_direct_xmit+0x2a0/0x9c0 net/sched/sch_generic.c:342\n[] qdisc_restart net/sched/sch_generic.c:407 [inline]\n[] __qdisc_run+0xb13/0x1e70 net/sched/sch_generic.c:415\n[] qdisc_run+0xd6/0x260 include/net/pkt_sched.h:125\n[] net_tx_action+0x7ac/0x940 net/core/dev.c:5247\n[] __do_softirq+0x2bd/0x9bd kernel/softirq.c:599\n[] invoke_softirq kernel/softirq.c:430 [inline]\n[] __irq_exit_rcu+0xc8/0x170 kernel/softirq.c:683\n[] irq_exit_rcu+0x9/0x20 kernel/softirq.c:695", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53831" } ], "release_date": "2025-12-09T01:29:46Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-97930", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usbusx2y: fix in04_last array size mismatch with in04_buf\n\nThe in04_last array in struct usx2ydev is declared as char[24], but\nin04_buf is allocated as sizeof(struct us428_ctls) which is 21 bytes.\nIn i_usx2y_in04_int(), when ctl_snapshot_last == -2 (initialization\npath):\n\n memcpy(usx2y->in04_last, usx2y->in04_buf, sizeof(usx2y->in04_last));\n\nThis copies 24 bytes from a 21-byte slab allocation, reading 3 bytes\npast the end of the source object.\n\nIntroduce a USX2Y_IN04_SIZE constant defined as sizeof(struct\nus428_ctls) and use it consistently for the in04_last array, the\nin04_buf allocation, the URB transfer length, and the comparison loop,\nreplacing the bare 24 and 21 literals throughout.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97930" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/229cab526580f82839ae8e4e379753c8cf16952e", "url": "https://git.kernel.org/stable/c/229cab526580f82839ae8e4e379753c8cf16952e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/381495b5b3da12d714e53d9d12d955b13fe26eac", "url": "https://git.kernel.org/stable/c/381495b5b3da12d714e53d9d12d955b13fe26eac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/861111a14740e12c36d363e9830f8daa734279c9", "url": "https://git.kernel.org/stable/c/861111a14740e12c36d363e9830f8daa734279c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/869fb83c072e884b80d93eab498e6040ffb010ba", "url": "https://git.kernel.org/stable/c/869fb83c072e884b80d93eab498e6040ffb010ba" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b5753bdfd909f7f095fb464d67802b5e52cbadbf", "url": "https://git.kernel.org/stable/c/b5753bdfd909f7f095fb464d67802b5e52cbadbf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d170cfbe38c8817ac787f605655546a6d343017d", "url": "https://git.kernel.org/stable/c/d170cfbe38c8817ac787f605655546a6d343017d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e75e4b0e647137f4c9f6dee4a7ef5b7b09e16f57", "url": "https://git.kernel.org/stable/c/e75e4b0e647137f4c9f6dee4a7ef5b7b09e16f57" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53754", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()\n\nWhen if_type equals zero and pci_resource_start(pdev, PCI_64BIT_BAR4)\nreturns false, drbl_regs_memmap_p is not remapped. This passes a NULL\npointer to iounmap(), which can trigger a WARN() on certain arches.\n\nWhen if_type equals six and pci_resource_start(pdev, PCI_64BIT_BAR4)\nreturns true, drbl_regs_memmap_p may has been remapped and\nctrl_regs_memmap_p is not remapped. This is a resource leak and passes a\nNULL pointer to iounmap().\n\nTo fix these issues, we need to add null checks before iounmap(), and\nchange some goto labels.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53754" } ], "release_date": "2025-12-08T01:19:14Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98486", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: fix MMIO read buffer leak on probe failure\n\nena_device_init() initializes the MMIO read mechanism with\nena_com_mmio_reg_read_request_init(), which allocates a coherent DMA\nbuffer for MMIO read responses.\n\nThe normal removal path releases this buffer through\nena_com_mmio_reg_read_request_destroy(). However, if ena_probe() fails\nafter ena_device_init() succeeds, the error path destroys the admin\nresources and eventually frees ena_dev without destroying the MMIO read\nrequest, leaving the coherent DMA buffer allocated.\n\nCall ena_com_mmio_reg_read_request_destroy() in the probe error path\nbefore releasing the remaining device resources.\n\nThis issue was found by manual code inspection.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98486" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/30ff01b4c7e419bb70f40f01dcd7f6af680808b3", "url": "https://git.kernel.org/stable/c/30ff01b4c7e419bb70f40f01dcd7f6af680808b3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/47785f9f638b064ce6e32e8e3b6f1ffd83849fc2", "url": "https://git.kernel.org/stable/c/47785f9f638b064ce6e32e8e3b6f1ffd83849fc2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7bd3e9a2d0c288e54f51df260d9433163f5fbc1e", "url": "https://git.kernel.org/stable/c/7bd3e9a2d0c288e54f51df260d9433163f5fbc1e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9476b4468862927297c94c440863cd8ed1e7cc83", "url": "https://git.kernel.org/stable/c/9476b4468862927297c94c440863cd8ed1e7cc83" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a0f5fd7a285f44fa402242f26feddfe1d4a0fc6c", "url": "https://git.kernel.org/stable/c/a0f5fd7a285f44fa402242f26feddfe1d4a0fc6c" } ], "release_date": "2026-10-18T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90345", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: fix P2P action frame handling without device vif\n\nSome P2P action frame paths assume the P2P device vif is always\navailable. That is not true when userspace sends non-P2P public action\nframes through the primary interface, or when action-frame abort runs\nafter the P2P device vif has not been created.\n\nFall back to the primary vif when aborting an action frame without a P2P\ndevice vif, and guard P2P device saved IE access before using it for\npeer channel search.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90345" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1b1edb9ebed49099bdc924cef49a9aea8b552199", "url": "https://git.kernel.org/stable/c/1b1edb9ebed49099bdc924cef49a9aea8b552199" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6641ba636bf675b2634c49fe818931cf6ca8f547", "url": "https://git.kernel.org/stable/c/6641ba636bf675b2634c49fe818931cf6ca8f547" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/66b89c6a7da47efb38a9b839c2ae221b23a1c88b", "url": "https://git.kernel.org/stable/c/66b89c6a7da47efb38a9b839c2ae221b23a1c88b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f26e1b16904555e171292e183c3cfc1c38159fc5", "url": "https://git.kernel.org/stable/c/f26e1b16904555e171292e183c3cfc1c38159fc5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f334b26b884dff5d0a558dc464fa55f300868a68", "url": "https://git.kernel.org/stable/c/f334b26b884dff5d0a558dc464fa55f300868a68" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-97929", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usbusx2y: validate URB actual_length in interrupt callback\n\ni_usx2y_in04_int() processes the interrupt URB data without checking\nurb->actual_length. A short transfer from a malfunctioning device\nwould cause the handler to process uninitialized heap data from the\nkmalloc-allocated in04_buf, which is then copied to the mmap-accessible\nctl_snapshot[] array.\n\nFix by using kzalloc() for in04_buf to zero-initialize the buffer,\nand adding an actual_length check to skip processing on short\ntransfers while still resubmitting the URB.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97929" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2770321b358658e0a39fe39ccf6a91ee97a81931", "url": "https://git.kernel.org/stable/c/2770321b358658e0a39fe39ccf6a91ee97a81931" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f5ef203abda9dd36b2af473c7b737d544f807bd", "url": "https://git.kernel.org/stable/c/8f5ef203abda9dd36b2af473c7b737d544f807bd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7d", "url": "https://git.kernel.org/stable/c/b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c156584999bf15118f523ef6c6fedc5b21f46bd9", "url": "https://git.kernel.org/stable/c/c156584999bf15118f523ef6c6fedc5b21f46bd9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c3576cb77b527f223cf2b9fc2b2e9af5e7adee25", "url": "https://git.kernel.org/stable/c/c3576cb77b527f223cf2b9fc2b2e9af5e7adee25" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-74330", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: fix lockless traversals of ->s_children\n\nHaving the parent directory locked protects entries from removal\nby another thread, but it does *not* protect cursors from being\nmoved around by lseek() - or freed, for that matter.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74330" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/459860529c109c5ce08b81c0776ca1200eaaeb4a", "url": "https://git.kernel.org/stable/c/459860529c109c5ce08b81c0776ca1200eaaeb4a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/637ef4961470e04455102b34ac484a34d8eca0a4", "url": "https://git.kernel.org/stable/c/637ef4961470e04455102b34ac484a34d8eca0a4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/77fd6f50f633a52c2db061e7d71d8cb486b0265e", "url": "https://git.kernel.org/stable/c/77fd6f50f633a52c2db061e7d71d8cb486b0265e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/91f289728ec706b7ff1ca0ee845dd73ff2253488", "url": "https://git.kernel.org/stable/c/91f289728ec706b7ff1ca0ee845dd73ff2253488" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9b9e8bb81c41fd27e7b57a1c936fde140548535f", "url": "https://git.kernel.org/stable/c/9b9e8bb81c41fd27e7b57a1c936fde140548535f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9e57e2863872e82e7c7237bc32299f67ebebc543", "url": "https://git.kernel.org/stable/c/9e57e2863872e82e7c7237bc32299f67ebebc543" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb", "url": "https://git.kernel.org/stable/c/b166ab78dc3f48e83d2c80bdfde4159b31fdc5fb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e6d93108e0a27d7e6f95c7e45017d14ba2900d32", "url": "https://git.kernel.org/stable/c/e6d93108e0a27d7e6f95c7e45017d14ba2900d32" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89541", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: harden gss_unwrap_resp_priv length checks\n\ngss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with\n\n offset = (u8 *)(p) - (u8 *)head->iov_base;\n if (offset + opaque_len > rcv_buf->len)\n goto unwrap_failed;\n maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,\n offset + opaque_len, rcv_buf);\n\nBoth operands are u32 and the sum is computed in u32. A reply with\nopaque_len near 0xffffffff makes offset + opaque_len wrap to a small\nvalue that is below rcv_buf->len, so the bound check passes and\ngss_unwrap() is called with end < begin. The check also lacks a\nlower bound, so any opaque_len in [0, GSS_KRB5_TOK_HDR_LEN) is\naccepted and forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt\nheader reads at ptr+4 and ptr+6 then run past the token.\n\nA krb5p NFS server returning a crafted RPCSEC_GSS reply can drive\nthe client into out-of-bounds reads in gss_krb5_unwrap_v2() and the\nrotate_left() loop that follows.\n\nFix by replacing the single combined check with three guards that\nare safe in u32 arithmetic and that enforce the RFC 4121 minimum\nouter token length:\n\n if (offset > rcv_buf->len)\n goto unwrap_failed;\n if (opaque_len > rcv_buf->len - offset)\n goto unwrap_failed;\n if (opaque_len < GSS_KRB5_TOK_HDR_LEN)\n goto unwrap_failed;\n\nThe first guard makes the subtraction in the second guard\nunconditionally safe; offset is derived from a successful\nxdr_inline_decode() in the head kvec, so in practice it already\nsatisfies the bound. The floor mirrors the server-side check added\nin commit 5b757c2e57a5 (\"SUNRPC: svcauth_gss: enforce krb5 token\nminimum length\").", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89541" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3691c4b3488d8ca046b9941e5be30c626dbbbb50", "url": "https://git.kernel.org/stable/c/3691c4b3488d8ca046b9941e5be30c626dbbbb50" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/401f6a5b338d05bb1069ad814d9f77e3c367854f", "url": "https://git.kernel.org/stable/c/401f6a5b338d05bb1069ad814d9f77e3c367854f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/81fd7654a8429718adfcb2a7e03496077f547ed0", "url": "https://git.kernel.org/stable/c/81fd7654a8429718adfcb2a7e03496077f547ed0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/85fa6b12e8f439739ac36ef2aad925f37c8b976a", "url": "https://git.kernel.org/stable/c/85fa6b12e8f439739ac36ef2aad925f37c8b976a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/87831b92112c81db251d46756d65daa4f91af6a2", "url": "https://git.kernel.org/stable/c/87831b92112c81db251d46756d65daa4f91af6a2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/89a15a50f84d32d4b99db86f957427fcbe20a99a", "url": "https://git.kernel.org/stable/c/89a15a50f84d32d4b99db86f957427fcbe20a99a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d395c30d570ca6168f0297b191709927d1258273", "url": "https://git.kernel.org/stable/c/d395c30d570ca6168f0297b191709927d1258273" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ebcbd2523a8524c3d24e111cdbed8e271d910269", "url": "https://git.kernel.org/stable/c/ebcbd2523a8524c3d24e111cdbed8e271d910269" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72392", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump\n\ninet6_dump_fib() saves its progress in cb->args[1] as a positional\nindex within the current hash chain. Between batches, a concurrent\nfib6_new_table() can insert a new table at the chain head, shifting\nall existing entries. The saved index then lands on a different\ntable, causing fib6_dump_table() to set w->root to the wrong table\nwhile w->node still points into the previous one.\nfib6_walk_continue() dereferences w->node->parent (NULL) and panics:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000008\n RIP: 0010:fib6_walk_continue+0x6e/0x170\n Call Trace:\n \n fib6_dump_table.isra.0+0xc5/0x240\n inet6_dump_fib+0xf6/0x420\n rtnl_dumpit+0x30/0xa0\n netlink_dump+0x15b/0x460\n netlink_recvmsg+0x1d6/0x2a0\n ____sys_recvmsg+0x17a/0x190\n\nFix by storing tb->tb6_id in cb->args[1] instead of a positional\nindex. On resume, skip entries until the id matches; a concurrent\nhead-insert can never match the saved id, so the walker always\nresumes on the correct table.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72392" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/059efb48dd746518898faaa9b965511009b59639", "url": "https://git.kernel.org/stable/c/059efb48dd746518898faaa9b965511009b59639" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/110ccbd28c9444866fcc84ba96a2ad64fa6e95ae", "url": "https://git.kernel.org/stable/c/110ccbd28c9444866fcc84ba96a2ad64fa6e95ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/27210d433a8c5fe6bf7278a04bbaeb49a81d0290", "url": "https://git.kernel.org/stable/c/27210d433a8c5fe6bf7278a04bbaeb49a81d0290" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/89f9c5fee3c64c5cabc34e65599308fd3c879cf9", "url": "https://git.kernel.org/stable/c/89f9c5fee3c64c5cabc34e65599308fd3c879cf9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9facb861dc6b9b9ea9793ef5032a9a826f7a4229", "url": "https://git.kernel.org/stable/c/9facb861dc6b9b9ea9793ef5032a9a826f7a4229" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cb90a774a9c6c46961a44949a246fbb61f5f934c", "url": "https://git.kernel.org/stable/c/cb90a774a9c6c46961a44949a246fbb61f5f934c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d8a01d27873e04bebd357dc87859aa756e0b28b2", "url": "https://git.kernel.org/stable/c/d8a01d27873e04bebd357dc87859aa756e0b28b2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee73a32dd258d4af66831ff006b771e19812b322", "url": "https://git.kernel.org/stable/c/ee73a32dd258d4af66831ff006b771e19812b322" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-68146", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Add global mutex to serialize trace_parser access\n\nIn ftrace, the trace_parser structure is allocated and initialized when\na trace file is opened, and is subsequently used across write and release\nhandlers to parse user input.\n\nThe affected handler paths and their specific functions are:\n - Open paths: ftrace_regex_open(), ftrace_graph_open()\n - Write paths: ftrace_regex_write(), ftrace_graph_write()\n - Release paths: ftrace_regex_release(), ftrace_graph_release()\n\nIf userspace opens a trace file descriptor and shares it across multiple\nthreads, concurrent write calls will race on the parser's internal state,\nspecifically the 'idx', 'cont', and 'buffer' fields, leading to corrupted\ninput or undefined behavior.\n\nFix this by adding a global mutex, parser_lock, to serialize all access\nto trace_parser across write and release paths, preventing concurrent\ncorruption of parser state.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68146" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1474fe4453505b6be720b5bb94be1c927de3314a", "url": "https://git.kernel.org/stable/c/1474fe4453505b6be720b5bb94be1c927de3314a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3d0dd138a06c782f8b755cd1b6f9909494514ce1", "url": "https://git.kernel.org/stable/c/3d0dd138a06c782f8b755cd1b6f9909494514ce1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/65bf73bee1a4f3722208ae46afc0fa5de76b9a0a", "url": "https://git.kernel.org/stable/c/65bf73bee1a4f3722208ae46afc0fa5de76b9a0a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7720b63bcef3f54c7fe288774b720a227d54a306", "url": "https://git.kernel.org/stable/c/7720b63bcef3f54c7fe288774b720a227d54a306" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/90be137813e1a5bdfd671e40fe28004fb959d3e4", "url": "https://git.kernel.org/stable/c/90be137813e1a5bdfd671e40fe28004fb959d3e4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a29bc20ea5f0cb79c6287f2c6182c5eeb8e6c01f", "url": "https://git.kernel.org/stable/c/a29bc20ea5f0cb79c6287f2c6182c5eeb8e6c01f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/db76744d588086695371ecdd982694395628ba48", "url": "https://git.kernel.org/stable/c/db76744d588086695371ecdd982694395628ba48" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e807c9193d9493c7a0d039158ebb955050a76df1", "url": "https://git.kernel.org/stable/c/e807c9193d9493c7a0d039158ebb955050a76df1" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80973", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: bound the MIDI event length from the device\n\nusb6fire_comm_receiver_handler() forwards a MIDI event using a length\nbyte the device supplies, with no bound and no check that the transfer\ndelivered that many bytes:\n\n\tif (!urb->status) {\n\t\tif (rt->receiver_buffer[0] == 0x10) /* midi in event */\n\t\t\tif (midi_rt)\n\t\t\t\tmidi_rt->in_received(midi_rt,\n\t\t\t\t\t\trt->receiver_buffer + 2,\n\t\t\t\t\t\trt->receiver_buffer[1]);\n\t}\n\nreceiver_buffer is a 64-byte kzalloc() buffer (COMM_RECEIVER_BUFSIZE), so\nonly 62 bytes follow the two-byte header. receiver_buffer[1] is a u8 the\ndevice chooses, so a device that answers with 0x10 and a length of 0xFF\nmakes snd_rawmidi_receive() read 255 bytes starting two bytes into a\n64-byte object. The bytes past the buffer are handed to userspace\nthrough the rawmidi read path.\n\nurb->actual_length is not consulted either, so a short transfer leaves\nboth the type byte and the length byte at their previous values and the\nhandler acts on stale data.\n\nThe receiver URB is submitted from usb6fire_comm_init() at probe, so the\nread happens on plug with no user action; forwarding to userspace also\nneeds a MIDI input substream open, since usb6fire_midi_in_received()\nonly calls snd_rawmidi_receive() when rt->in is set.\n\nKASAN on 7.2.0-rc5 (arm64), single packet from an emulated device:\n\n BUG: KASAN: slab-out-of-bounds in snd_rawmidi_receive\n Read of size 255 at addr ffff000009f64682 by task bash/183\n __asan_memcpy\n snd_rawmidi_receive\n usb6fire_midi_in_received [snd_usb_6fire]\n usb6fire_comm_receiver_handler [snd_usb_6fire]\n Allocated by task 11:\n usb6fire_comm_init [snd_usb_6fire]\n usb6fire_chip_probe [snd_usb_6fire]\n The buggy address is located 2 bytes inside of\n allocated 64-byte region [ffff000009f64680, ffff000009f646c0)\n\nReject the event when the length exceeds the bytes that follow the\nheader, and require the transfer to have delivered the header plus that\nmany bytes. The receiver URB is submitted with a 64-byte\ntransfer_buffer_length, so a genuine device cannot deliver an event\nlonger than those 62 bytes and nothing valid is dropped.\n\nDiscovered by XBOW, triaged by Baul Lee ", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80973" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/00e84a9ff2d43953ae261995cae94d46f4c307a6", "url": "https://git.kernel.org/stable/c/00e84a9ff2d43953ae261995cae94d46f4c307a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c8a3c773823cf12abd39c480aed70e25c384630", "url": "https://git.kernel.org/stable/c/0c8a3c773823cf12abd39c480aed70e25c384630" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2a6f6fba3bd31d2e8c957fefa29156e35e5e75d5", "url": "https://git.kernel.org/stable/c/2a6f6fba3bd31d2e8c957fefa29156e35e5e75d5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c590d5e1b1595d5c8fa0b72d2897423ce9985ca", "url": "https://git.kernel.org/stable/c/2c590d5e1b1595d5c8fa0b72d2897423ce9985ca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/34816e2cfeabafb8eccf54687186ce25699e8363", "url": "https://git.kernel.org/stable/c/34816e2cfeabafb8eccf54687186ce25699e8363" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/466e911bbbbb779bb06337e35a286e5ca7af16b3", "url": "https://git.kernel.org/stable/c/466e911bbbbb779bb06337e35a286e5ca7af16b3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a478893b59e36cfe7d77a76b352f2db55502e879", "url": "https://git.kernel.org/stable/c/a478893b59e36cfe7d77a76b352f2db55502e879" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c9204bc2ed2010e2469dbe5fce598878a37efd04", "url": "https://git.kernel.org/stable/c/c9204bc2ed2010e2469dbe5fce598878a37efd04" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98015", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put\n\nIn mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads\ntt->ref_count after termtbl_mutex has been released. Two concurrent\ncallers on the same mlx5_termtbl_handle race: one decrements ref_count\nto zero, removes the hash entry, and calls kfree(tt) while the other\nhas already dropped the mutex and is about to evaluate\nif (!tt->ref_count), producing a use-after-free.\n\nFix this by capturing the result of the decrement into a stack-local\nlast variable before dropping the mutex. The cleanup decision is now\nmade entirely under termtbl_mutex, and tt is not touched after\nkfree.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98015" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/18b2969073879b9cce24e1a78b118bdad54518d1", "url": "https://git.kernel.org/stable/c/18b2969073879b9cce24e1a78b118bdad54518d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/304ea40ef4561671503c36e47da44a0a31b71e36", "url": "https://git.kernel.org/stable/c/304ea40ef4561671503c36e47da44a0a31b71e36" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7ee07f601f8f507c9faf25c68a49396ab8950596", "url": "https://git.kernel.org/stable/c/7ee07f601f8f507c9faf25c68a49396ab8950596" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/92f581cac93a71723456ac79ef54d9f60a251b42", "url": "https://git.kernel.org/stable/c/92f581cac93a71723456ac79ef54d9f60a251b42" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a5833fdf53350b8b95a558fcf0056ddb1c0fe154", "url": "https://git.kernel.org/stable/c/a5833fdf53350b8b95a558fcf0056ddb1c0fe154" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797", "url": "https://git.kernel.org/stable/c/b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e393789e92310d7c66f57c876101779c90816a12", "url": "https://git.kernel.org/stable/c/e393789e92310d7c66f57c876101779c90816a12" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3ee194a790896fa92fea20b5385a354be2f2c12", "url": "https://git.kernel.org/stable/c/e3ee194a790896fa92fea20b5385a354be2f2c12" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98494", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read\n\nSame issue as atl1c (see the first commit in this series, \"net:\natl1c: fix soft lockup on out-of-range tpd_cons read\"): the hardware\ncan report an out-of-range cmb_tpd_next_to_clean (seen as 0xffff)\nwhile the PCIe link/MAC is resetting. An out-of-range value can\nnever be reached and the loop below would spin forever. Treat it as\n\"nothing new to clean\" instead.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98494" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0f573b0576252d44fb27ab8470ea873bc6408ef3", "url": "https://git.kernel.org/stable/c/0f573b0576252d44fb27ab8470ea873bc6408ef3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/43e746821f5f5afbbf68e388bf9fbe221e03bfca", "url": "https://git.kernel.org/stable/c/43e746821f5f5afbbf68e388bf9fbe221e03bfca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5d7ac337d37cb97d77e4c910d37746694b606661", "url": "https://git.kernel.org/stable/c/5d7ac337d37cb97d77e4c910d37746694b606661" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6285919d4c06254d257d24dc980f6332e1984a82", "url": "https://git.kernel.org/stable/c/6285919d4c06254d257d24dc980f6332e1984a82" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/632cd7b81cb7bab36112f02eb2ee7f7cc1214fb1", "url": "https://git.kernel.org/stable/c/632cd7b81cb7bab36112f02eb2ee7f7cc1214fb1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6ab9f61ca851f02ae4398cebaf00735a22e1d6ca", "url": "https://git.kernel.org/stable/c/6ab9f61ca851f02ae4398cebaf00735a22e1d6ca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/79e2447b11322c27ef9ac423be0a94efc7691f02", "url": "https://git.kernel.org/stable/c/79e2447b11322c27ef9ac423be0a94efc7691f02" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c55e51d5899e80f9593b26985ed0b89e0c828a5e", "url": "https://git.kernel.org/stable/c/c55e51d5899e80f9593b26985ed0b89e0c828a5e" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-93048", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()\n\nmtd_add_partition() does not reject the special offset value\nMTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in\nadd_mtd_device() when called through the BLKPG ioctl on NAND\ndevices. The RETAIN value depends on cur_offset being the end of\nthe previous partition, but in the dynamic partition path\ncur_offset equals the offset argument itself, causing undefined\nbehavior.\n\nCommit 5daa7b21496a (\"mtd: prepare partition add and del functions\nfor ioctl requests\") introduced mtd_add_partition() and correctly\nrejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2),\nsince those special offsets rely on cur_offset tracking the\nprevious partition's end. However, commit 1a31368bf92e (\"mtd: add a flags\nfor partitions which should just leave smth. after them\")\nlater added MTDPART_OFS_RETAIN (-3) for the static\npartition table path without updating mtd_add_partition() to\nalso reject this value.\n\nWith offset=-3 passed via BLKPG, the RETAIN size calculation in\nallocate_partition() underflows (parent_size - 0xFFFFFFFFFFFFFFFD\n= parent_size + 3). If the underflow result does not appear to\nleave enough space, allocate_partition() jumps to out_register via\ngoto, skipping erasesize initialization. This results in\nerasesize=0, which triggers:\n\nWARN_ON((!mtd->erasesize || !master->_erase) &&\n\t\t!(mtd->flags & MTD_NO_ERASE))\n\nin add_mtd_device(). If the underflow result appears to leave\nenough space, a bogus partition size is calculated, but the\n\"out of reach\" sanity check catches the invalid offset and\ncreates a disabled empty partition (offset=0, size=0) instead\nof returning an error.\n\nFix this by adding MTDPART_OFS_RETAIN to the rejection list in\nmtd_add_partition(), consistent with the existing handling of\nAPPEND and NXTBLK.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-93048" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/181c1bff940e7d3e34ca485d37e3cdbfe409203c", "url": "https://git.kernel.org/stable/c/181c1bff940e7d3e34ca485d37e3cdbfe409203c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/398aca2f90122d5abbabff1079deaeb885fe9e40", "url": "https://git.kernel.org/stable/c/398aca2f90122d5abbabff1079deaeb885fe9e40" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6aaab2ace3f7b55733d904e5549acf8405f03642", "url": "https://git.kernel.org/stable/c/6aaab2ace3f7b55733d904e5549acf8405f03642" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/701c3ae7273e1adc20db5d97c42e0139b479f16b", "url": "https://git.kernel.org/stable/c/701c3ae7273e1adc20db5d97c42e0139b479f16b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a536eb57be58442b19398b2783071007ecfb1735", "url": "https://git.kernel.org/stable/c/a536eb57be58442b19398b2783071007ecfb1735" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b759d5bb6265419344ee9729fd0dc07ad85719d8", "url": "https://git.kernel.org/stable/c/b759d5bb6265419344ee9729fd0dc07ad85719d8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff", "url": "https://git.kernel.org/stable/c/c645f6dd1af2ecc70fd3578e141f2f71fa9e4eff" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e204e5c49a012f99638633fdbd773e3c86260053", "url": "https://git.kernel.org/stable/c/e204e5c49a012f99638633fdbd773e3c86260053" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98358", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/iser: reject a remote invalidation of an unregistered direction\n\nA write command whose data is sent entirely as immediate data is not\nregistered. iser_reg_mem_fastreg() takes the DMA key path and leaves\nrdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has\nalready set dir[ISER_DIR_OUT].\n\niser_check_remote_inv() looks at dir[] alone and hands the descriptor to\niser_inv_desc(), which reads desc->sig_protected. A target that answers\nsuch a command with IB_WR_SEND_WITH_INV faults the initiator.\nLeaving those commands unregistered is deliberate.\n\nThe same function already terminates the connection when a target sends\na remote invalidation the initiator did not ask for. A target that\ninvalidates a direction that was never registered is in the same class,\nso give it the same answer.\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]\n CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy)\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Workqueue: rxe_wq do_work\n RIP: 0010:iser_task_rsp+0x6d6/0xec0\n Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04\n RSP: 0018:ffff88811b008db8 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848\n RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020\n RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0\n R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800\n R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000\n FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0\n PKRU: 55555554\n Call Trace:\n \n __ib_process_cq+0xe1/0x390\n ib_poll_handler+0x6e/0x200\n irq_poll_softirq+0x1df/0x480\n ? clockevents_program_event+0x2ba/0x860\n ? __pfx_irq_poll_softirq+0x10/0x10\n handle_softirqs+0x18e/0x590\n ? __pfx_handle_softirqs+0x10/0x10\n ? __hrtimer_rearm_deferred+0x156/0x450\n do_softirq+0x3b/0x60\n \n \n __local_bh_enable_ip+0x61/0x70\n __alloc_skb+0x732/0x890\n ? _raw_spin_lock_irqsave+0x85/0xe0\n ? __pfx___alloc_skb+0x10/0x10\n ? _raw_read_unlock_irqrestore+0x16/0x50\n rxe_init_packet+0x16b/0x4f0\n prepare_ack_packet+0xb8/0x830\n rxe_receiver+0x499/0x9980\n ? __pfx_rxe_receiver+0x10/0x10\n ? rxe_completer+0x29e5/0x38c0\n ? hrtimer_start_range_ns_common+0x75f/0x1730\n ? hrtimer_start_range_ns+0xa6/0x2c0\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __pfx_rxe_receiver+0x10/0x10\n do_work+0x144/0x470\n process_one_work+0x633/0x1030\n ? assign_work+0x11d/0x370\n worker_thread+0x45b/0xd10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2c6/0x3b0\n ? recalc_sigpending+0x15c/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x36e/0x5a0\n ? __pfx_ret_from_fork+0x10/0x10\n ? __switch_to+0x572/0xdd0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \n Modules linked in:\n ---[ end trace 0000000000000000 ]---", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98358" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/198e4db9add54a50cce60a5d80b8f0ee5456b65a", "url": "https://git.kernel.org/stable/c/198e4db9add54a50cce60a5d80b8f0ee5456b65a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/19ddd4af7fce9200e70882f622011e9dd130f427", "url": "https://git.kernel.org/stable/c/19ddd4af7fce9200e70882f622011e9dd130f427" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6ed3ebaff3345837f0528d85bd39ce573c7b9a41", "url": "https://git.kernel.org/stable/c/6ed3ebaff3345837f0528d85bd39ce573c7b9a41" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9d145a2d8d6f8f2cc460b80df41870819048f2a0", "url": "https://git.kernel.org/stable/c/9d145a2d8d6f8f2cc460b80df41870819048f2a0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4d278c91209931199db9c0836dc2e21a7593dad", "url": "https://git.kernel.org/stable/c/b4d278c91209931199db9c0836dc2e21a7593dad" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b9e37452915feaa8422af87dea5d0c16a7d1ff13", "url": "https://git.kernel.org/stable/c/b9e37452915feaa8422af87dea5d0c16a7d1ff13" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ceecf3f9c322fc6937a66682942a26ad13a34a07", "url": "https://git.kernel.org/stable/c/ceecf3f9c322fc6937a66682942a26ad13a34a07" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d85f0f0a7c85756fc992c70d869706f19dac9259", "url": "https://git.kernel.org/stable/c/d85f0f0a7c85756fc992c70d869706f19dac9259" } ], "release_date": "2026-10-06T09:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-68377", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_tunnel_key: Defer dst_release to RCU callback\n\nFix a race-condition use-after-free in tunnel_key_release_params().\n\nThe function releases the metadata_dst of the old params synchronously\nvia dst_release() while deferring the params struct free with\nkfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may\nstill hold the old params pointer (under rcu_read_lock_bh) and proceed\nto call dst_clone(¶ms->tcft_enc_metadata->dst) after the writer's\ndst_release has already pushed the dst's rcuref to RCUREF_DEAD.\n\nzdi-disclosures@trendmicro.com produced a poc which i (and Victor) verified\nthat KASAN reports:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112\nBUG: KASAN: slab-use-after-free in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326\nBUG: KASAN: slab-use-after-free in __rcuref_put include/linux/rcuref.h:109\nBUG: KASAN: slab-use-after-free in rcuref_put include/linux/rcuref.h:173\nBUG: KASAN: slab-use-after-free in dst_release+0x5b/0x370 net/core/dst.c:168\nWrite of size 4 at addr ffff88806158de40 by task poc/9388\n\nCPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy)\nTainted: [W]=WARN\nHardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n \n __dump_stack lib/dump_stack.c:94\n dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378\n print_report+0x139/0x4ad mm/kasan/report.c:482\n kasan_report+0xe4/0x1d0 mm/kasan/report.c:595\n check_region_inline mm/kasan/generic.c:186\n kasan_check_range+0x125/0x200 mm/kasan/generic.c:200\n instrument_atomic_read_write include/linux/instrumented.h:112\n atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326\n __rcuref_put include/linux/rcuref.h:109\n rcuref_put include/linux/rcuref.h:173\n dst_release+0x5b/0x370 net/core/dst.c:168\n refdst_drop include/net/dst.h:272\n skb_dst_drop include/net/dst.h:284\n skb_release_head_state+0x293/0x400 net/core/skbuff.c:1163\n skb_release_all net/core/skbuff.c:1187\n[..]\nAllocated by task 9391:\n kasan_save_stack+0x30/0x50 mm/kasan/common.c:57\n kasan_save_track+0x14/0x30 mm/kasan/common.c:78\n poison_kmalloc_redzone mm/kasan/common.c:398\n __kasan_kmalloc+0x9a/0xb0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263\n __do_kmalloc_node mm/slub.c:5296\n __kmalloc_noprof+0x2f1/0x830 mm/slub.c:5308\n kmalloc_noprof include/linux/slab.h:954\n kzalloc_noprof include/linux/slab.h:1188\n offload_action_alloc+0x2f/0x130 net/core/flow_offload.c:35\n tcf_action_offload_add_ex+0x1ba/0x880 net/sched/act_api.c:258\n tcf_action_offload_add net/sched/act_api.c:293\n tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547\n tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101\n[..]\nFreed by task 9391:\n kasan_save_stack+0x30/0x50 mm/kasan/common.c:57\n kasan_save_track+0x14/0x30 mm/kasan/common.c:78\n kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584\n poison_slab_object mm/kasan/common.c:253\n __kasan_slab_free+0x6b/0x90 mm/kasan/common.c:285\n kasan_slab_free include/linux/kasan.h:235\n slab_free_hook mm/slub.c:2689\n slab_free mm/slub.c:6251\n kfree+0x21f/0x6b0 mm/slub.c:6566\n tcf_action_offload_add_ex+0x4ad/0x880 net/sched/act_api.c:284\n tcf_action_offload_add net/sched/act_api.c:293\n tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547\n tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101\n\nThe buggy address belongs to the object at ffff88806158de00\n which belongs to the cache kmalloc-256 of size 256\nThe buggy address is located 64 bytes inside of\n freed 256-byte region [ffff88806158de00, ffff88806158df00)\n\nThe buggy address belongs to the physical page:\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c\nhead: order:1 mapcount:0 entire_map\n---truncated---", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68377" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2200a00ff247f70f5dcdb4e6f14b0d48ddac5467", "url": "https://git.kernel.org/stable/c/2200a00ff247f70f5dcdb4e6f14b0d48ddac5467" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2791a501da508b704a617b4dba29db54a65bc9f7", "url": "https://git.kernel.org/stable/c/2791a501da508b704a617b4dba29db54a65bc9f7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/389d03992dabb80488228e8119b9dd6d0f58e1a6", "url": "https://git.kernel.org/stable/c/389d03992dabb80488228e8119b9dd6d0f58e1a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/531dbb5bb98e52ad26be7e90f9f8bec707c5bd0e", "url": "https://git.kernel.org/stable/c/531dbb5bb98e52ad26be7e90f9f8bec707c5bd0e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/676ad6aa7cec89a08d2a5ce3cd5959e313f29733", "url": "https://git.kernel.org/stable/c/676ad6aa7cec89a08d2a5ce3cd5959e313f29733" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b5931f020b681fdcb9378262d89b61cb3c7ebbf8", "url": "https://git.kernel.org/stable/c/b5931f020b681fdcb9378262d89b61cb3c7ebbf8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1f5c8a3955f8fda3f84ed883ac8daa1847e724c", "url": "https://git.kernel.org/stable/c/f1f5c8a3955f8fda3f84ed883ac8daa1847e724c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fed1b1ddab41a0e7a462ac690a0c8af6ff793624", "url": "https://git.kernel.org/stable/c/fed1b1ddab41a0e7a462ac690a0c8af6ff793624" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90103", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.2: fix LAYOUTSTATS send buffer exhaustion\n\nencode_layoutstats_maxsz budgets XDR_QUADLEN(PNFS_LAYOUTSTATS_MAXSIZE),\ni.e. 256 bytes, for the layoutupdate4 body written by the layout driver.\nThe flexfiles record can exceed that.\n\nff_layout_encode_ff_layoutupdate() emits, per data server, a netaddr4,\nan nfs_fh4, two ff_io_latency4, an nfstime4 and a bool. A data server\nwhose filehandle is NFS_MAXFHSIZE bytes long already accounts for 132 of\nthose bytes, and the two ff_io_latency4 at 64 bytes each, the nfstime4\nand the bool add a further 144, so the body passes 256 bytes before the\nnetaddr4 is encoded at all. encode_layoutstats() additionally writes\nthe deviceid4 and the layoutupdate4 lou_type word, neither of which the\nmacro accounts for.\n\nThe filehandle and the address are both chosen by the server, through\nLAYOUTGET and GETDEVICEINFO, so it can drive the encoder past the\nend of the send buffer. xdr_reserve_space() returns NULL once that\nhappens, and the two ff_layout_encode_io_latency() calls run with\ndss_info->mirror->lock held, so a NULL return there leaves the lock\npermanently held.\n\nRaise PNFS_LAYOUTSTATS_MAXSIZE to 384 so that the record fits inside the\nreservation.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90103" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3815b894b922e9b4f40b8b6f6d67bf80d44141c9", "url": "https://git.kernel.org/stable/c/3815b894b922e9b4f40b8b6f6d67bf80d44141c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/397aa7000bbf6b6a0d32e66a544e978fb478c8e4", "url": "https://git.kernel.org/stable/c/397aa7000bbf6b6a0d32e66a544e978fb478c8e4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5aca000630c0fd0da102ae1abf9245dd74f2ce36", "url": "https://git.kernel.org/stable/c/5aca000630c0fd0da102ae1abf9245dd74f2ce36" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/842ac26615424577f24f0486b9d3bf97f28fad9c", "url": "https://git.kernel.org/stable/c/842ac26615424577f24f0486b9d3bf97f28fad9c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a973622da0c62c34043ddbbf382cd761b03e5136", "url": "https://git.kernel.org/stable/c/a973622da0c62c34043ddbbf382cd761b03e5136" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c75ef2137e749f2673f0617cfdaae53b2bb7195a", "url": "https://git.kernel.org/stable/c/c75ef2137e749f2673f0617cfdaae53b2bb7195a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cb11590c7ddc6883a1b1d70b1f98b2779fe626f2", "url": "https://git.kernel.org/stable/c/cb11590c7ddc6883a1b1d70b1f98b2779fe626f2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e82d7d999fe9f893f84bf332fd39cb5d9de7128f", "url": "https://git.kernel.org/stable/c/e82d7d999fe9f893f84bf332fd39cb5d9de7128f" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-47713", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()\n\nSince '__dev_queue_xmit()' should be called with interrupts enabled,\nthe following backtrace:\n\nieee80211_do_stop()\n ...\n spin_lock_irqsave(&local->queue_stop_reason_lock, flags)\n ...\n ieee80211_free_txskb()\n ieee80211_report_used_skb()\n ieee80211_report_ack_skb()\n cfg80211_mgmt_tx_status_ext()\n nl80211_frame_tx_status()\n genlmsg_multicast_netns()\n genlmsg_multicast_netns_filtered()\n nlmsg_multicast_filtered()\n\t netlink_broadcast_filtered()\n\t do_one_broadcast()\n\t netlink_broadcast_deliver()\n\t __netlink_sendskb()\n\t netlink_deliver_tap()\n\t __netlink_deliver_tap_skb()\n\t dev_queue_xmit()\n\t __dev_queue_xmit() ; with IRQS disabled\n ...\n spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags)\n\nissues the warning (as reported by syzbot reproducer):\n\nWARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120\n\nFix this by implementing a two-phase skb reclamation in\n'ieee80211_do_stop()', where actual work is performed\noutside of a section with interrupts disabled.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-47713" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/04f75f5bae33349283d6886901d9acd2f110c024", "url": "https://git.kernel.org/stable/c/04f75f5bae33349283d6886901d9acd2f110c024" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/058c9026ad79dc98572442fd4c7e9a36aba6f596", "url": "https://git.kernel.org/stable/c/058c9026ad79dc98572442fd4c7e9a36aba6f596" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/07eb0bd7b0a8abed9d45e0f567c9af1dc83e5268", "url": "https://git.kernel.org/stable/c/07eb0bd7b0a8abed9d45e0f567c9af1dc83e5268" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9d301de12da6e1bb069a9835c38359b8e8135121", "url": "https://git.kernel.org/stable/c/9d301de12da6e1bb069a9835c38359b8e8135121" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/acb53a716e492a02479345157c43f21edc8bc64b", "url": "https://git.kernel.org/stable/c/acb53a716e492a02479345157c43f21edc8bc64b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ad4b7068b101fbbb4a9ca4b99b25eb051a9482ec", "url": "https://git.kernel.org/stable/c/ad4b7068b101fbbb4a9ca4b99b25eb051a9482ec" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/db5ca4b42ccfa42d2af7b335ff12578e57775c02", "url": "https://git.kernel.org/stable/c/db5ca4b42ccfa42d2af7b335ff12578e57775c02" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eab272972cffff9cd973b8e4055a8e81c64f7e6a", "url": "https://git.kernel.org/stable/c/eab272972cffff9cd973b8e4055a8e81c64f7e6a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f232916fab67ca1c3425926df4a866e59ff26908", "url": "https://git.kernel.org/stable/c/f232916fab67ca1c3425926df4a866e59ff26908" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html" } ], "release_date": "2024-10-21T12:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-89527", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Use svc_xprt_put to free listener on create failure\n\nsvc_rdma_create() calls kfree(cma_xprt) when\nsvc_rdma_create_listen_id() fails. svc_xprt_init() has already\nacquired a net namespace reference via get_net_track(); kfree\nbypasses svc_xprt_free() which releases it.\n\nReplace the kfree() with svc_xprt_put() so the kref_init birth\nreference drops to zero and svc_xprt_free() dispatches\nsvc_rdma_free() to clean up properly. sc_cm_id is still NULL\nat that point; the preceding patch added the necessary NULL\nguard in svc_rdma_free().\n\nsvc_xprt_free() also drops the module reference via\nmodule_put(), but the caller _svc_xprt_create() does the same\non xpo_create failure, double-putting the single\ntry_module_get() it acquired. Take a compensating\n__module_get() before the svc_xprt_put() to keep the count\nbalanced, matching the convention in svc_rdma_accept()'s error\npath.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89527" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2e35ec558b8cece9399a50141ecaeadbdb8768dc", "url": "https://git.kernel.org/stable/c/2e35ec558b8cece9399a50141ecaeadbdb8768dc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ac1dd6002f758ab7dd3e737757e5a1bb1c0b38d6", "url": "https://git.kernel.org/stable/c/ac1dd6002f758ab7dd3e737757e5a1bb1c0b38d6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e346ef7bcb137f50c49f969330ab7dcf64ea1654", "url": "https://git.kernel.org/stable/c/e346ef7bcb137f50c49f969330ab7dcf64ea1654" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e68380710fc970e07610b2f42594575ad35fdb1c", "url": "https://git.kernel.org/stable/c/e68380710fc970e07610b2f42594575ad35fdb1c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee70d690b5544b736706a9a5796aafb634013f54", "url": "https://git.kernel.org/stable/c/ee70d690b5544b736706a9a5796aafb634013f54" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-50849", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore: Avoid kcore oops by vmap()ing with VM_IOREMAP\n\nAn oops can be induced by running 'cat /proc/kcore > /dev/null' on\ndevices using pstore with the ram backend because kmap_atomic() assumes\nlowmem pages are accessible with __va().\n\n Unable to handle kernel paging request at virtual address ffffff807ff2b000\n Mem abort info:\n ESR = 0x96000006\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x06: level 2 translation fault\n Data abort info:\n ISV = 0, ISS = 0x00000006\n CM = 0, WnR = 0\n swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000081d87000\n [ffffff807ff2b000] pgd=180000017fe18003, p4d=180000017fe18003, pud=180000017fe18003, pmd=0000000000000000\n Internal error: Oops: 96000006 [#1] PREEMPT SMP\n Modules linked in: dm_integrity\n CPU: 7 PID: 21179 Comm: perf Not tainted 5.15.67-10882-ge4eb2eb988cd #1 baa443fb8e8477896a370b31a821eb2009f9bfba\n Hardware name: Google Lazor (rev3 - 8) (DT)\n pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __memcpy+0x110/0x260\n lr : vread+0x194/0x294\n sp : ffffffc013ee39d0\n x29: ffffffc013ee39f0 x28: 0000000000001000 x27: ffffff807ff2b000\n x26: 0000000000001000 x25: ffffffc0085a2000 x24: ffffff802d4b3000\n x23: ffffff80f8a60000 x22: ffffff802d4b3000 x21: ffffffc0085a2000\n x20: ffffff8080b7bc68 x19: 0000000000001000 x18: 0000000000000000\n x17: 0000000000000000 x16: 0000000000000000 x15: ffffffd3073f2e60\n x14: ffffffffad588000 x13: 0000000000000000 x12: 0000000000000001\n x11: 00000000000001a2 x10: 00680000fff2bf0b x9 : 03fffffff807ff2b\n x8 : 0000000000000001 x7 : 0000000000000000 x6 : 0000000000000000\n x5 : ffffff802d4b4000 x4 : ffffff807ff2c000 x3 : ffffffc013ee3a78\n x2 : 0000000000001000 x1 : ffffff807ff2b000 x0 : ffffff802d4b3000\n Call trace:\n __memcpy+0x110/0x260\n read_kcore+0x584/0x778\n proc_reg_read+0xb4/0xe4\n\nDuring early boot, memblock reserves the pages for the ramoops reserved\nmemory node in DT that would otherwise be part of the direct lowmem\nmapping. Pstore's ram backend reuses those reserved pages to change the\nmemory type (writeback or non-cached) by passing the pages to vmap()\n(see pfn_to_page() usage in persistent_ram_vmap() for more details) with\nspecific flags. When read_kcore() starts iterating over the vmalloc\nregion, it runs over the virtual address that vmap() returned for\nramoops. In aligned_vread() the virtual address is passed to\nvmalloc_to_page() which returns the page struct for the reserved lowmem\narea. That lowmem page is passed to kmap_atomic(), which effectively\ncalls page_to_virt() that assumes a lowmem page struct must be directly\naccessible with __va() and friends. These pages are mapped via vmap()\nthough, and the lowmem mapping was never made, so accessing them via the\nlowmem virtual address oopses like above.\n\nLet's side-step this problem by passing VM_IOREMAP to vmap(). This will\ntell vread() to not include the ramoops region in the kcore. Instead the\narea will look like a bunch of zeros. The alternative is to teach kmap()\nabout vmalloc areas that intersect with lowmem. Presumably such a change\nisn't a one-liner, and there isn't much interest in inspecting the\nramoops region in kcore files anyway, so the most expedient route is\ntaken for now.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-50849" } ], "release_date": "2025-12-30T12:15:26Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-63904", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbtmc: check URB actual_length for interrupt-IN notifications\n\nUSBTMC devices can use an optional interrupt endpoint for notification\nmessages. These typically contain two-byte headers indicating the\npayload format, but the driver does not check if these headers are\npresent before accessing the data buffers. In cases where the URB\nactual_length is not enough to fit these headers, the driver will either\ncause an out-of-bounds read, or consume stale leftover data from a\nprevious notification.\n\nFix by checking if actual_data contains enough bytes for the headers,\notherwise resubmit URB to the interrupt endpoint.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-63904" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd", "url": "https://git.kernel.org/stable/c/52f2ad3f7e5eb3b5908e1d685d4342519dc9cfcd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5de7df75ef3a2756b25fe3d582a4a2970444fe5a", "url": "https://git.kernel.org/stable/c/5de7df75ef3a2756b25fe3d582a4a2970444fe5a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/69020fa089f1bf0e1a10a15265f31b143a846409", "url": "https://git.kernel.org/stable/c/69020fa089f1bf0e1a10a15265f31b143a846409" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/75f6d3da2cc646983f41807ef98851569c12bca9", "url": "https://git.kernel.org/stable/c/75f6d3da2cc646983f41807ef98851569c12bca9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae87f505917e703ae3b487d9663d78826ff43608", "url": "https://git.kernel.org/stable/c/ae87f505917e703ae3b487d9663d78826ff43608" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3eec3005de44e7f37d8d7724be636446516ab42", "url": "https://git.kernel.org/stable/c/e3eec3005de44e7f37d8d7724be636446516ab42" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e794bd67b3faf98af46f958897f6b91412c7d2a9", "url": "https://git.kernel.org/stable/c/e794bd67b3faf98af46f958897f6b91412c7d2a9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f141b01eaa58ac7e323931d670318aa247bff087", "url": "https://git.kernel.org/stable/c/f141b01eaa58ac7e323931d670318aa247bff087" } ], "release_date": "2026-07-19T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53392", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/flexfiles: reject zero filehandle version count\n\nff_layout_alloc_lseg() decodes the filehandle-version array count\nfrom the flexfiles layout body. The value is used as the count for\nkzalloc_objs(), and the current code only rejects NULL.\n\nA zero count yields ZERO_SIZE_PTR, which can be stored in\ndss_info->fh_versions even though later flexfiles paths assume that at\nleast one filehandle version exists.\n\nReject fh_count == 0 before the allocation, matching the existing zero\nversion_count validation in the flexfiles GETDEVICEINFO parser.\n\nA QEMU/KASAN run with a malformed flexfiles layout hit:\n\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750\n ff_layout_encode_layoutreturn+0x683/0x970\n nfs4_xdr_enc_layoutreturn+0x278/0x3a0\n Kernel panic - not syncing: Fatal exception\n\nThe patched kernel rejects the malformed layout without KASAN/oops/panic,\nand a valid fh_count=1 regression still opens, reads, and unmounts cleanly.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53392" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/18cc6d57a14fa65ab2a2b52279f549041c4bc9cf", "url": "https://git.kernel.org/stable/c/18cc6d57a14fa65ab2a2b52279f549041c4bc9cf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2131ed64b767ffa8bcdb3677d90f3964e39aabc8", "url": "https://git.kernel.org/stable/c/2131ed64b767ffa8bcdb3677d90f3964e39aabc8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2", "url": "https://git.kernel.org/stable/c/2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7779c85028a0676fb190cde4f0c540f4f8e97761", "url": "https://git.kernel.org/stable/c/7779c85028a0676fb190cde4f0c540f4f8e97761" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9033591535c066726f5b505126ccb4068b98fa4f", "url": "https://git.kernel.org/stable/c/9033591535c066726f5b505126ccb4068b98fa4f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/be7829715e341b42846437dd9e721005db59f0cc", "url": "https://git.kernel.org/stable/c/be7829715e341b42846437dd9e721005db59f0cc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d8c90c7cc061265d5f2813a1f5c82ef2f4707e67", "url": "https://git.kernel.org/stable/c/d8c90c7cc061265d5f2813a1f5c82ef2f4707e67" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eeabb9020721db6bc132e68eeae380b8d4fb4b04", "url": "https://git.kernel.org/stable/c/eeabb9020721db6bc132e68eeae380b8d4fb4b04" } ], "release_date": "2026-07-19T12:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90151", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: remove callback IDR entry on client allocation failure\n\nnfs4_alloc_client() allocates an NFSv4.0 callback identifier before it\nfinishes setting up the client. If any later initialization step fails,\nthe error path frees the nfs_client directly with nfs_free_client(). That\nbypasses nfs_put_client(), which is where the callback IDR entry is\nremoved during normal teardown.\n\nA failed allocation can therefore leave cb_ident_idr pointing at a freed\nnfs_client. A later NFSv4.0 callback lookup by cb_ident would find the\nstale pointer and take a reference to it.\n\nMake the callback IDR removal helper callable by the allocation failure\npath, and remove the callback identifier before freeing the client.\n\nThis was found by a local static-analysis checker for publish-before-free\nlifetime bugs and confirmed by manual inspection.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90151" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f2387e8bfbc4efda5d77c3a11a028d0a119c48f", "url": "https://git.kernel.org/stable/c/3f2387e8bfbc4efda5d77c3a11a028d0a119c48f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5891c03e150920618db0e9c4ea2d772abacdcfd1", "url": "https://git.kernel.org/stable/c/5891c03e150920618db0e9c4ea2d772abacdcfd1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/68c721391b761dbe38d5b0094d2bb6e8489ad92b", "url": "https://git.kernel.org/stable/c/68c721391b761dbe38d5b0094d2bb6e8489ad92b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c4812eb96bdcafb31a65b12f2aa96659429d1d4", "url": "https://git.kernel.org/stable/c/7c4812eb96bdcafb31a65b12f2aa96659429d1d4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/80b1c3d5a881f7d9081aa9f46da9742878a0f893", "url": "https://git.kernel.org/stable/c/80b1c3d5a881f7d9081aa9f46da9742878a0f893" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9bfdd0f591307b5198826a0e7a5b2f35f87acd2d", "url": "https://git.kernel.org/stable/c/9bfdd0f591307b5198826a0e7a5b2f35f87acd2d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d05c2007b3d84ccba11dc6e9cb3202768cc72f14", "url": "https://git.kernel.org/stable/c/d05c2007b3d84ccba11dc6e9cb3202768cc72f14" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fc95ca82d5ae598c428ab5a00ae69f8526d59371", "url": "https://git.kernel.org/stable/c/fc95ca82d5ae598c428ab5a00ae69f8526d59371" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89628", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: picolcd: clamp eeprom debugfs read to bytes actually received\n\npicolcd_debug_eeprom_read() trusts resp->raw_data[2] -- a length byte\nsupplied by the device in its REPORT_EE_DATA reply -- clamped only to\nthe caller's read() count:\n\n\tret = resp->raw_data[2];\n\tif (ret > s)\n\t\tret = s;\n\tif (copy_to_user(u, resp->raw_data+3, ret))\n\nIt never checks resp->raw_size, the number of bytes picolcd_raw_event()\nactually copied into the 64-byte raw_data[] of the kmalloc'd struct\npicolcd_pending. A device (or a spoofed picoLCD) returning a length byte\nof 0xff, read with a count >= 255, makes copy_to_user() read past\nraw_data[] into adjacent slab memory and return it to userspace through\nthe debugfs \"eeprom\" file:\n\n\tBUG: KASAN: slab-out-of-bounds in _copy_to_user\n\tRead of size 255 ... picolcd_debug_eeprom_read+0x214/0x2f0 [hid_picolcd]\n\nThe debug-dump path in the same file already validates the device length\nbyte against the received size before trusting it; this read does not.\nThe file is created S_IRUSR (root-only) and a crafted device is needed,\nso it is neither unprivileged- nor remotely-triggerable.\n\nClamp the copy length to resp->raw_size - 3 (the payload actually\nreceived, minus the 3-byte header), floored at 0 for short replies.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89628" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1a02056c2bf7ef9b5fd05ee6913aeeadb703c443", "url": "https://git.kernel.org/stable/c/1a02056c2bf7ef9b5fd05ee6913aeeadb703c443" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/471f4a939c66d1d44aece2321807abf609fc9098", "url": "https://git.kernel.org/stable/c/471f4a939c66d1d44aece2321807abf609fc9098" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4daf432c94a42e7be6aa10b012b33af5ed9bc118", "url": "https://git.kernel.org/stable/c/4daf432c94a42e7be6aa10b012b33af5ed9bc118" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/65daa322f1021d8206f8032c4cd4c0cb2d26c7c3", "url": "https://git.kernel.org/stable/c/65daa322f1021d8206f8032c4cd4c0cb2d26c7c3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/699a3c8b56e168ca19d12722f3f5ef1d6f4b1d84", "url": "https://git.kernel.org/stable/c/699a3c8b56e168ca19d12722f3f5ef1d6f4b1d84" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8dc662af019158690c470edd2e2857657f700abb", "url": "https://git.kernel.org/stable/c/8dc662af019158690c470edd2e2857657f700abb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a3e6e8d7198a9f3861861520a38b673684a1062b", "url": "https://git.kernel.org/stable/c/a3e6e8d7198a9f3861861520a38b673684a1062b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e9c667395ac1f8024f623250b32bae4c7af9caa0", "url": "https://git.kernel.org/stable/c/e9c667395ac1f8024f623250b32bae4c7af9caa0" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-93206", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/proc: Use file_ns_capable() when checking config space read access\n\nproc_bus_pci_read() decides how much of the config space is readable based\non capable(CAP_SYS_ADMIN), which checks the credentials of the task calling\nread(), not the credentials of the process that opened the file.\n\nThe sysfs equivalent, pci_read_config(), has checked the credentials of the\nopening process since commit de139a339395 (\"pci: check caps from sysfs file\nopen to read device dependent config space\"), so a privileged process can\nopen the config space file and pass the file descriptor to an unprivileged\nprocess (for example, a process running a KVM guest with an assigned\ndevice), which can then read the entire config space. The check was\nsubsequently routed through the LSM framework in commit 47970b1b2aa6 (\"pci:\nuse security_capable() when checking capablities during config space read\")\nand converted to the dedicated helper in commit ab0fa82b2df9 (\"pci-sysfs:\nuse proper file capability helper function\").\n\nThus, the two interfaces check the same capability against different\ncredentials. Checking the credentials of the task calling read() makes the\noutcome depend on who reads rather than who opened, so the restriction is\nbypassed whenever a more privileged process reads through the descriptor.\nChecking the credentials recorded in file->f_cred settles the decision at\nopen() time and ties it to the file, where it cannot change with the\ncaller.\n\nUse file_ns_capable() to check CAP_SYS_ADMIN against the credentials in\neffect when the file was opened, bringing the procfs interface in line with\nthe sysfs behaviour.\n\nAs a result, a file descriptor opened by a privileged process and passed to\nan unprivileged one now allows the entire config space to be read through\nprocfs, matching sysfs.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-93206" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/53407535d49ec034e476121020b5c878f0d92e18", "url": "https://git.kernel.org/stable/c/53407535d49ec034e476121020b5c878f0d92e18" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5c7ab4ca66f0880cffc3735555ea719dd5253726", "url": "https://git.kernel.org/stable/c/5c7ab4ca66f0880cffc3735555ea719dd5253726" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6351e94076329dab517ea94c115e15c4d8459381", "url": "https://git.kernel.org/stable/c/6351e94076329dab517ea94c115e15c4d8459381" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/77272b7fd0e472086fd626a1fcd11da625822cc2", "url": "https://git.kernel.org/stable/c/77272b7fd0e472086fd626a1fcd11da625822cc2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8a3a54aa3e65ed76f8560a387243a7738ae0cb1c", "url": "https://git.kernel.org/stable/c/8a3a54aa3e65ed76f8560a387243a7738ae0cb1c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c2d4174f492458ecdcdef309243624999612d526", "url": "https://git.kernel.org/stable/c/c2d4174f492458ecdcdef309243624999612d526" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e7730acd6a01c5931a3afb83639810ff2fb9cc92", "url": "https://git.kernel.org/stable/c/e7730acd6a01c5931a3afb83639810ff2fb9cc92" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f82f53e75eff382fc8f56b73279b54f7cf5a5c65", "url": "https://git.kernel.org/stable/c/f82f53e75eff382fc8f56b73279b54f7cf5a5c65" } ], "release_date": "2026-09-24T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80765", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hyperv: validate initial device info bounds\n\nThe Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO\nmessages that contain a HID descriptor followed by the report descriptor\nbytes. mousevsc_on_receive_device_info() trusts bLength and\nwDescriptorLength without checking that the received packet contains both\nbyte ranges.\n\nA malformed host or backend message can therefore make the guest read\npast the received VMBus packet while copying the report descriptor. Pass\nthe received initial-device-info size into the parser and reject\ndescriptor lengths that exceed the packet.\n\nImpact: A malicious Hyper-V host or backend can crash a guest by sending\na short initial device-info message with an oversized HID report\ndescriptor length.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80765" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2529737763cb4bcfcaf397beeea2664656c865b4", "url": "https://git.kernel.org/stable/c/2529737763cb4bcfcaf397beeea2664656c865b4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/334271d3812ab3197c95b4593bc6745f8d189114", "url": "https://git.kernel.org/stable/c/334271d3812ab3197c95b4593bc6745f8d189114" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/390d3d9c52a710fdc9de95a537747397c0c671d1", "url": "https://git.kernel.org/stable/c/390d3d9c52a710fdc9de95a537747397c0c671d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/608f8fd8c0f7b6268da43509447802955f210aac", "url": "https://git.kernel.org/stable/c/608f8fd8c0f7b6268da43509447802955f210aac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8614c043b11cc35ffebd35542ab4da275f8f923d", "url": "https://git.kernel.org/stable/c/8614c043b11cc35ffebd35542ab4da275f8f923d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/934b7778aa7b7c8f6bb073d2a73ba3674885bae0", "url": "https://git.kernel.org/stable/c/934b7778aa7b7c8f6bb073d2a73ba3674885bae0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c894143c508a7e063aab9f73c9e835ab40121283", "url": "https://git.kernel.org/stable/c/c894143c508a7e063aab9f73c9e835ab40121283" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e0d5d3e45e142b7ef7525654aaa54d3e986002a6", "url": "https://git.kernel.org/stable/c/e0d5d3e45e142b7ef7525654aaa54d3e986002a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f84d777574b748b1a488723ca7be9d87a301a872", "url": "https://git.kernel.org/stable/c/f84d777574b748b1a488723ca7be9d87a301a872" } ], "release_date": "2026-09-04T16:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98176", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc\n\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\n\nffs(q->eop_ring_buffer_size / sizeof(unsigned int)) - 1 - 1\n\nBut ffs can in theory return 1 or 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\n\nChange this to\n\nffs(q->eop_ring_buffer_size / sizeof(unsigned int) / 4)\n\nusing properties of logarithms.\n\n(cherry picked from commit 4f18c56630383c14bfc6b2d65f88f2f895d2121a)", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98176" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/82e1b8299c6da02ce02185c208d2fdf7572b5ea1", "url": "https://git.kernel.org/stable/c/82e1b8299c6da02ce02185c208d2fdf7572b5ea1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c883d0a132d430ef7ebb23fd94323be94d0fbdb8", "url": "https://git.kernel.org/stable/c/c883d0a132d430ef7ebb23fd94323be94d0fbdb8" } ], "release_date": "2026-10-06T09:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90293", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: post the full-feature receive buffers after session registration\n\nisert_put_login_tx() posts the full-feature receive buffers before\n__transport_register_session() runs, so an initiator that does not wait\nfor the final Login Response can still have a SCSI command executed\nagainst an se_session whose se_tpg is NULL - the same oops as the\nprevious patch, at target_submit+0xbe.\n\nPost them from isert_get_rx_pdu(), which the previous patch already uses\nto send that response, and post them before that send: the receive queue\nis filled at the moment the initiator is told it may use it. Allocating\nthere keeps the existing property that a memory allocation failure cannot\nhappen once the final Login Response is on the wire.\n\nThe receive queue is already empty between the final Login Request and\nisert_post_recvm(); this moves the second point later, from a median of\n92 us to 172 us over 1200 logins. Only an initiator that sends before it\nhas been told to can reach that window, and on IB and RoCE its send is\nretried there until the buffers appear - isert_rdma_accept() asks for\nrnr_retry_count = 7. iWARP has no RNR flow control, so there the same\nsend terminates the connection instead.\n\nMeasured over rxe, 400 login cycles per run, with an initiator that does\nnot wait: an instrumented build counted no entries to isert_recv_done()\nbefore the buffers are posted in 10 runs, where that initiator oopsed\n8 of 10 unpatched runs and 5 of 10 with only the previous patch.\n\nNot tested: iWARP, discovery sessions over iSER, and real HCAs.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90293" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/068fe9841d2585b79d479fc7b58251d02d0b066f", "url": "https://git.kernel.org/stable/c/068fe9841d2585b79d479fc7b58251d02d0b066f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5247dde9daac7e107853b6fea043f7f47be033f7", "url": "https://git.kernel.org/stable/c/5247dde9daac7e107853b6fea043f7f47be033f7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6c506fee5a5f2c8719c65bcfc5e5d0862b0a1946", "url": "https://git.kernel.org/stable/c/6c506fee5a5f2c8719c65bcfc5e5d0862b0a1946" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/962edb9a6b0dae09d33a677485a398fc7d55968c", "url": "https://git.kernel.org/stable/c/962edb9a6b0dae09d33a677485a398fc7d55968c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9b2c61344992c8c2b883e1eebe416cc488a19390", "url": "https://git.kernel.org/stable/c/9b2c61344992c8c2b883e1eebe416cc488a19390" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9c21a433022219ca899d1b3cd9049991f51a6a2c", "url": "https://git.kernel.org/stable/c/9c21a433022219ca899d1b3cd9049991f51a6a2c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ad4492dcaf90a1d1a728ec5eef1a68ce5355027a", "url": "https://git.kernel.org/stable/c/ad4492dcaf90a1d1a728ec5eef1a68ce5355027a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d4f8257c3283919ca7e149381d062b9af5f7df7d", "url": "https://git.kernel.org/stable/c/d4f8257c3283919ca7e149381d062b9af5f7df7d" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80828", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Complete cleanup after system-resume errors\n\nA failed system resume can leave the card unusable until reboot.\nusb_audio_resume() jumps to err_out when snd_usb_pcm_resume() or\nsnd_usb_mixer_resume() fails. The error path skips the out: block, which\nrestores D0 and decrements chip->num_suspended_intf.\n\nThe card stays in SNDRV_CTL_POWER_D3hot, so later control access blocks in\nsnd_power_ref_and_wait(). USB core logs an interface resume callback error.\nIt does not retry that callback, so a later callback cannot complete the\nskipped cleanup.\n\nusb_audio_suspend() increments num_suspended_intf before returning success.\nA system-resume callback must consume the system-suspend count even if a\ncomponent resume fails. Otherwise, the stranded count skews later suspend\nand resume cycles.\n\nDo not apply this cleanup to runtime-resume errors. Runtime PM can retry\n-EAGAIN or -EBUSY without another suspend callback. The count must continue\nto describe that suspended interface. Other runtime-resume errors latch\nruntime_error in the PM core and do not cause an immediate callback retry.\n\nBoth parts of the system-resume error path are longstanding. Commit\n88a8516a2128a (\"ALSA: usbaudio: implement USB autosuspend\") introduced\nerr_out past the D0 restore. Commit 862b2509d157c (\"ALSA: usb-audio: Fix\ninconsistent card PM state after resume\") later moved\nnum_suspended_intf-- into the out: block. The error path now skips both\noperations.\n\nNo third-party code is needed to reach the error path.\nsnd_usb_mixer_resume() ends in snd_usb_mixer_activate(), which returns the\nresult of usb_submit_urb() for devices that have a mixer status URB. Its\nmixer->private_resume hook can also fail through scarlett2_init_notify().\nsnd_usb_pcm_resume() issues a SET_CUR request to a UAC3 power domain. It\ncan return -EPIPE or -EIO when the device stalls the request.\n\nRoute a component error through out: only when system_suspend is nonzero.\nContinue to return runtime-resume errors through err_out. Later component\nresume stages remain skipped. The original error still reaches USB core.\nA later transfer can fail if the device did not recover.\n\nI reproduced the system-resume failure on an Audient iD14 MkI with an\nout-of-tree diagnostic mixer resume hook. An injected -EIO on the unpatched\ncore left control readers in uninterruptible sleep in\nsnd_power_ref_and_wait() until a reboot. With this patch, the same failure\nrestored control access. A second system suspend and resume also succeeded\nafter I disabled fault injection.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80828" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1739a976312e110c93a8dee66a1cdf893a1b187e", "url": "https://git.kernel.org/stable/c/1739a976312e110c93a8dee66a1cdf893a1b187e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f06f3f5b16212f180764654a9398ff5f7a855c8", "url": "https://git.kernel.org/stable/c/3f06f3f5b16212f180764654a9398ff5f7a855c8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3fa521c3c54b42e16cad8ade76551113a783752b", "url": "https://git.kernel.org/stable/c/3fa521c3c54b42e16cad8ade76551113a783752b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a625fc2284e35f33693efd9534aebaca3b005d4", "url": "https://git.kernel.org/stable/c/5a625fc2284e35f33693efd9534aebaca3b005d4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6c94877b6bab9185898bcad4b082ff5592558921", "url": "https://git.kernel.org/stable/c/6c94877b6bab9185898bcad4b082ff5592558921" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6d3e202670b819c414076a5d07dffac8a39274ad", "url": "https://git.kernel.org/stable/c/6d3e202670b819c414076a5d07dffac8a39274ad" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d1f643b1c0258bd519146f7a342bbb394d413912", "url": "https://git.kernel.org/stable/c/d1f643b1c0258bd519146f7a342bbb394d413912" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1c05c41d07b874635d681ae328d13ec550470c5", "url": "https://git.kernel.org/stable/c/f1c05c41d07b874635d681ae328d13ec550470c5" } ], "release_date": "2026-09-04T16:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-97561", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: honor forceuid/forcegid when mapping SIDs to uid/gid\n\nWhen the administrator mounts with forceuid or forcegid (uid=/gid=\nmount options), they expect all files to appear owned by the specified\nuser/group. However, several code paths unconditionally called\nsid_to_id() to overwrite cf_uid/cf_gid with server-provided values,\nignoring the administrator's explicit override:\n\n - smb311_posix_info_to_fattr() (stat via POSIX extensions)\n - cifs_posix_to_fattr() (readdir via POSIX extensions)\n - parse_sec_desc() (CIFS ACL ownership mapping)\n\nThis allowed an untrusted server to dictate local file ownership even\nwhen the mount was configured to force specific uid/gid values.\n\nFix all three call sites to check CIFS_MOUNT_OVERR_UID and\nCIFS_MOUNT_OVERR_GID before calling sid_to_id(), following the\nsame pattern already used by cifs_unix_basic_to_fattr() for unix\nextensions.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97561" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/18a72975e9f35aadecc75b031f693f2d1f49308f", "url": "https://git.kernel.org/stable/c/18a72975e9f35aadecc75b031f693f2d1f49308f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6ac7a29691558bed18e2df1780636b8aa0fd13d5", "url": "https://git.kernel.org/stable/c/6ac7a29691558bed18e2df1780636b8aa0fd13d5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bc35de451c128d399ad185d6269f8847e97cd1c9", "url": "https://git.kernel.org/stable/c/bc35de451c128d399ad185d6269f8847e97cd1c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/be6eccccec867c22d7c65fab4ea4e91ec3d5b8c6", "url": "https://git.kernel.org/stable/c/be6eccccec867c22d7c65fab4ea4e91ec3d5b8c6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e1b74f8f8c1d13190b09fe623b729d36b7ac22a8", "url": "https://git.kernel.org/stable/c/e1b74f8f8c1d13190b09fe623b729d36b7ac22a8" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80664", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_nat: reject unsupported target families\n\nxt_nat SNAT and DNAT target handlers assume IP-family conntrack state\nis present and can dereference a NULL pointer when instantiated from an\nunsupported family through nft_compat. A bridge-family compat rule can\ntherefore trigger a NULL-dereference in nf_nat_setup_info().\n\nReject non-IP families in xt_nat_checkentry() so unsupported targets\ncannot be installed. Keep NFPROTO_INET allowed for valid inet NAT\ncompat users and leave the runtime fast path unchanged.\n\n[ The crash was fixed via\n 9dbba7e694ec (\"netfilter: nft_compat: ebtables emulation must reject non-bridge targets\"),\n so this patch is no longer critical.\n Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra\n family check is a good idea in any case. ]", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80664" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0afc9ad987c0faa80ab5f8d6e7815085ac8dbb82", "url": "https://git.kernel.org/stable/c/0afc9ad987c0faa80ab5f8d6e7815085ac8dbb82" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/49abe564391411057a26a9a943c8e17867c3b9b4", "url": "https://git.kernel.org/stable/c/49abe564391411057a26a9a943c8e17867c3b9b4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4fbc2bac02edabb665beb2aa87ca6f1e1d4c4777", "url": "https://git.kernel.org/stable/c/4fbc2bac02edabb665beb2aa87ca6f1e1d4c4777" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5d1a2240935ea47e2673d0ea17fdb058e4dc91dd", "url": "https://git.kernel.org/stable/c/5d1a2240935ea47e2673d0ea17fdb058e4dc91dd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/679ced28a9dc2f6dc679eb05027d779693e60902", "url": "https://git.kernel.org/stable/c/679ced28a9dc2f6dc679eb05027d779693e60902" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a842dab87cab29f2a5798a47b2dc5e6a449950bf", "url": "https://git.kernel.org/stable/c/a842dab87cab29f2a5798a47b2dc5e6a449950bf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e35c048d7511e9d4c2a537b8a231c49606e97c16", "url": "https://git.kernel.org/stable/c/e35c048d7511e9d4c2a537b8a231c49606e97c16" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ec88fa71c82072e9189983b05b499d3507550271", "url": "https://git.kernel.org/stable/c/ec88fa71c82072e9189983b05b499d3507550271" } ], "release_date": "2026-08-28T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90307", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ\n\nsrp_recv_done() passes wc->byte_len to srp_process_rsp(). It passes\nnothing to srp_process_cred_req() and srp_process_aer_req(), which read\nfixed-size fields from the receive buffer without checking that those\nfields were received.\n\nThe buffer size is max_ti_iu_len, which comes from the login response\nand is not validated. A target that advertises 8 and then sends an\n8-byte SRP_CRED_REQ makes the initiator read req->tag from beyond the\nend of the buffer. req->tag is copied into the SRP_CRED_RSP and sent\nback, so those bytes reach the target. SRP_AER_REQ behaves the same way\nand also reads req->lun.\n\nThe leak is 8 bytes per response. max_ti_iu_len also decides which slab\ncache the buffer comes from. With 8 the buffer is a kmalloc-8 object and\nthe read is entirely outside it:\n\n BUG: KASAN: slab-out-of-bounds in srp_recv_done+0x172b/0x1aa0\n Read of size 8 at addr ffff888104714da8 by task kworker/u8:3/50\n which belongs to the cache kmalloc-8 of size 8\n The buggy address is located 0 bytes to the right of\n allocated 8-byte region [ffff888104714da0, ffff888104714da8)\n\nWithout KASAN the returned bytes are whatever is next in the slab. One\nrun returned \".strtab\".\n\nrsp->data[3] in srp_process_rsp() has the same problem: only\nresp_data_len is checked before it is read.\n\nDrop a request that is shorter than the structure being parsed, and\ncheck byte_len before the tsk_mgmt read.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90307" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/001adf2fe87d1ab677c014a97467bbea5153ae5f", "url": "https://git.kernel.org/stable/c/001adf2fe87d1ab677c014a97467bbea5153ae5f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e7ba617514902501514d577647d866e670dad90", "url": "https://git.kernel.org/stable/c/0e7ba617514902501514d577647d866e670dad90" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/138eb2f0ef02adfe6ad126afad5b54c56b5046ee", "url": "https://git.kernel.org/stable/c/138eb2f0ef02adfe6ad126afad5b54c56b5046ee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3787f4c3e0d813d6c56be9f6dfaf66f8551fb0a7", "url": "https://git.kernel.org/stable/c/3787f4c3e0d813d6c56be9f6dfaf66f8551fb0a7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f7fdf561f1ec3b523c39708df00bd808671668d", "url": "https://git.kernel.org/stable/c/3f7fdf561f1ec3b523c39708df00bd808671668d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/961ac0f0c5e414abdd6b33fae84b311d9fde0bd0", "url": "https://git.kernel.org/stable/c/961ac0f0c5e414abdd6b33fae84b311d9fde0bd0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dc2272c00d7c00ee2a69b57f7ca9caaefcbdb8cd", "url": "https://git.kernel.org/stable/c/dc2272c00d7c00ee2a69b57f7ca9caaefcbdb8cd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fa1b33fdab3e79dce83721ead3220200a2dbec22", "url": "https://git.kernel.org/stable/c/fa1b33fdab3e79dce83721ead3220200a2dbec22" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98488", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1e: fix soft lockup on out-of-range hw_next_to_clean read\n\nSame issue as atl1c (see the first commit in this series, \"net:\natl1c: fix soft lockup on out-of-range tpd_cons read\"): the hardware\ncan report an out-of-range hw_next_to_clean (seen as 0xffff) while\nthe PCIe link/MAC is resetting. An out-of-range value can never be\nreached and the loop below would spin forever. Treat it as \"nothing\nnew to clean\" instead.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98488" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1d8c85359b5075c7937925b673add7ed00e57ec8", "url": "https://git.kernel.org/stable/c/1d8c85359b5075c7937925b673add7ed00e57ec8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/34bc747a61bef572244b01b095552b629cd8d2a2", "url": "https://git.kernel.org/stable/c/34bc747a61bef572244b01b095552b629cd8d2a2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/374bf9e4b90f979e052332c4faca2d745c491a12", "url": "https://git.kernel.org/stable/c/374bf9e4b90f979e052332c4faca2d745c491a12" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3a7d9271b37c80fb7db04aff3bc5621cfdaf9bee", "url": "https://git.kernel.org/stable/c/3a7d9271b37c80fb7db04aff3bc5621cfdaf9bee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4b7161804d8f31227551901f93947bb4eea4690b", "url": "https://git.kernel.org/stable/c/4b7161804d8f31227551901f93947bb4eea4690b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4bbb44075bd3e773d61706882ab923ece8b3b519", "url": "https://git.kernel.org/stable/c/4bbb44075bd3e773d61706882ab923ece8b3b519" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a277422d194c62daa1b961f5f739689e53fe7301", "url": "https://git.kernel.org/stable/c/a277422d194c62daa1b961f5f739689e53fe7301" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ca862b1a4af7eac19429ca7ab92625f94ff4a46c", "url": "https://git.kernel.org/stable/c/ca862b1a4af7eac19429ca7ab92625f94ff4a46c" } ], "release_date": "2026-10-18T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72421", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: Don't ignore error route in local/main tables.\n\nWhen CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added,\nfib_lookup() performs route lookup directly on two tables.\n\nSince the first lookup does not properly bail out, the result\nof an error route in the merged local/main table could be\noverwritten by another route in the default table:\n\n # unshare -n\n # ip link set lo up\n # ip route add 192.168.0.0/24 dev lo table 253\n # ip route add unreachable 192.168.0.0/24\n # ip route get 192.168.0.1\n 192.168.0.1 dev lo table default uid 0\n cache \n\nOnce a random rule is added, the error route is respected:\n\n # ip rule add table 0\n # ip rule del table 0\n # ip route get 192.168.0.1\n RTNETLINK answers: No route to host\n\nLet's fix the inconsistent behaviour.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72421" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/49eaf1403201357762d745a35882fb734107d763", "url": "https://git.kernel.org/stable/c/49eaf1403201357762d745a35882fb734107d763" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5ae18d87a45698e8244d0fcba64c658c35a7dd3d", "url": "https://git.kernel.org/stable/c/5ae18d87a45698e8244d0fcba64c658c35a7dd3d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/828fad4fd418bcdb9f5d66fec0d184c52a85ec31", "url": "https://git.kernel.org/stable/c/828fad4fd418bcdb9f5d66fec0d184c52a85ec31" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9127589aabdee588278e8d0d0bd3709a760a92c8", "url": "https://git.kernel.org/stable/c/9127589aabdee588278e8d0d0bd3709a760a92c8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a29e95fbc51e8a1b932773fd0e259b2080881443", "url": "https://git.kernel.org/stable/c/a29e95fbc51e8a1b932773fd0e259b2080881443" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a668fa160247d7bbe921548cb845f607b8b9305f", "url": "https://git.kernel.org/stable/c/a668fa160247d7bbe921548cb845f607b8b9305f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b72f0db64205d9ce462038ba995d5d31eff32dc1", "url": "https://git.kernel.org/stable/c/b72f0db64205d9ce462038ba995d5d31eff32dc1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fd25996f57a95d56bc568c89b4921edcf334b7d8", "url": "https://git.kernel.org/stable/c/fd25996f57a95d56bc568c89b4921edcf334b7d8" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-50289", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: av7110: fix a spectre vulnerability\n\nAs warned by smatch:\n\tdrivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap)\n\nThere is a spectre-related vulnerability at the code. Fix it.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-50289" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e58d7070eef16615e280d9b25d334b08e042b61", "url": "https://git.kernel.org/stable/c/0e58d7070eef16615e280d9b25d334b08e042b61" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/458ea1c0be991573ec436aa0afa23baacfae101a", "url": "https://git.kernel.org/stable/c/458ea1c0be991573ec436aa0afa23baacfae101a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f3927206c478bd249c225414f7a751752a30e7b9", "url": "https://git.kernel.org/stable/c/f3927206c478bd249c225414f7a751752a30e7b9" } ], "release_date": "2024-11-19T02:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2022-50709", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()\n\nsyzbot is reporting uninit value at ath9k_htc_rx_msg() [1], for\nioctl(USB_RAW_IOCTL_EP_WRITE) can call ath9k_hif_usb_rx_stream() with\npkt_len = 0 but ath9k_hif_usb_rx_stream() uses\n__dev_alloc_skb(pkt_len + 32, GFP_ATOMIC) based on an assumption that\npkt_len is valid. As a result, ath9k_hif_usb_rx_stream() allocates skb\nwith uninitialized memory and ath9k_htc_rx_msg() is reading from\nuninitialized memory.\n\nSince bytes accessed by ath9k_htc_rx_msg() is not known until\nath9k_htc_rx_msg() is called, it would be difficult to check minimal valid\npkt_len at \"if (pkt_len > 2 * MAX_RX_BUF_SIZE) {\" line in\nath9k_hif_usb_rx_stream().\n\nWe have two choices. One is to workaround by adding __GFP_ZERO so that\nath9k_htc_rx_msg() sees 0 if pkt_len is invalid. The other is to let\nath9k_htc_rx_msg() validate pkt_len before accessing. This patch chose\nthe latter.\n\nNote that I'm not sure threshold condition is correct, for I can't find\ndetails on possible packet length used by this protocol.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-50709" } ], "release_date": "2025-12-24T10:55:23Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-74388", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: oss: Fix UAF at handling events with embedded SysEx data\n\nThe OSS sequencer processes the input MIDI bytes into a sequencer\nevent to be dispatched later (in snd_seq_oss_midi_putc() called from\nsnd_seq_oss_process_event()). When it's a SysEx data, the event\nrecord contains data.ext.ptr pointer to the original SysEx bytes, and\nthe referred data is copied into the pool afterwards at dispatching.\nThe problem is that, if the sequencer port gets closed concurrently\nbefore the dispatch, the OSS sequencer core also releases the\nresources (in snd_seq_oss_midi_check_exit_port()), while the pending\nevent may hold a stale pointer, eventually leading to a UAF at a later\ndispatch.\n\nFortunately, there is already a refcounting mechanism (snd_use_lock_t)\nfor the OSS MIDI device access, and for addressing the issue above, we\njust need to extend the refcount until the event gets dispatched.\n\nThis patch extends snd_seq_oss_process_event() to give back the\nrefcount object, which is in turn released after calling the sequencer\ndispatcher with the given event in the caller side.\n\nAccording to the original report, KASAN report as below:\n\nKASAN slab-use-after-free in snd_seq_event_dup+0x40c/0x470\nRIP: 0033:0x7f2cb66a6340\nRead of size 6\nCall trace:\n dump_stack_lvl+0x73/0xb0 (?:?)\n print_report+0xd1/0x650 (?:?)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n __virt_addr_valid+0x1a7/0x340 (?:?)\n kasan_complete_mode_report_info+0x64/0x200 (?:?)\n kasan_report+0xf7/0x130 (?:?)\n snd_seq_event_dup+0x40c/0x470 (?:?)\n kasan_check_range+0x10c/0x1c0 (?:?)\n __asan_memcpy+0x27/0x70 (?:?)\n snd_seq_event_dup+0x9/0x470 (?:?)\n snd_seq_client_enqueue_event+0x139/0x240 (?:?)\n _raw_spin_unlock_irqrestore+0x4b/0x60 (?:?)\n snd_seq_kernel_client_enqueue+0x102/0x120 (?:?)\n snd_seq_oss_write+0x416/0x4e0 (?:?)\n apparmor_file_permission+0x20/0x30 (?:?)\n odev_write+0x3b/0x60 (?:?)\n vfs_write+0x1ce/0x850 (?:?)\n lock_release+0xc8/0x2a0 (?:?)\n __kasan_check_write+0x18/0x20 (?:?)\n __mutex_unlock_slowpath+0x129/0x510 (?:?)\n ksys_write+0xe1/0x180 (?:?)\n mutex_unlock+0x16/0x20 (?:?)\n odev_ioctl+0x65/0xc0 (?:?)\n __x64_sys_write+0x46/0x60 (?:?)\n x64_sys_call+0x7d/0x20d0 (?:?)\n do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87)\n entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74388" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6dc781778b595be94c31395b2cb167f65145d91f", "url": "https://git.kernel.org/stable/c/6dc781778b595be94c31395b2cb167f65145d91f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7aad70cabd8f34cf11a9593fcd3f2ac3f5496943", "url": "https://git.kernel.org/stable/c/7aad70cabd8f34cf11a9593fcd3f2ac3f5496943" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c349b4f2a603202fb8c363bd2774a22ac2fddf3", "url": "https://git.kernel.org/stable/c/7c349b4f2a603202fb8c363bd2774a22ac2fddf3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bc963e193b314f1441082e8b1ffe15eb255d0a44", "url": "https://git.kernel.org/stable/c/bc963e193b314f1441082e8b1ffe15eb255d0a44" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e96824274239ae4cd2f7b712644441cdc72c81a3", "url": "https://git.kernel.org/stable/c/e96824274239ae4cd2f7b712644441cdc72c81a3" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72017", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: drop in-flight Tx SKBs on close\n\nThe MACB driver has since forever leaked the outgoing SKBs that\nhave not yet been marked as completed. They live in queue->tx_skb\nwhich gets freed without remorse nor checking.\n\nmacb_free_consistent() gets called in a few codepaths, but only close will\ntrigger the added expressions. In macb_open() and macb_alloc_consistent()\nfailure cases, queues' tx_skb just got allocated and are empty.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72017" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e9797dc4ebdefe1b7f931b1f92d5e98e5dbf655", "url": "https://git.kernel.org/stable/c/0e9797dc4ebdefe1b7f931b1f92d5e98e5dbf655" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/109241d9880488aafd8e104832b4d4859ad57244", "url": "https://git.kernel.org/stable/c/109241d9880488aafd8e104832b4d4859ad57244" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2143fdc0ce27adbb1caaa1a97e0bfb9f3750aef4", "url": "https://git.kernel.org/stable/c/2143fdc0ce27adbb1caaa1a97e0bfb9f3750aef4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26b131b2d5b55a81ef6182769d28105a870c0eb2", "url": "https://git.kernel.org/stable/c/26b131b2d5b55a81ef6182769d28105a870c0eb2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/27f575836cfebbf872dec020428742b10650a955", "url": "https://git.kernel.org/stable/c/27f575836cfebbf872dec020428742b10650a955" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6124bd785073659c99385094657b77382ebce11b", "url": "https://git.kernel.org/stable/c/6124bd785073659c99385094657b77382ebce11b" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98357", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: wait for deferred control PDU completions before releasing the connection\n\nisert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and\nISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns. The work\nitem then runs isert_completion_put() -> isert_put_cmd(), which reads\nisert_conn->conn and takes conn->cmd_lock.\n\nNothing orders that work item against teardown. isert_wait_conn() queues\nisert_release_work, which frees isert_conn, and iscsit_close_connection()\nfrees the iscsit_conn right after it returns, so the queued work can run\nagainst freed memory.\n\nCount the deferred control PDU completions per connection and let\nisert_wait_conn() wait for them before the release work is queued.\n\nISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs\niscsit_logout_post_handler(), which ends up waiting for\nconn->conn_wait_comp, and that completion is only sent by\niscsit_close_connection() after it has called iscsit_wait_conn().\nWaiting for it here would deadlock. Its wait stays the existing\nisert_wait4logout().\n\nThe splat below is from a kernel with tracing printk()s and an msleep(200)\ninjected into isert_do_control_comp() to widen the window:\n\n BUG: KASAN: slab-use-after-free in isert_put_cmd+0x53d/0x620\n Read of size 8 at addr ffff8881054f1038 by task kworker/u17:1/182\n\n CPU: 0 UID: 0 PID: 182 Comm: kworker/u17:1 Tainted: G B 7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy)\n Tainted: [B]=BAD_PAGE\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Workqueue: isert_comp_wq isert_do_control_comp\n Call Trace:\n \n dump_stack_lvl+0x53/0x70\n print_report+0xd0/0x630\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? _raw_spin_unlock_irqrestore+0x3e/0x70\n ? isert_put_cmd+0x53d/0x620\n kasan_report+0xce/0x100\n ? isert_put_cmd+0x53d/0x620\n isert_put_cmd+0x53d/0x620\n ? isert_completion_put+0x305/0x330\n ? isert_do_control_comp+0x2ef/0x310\n process_one_work+0x633/0x1030\n ? assign_work+0x11d/0x370\n worker_thread+0x45b/0xd10\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2c6/0x3b0\n ? recalc_sigpending+0x15c/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x36e/0x5a0\n ? __pfx_ret_from_fork+0x10/0x10\n ? __switch_to+0x572/0xdd0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \n\n Allocated by task 48:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc_cache_noprof+0x158/0x370\n isert_cma_handler+0x1e3/0x2ae0\n cma_cm_event_handler+0x3e/0x240\n cma_ib_req_handler+0x17d9/0x4490\n cm_process_work+0x41/0x330\n cm_work_handler+0x5727/0xc160\n process_one_work+0x633/0x1030\n worker_thread+0x45b/0xd10\n kthread+0x2c6/0x3b0\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n\n Freed by task 184:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kfree+0x121/0x380\n iscsit_close_connection+0x7cf/0x1e60\n iscsit_take_action_for_connection_exit+0x1b6/0x360\n iscsi_target_tx_thread+0x472/0x690\n kthread+0x2c6/0x3b0\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98357" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e230917670c6e6fe3243abfa11299fcbe05b1f4", "url": "https://git.kernel.org/stable/c/0e230917670c6e6fe3243abfa11299fcbe05b1f4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/505b242d9351690d1385bbe508ab4666f60363ce", "url": "https://git.kernel.org/stable/c/505b242d9351690d1385bbe508ab4666f60363ce" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7908fbc597a694bbd99bfb59ece73bc3daded68e", "url": "https://git.kernel.org/stable/c/7908fbc597a694bbd99bfb59ece73bc3daded68e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7edb8a88d6c76237c8b4435765bee1009e26a50a", "url": "https://git.kernel.org/stable/c/7edb8a88d6c76237c8b4435765bee1009e26a50a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f", "url": "https://git.kernel.org/stable/c/a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b96b8b3e41c308f606ffd10cfef1a7b9f97414cd", "url": "https://git.kernel.org/stable/c/b96b8b3e41c308f606ffd10cfef1a7b9f97414cd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ccdb1523f12bc8a9646de65055d1aafed9e9bcc6", "url": "https://git.kernel.org/stable/c/ccdb1523f12bc8a9646de65055d1aafed9e9bcc6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f5613acbe2e346d5c466ef0bd264fca936b69f82", "url": "https://git.kernel.org/stable/c/f5613acbe2e346d5c466ef0bd264fca936b69f82" } ], "release_date": "2026-10-06T09:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72238", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/boot: Validate console=uart8250 baud rate to fix early boot hang\n\nWhen the baud rate is empty, 0, invalid, or overflows to 0 when stored\nas an int, the system will hang during early boot because of a division\nby zero in early_serial_init().\n\nFall back to DEFAULT_BAUD when the resulting baud rate is 0 to prevent\nan early system hang.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72238" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/24fbed0a2a45f5f379ef2b53bd2abe58be1142ad", "url": "https://git.kernel.org/stable/c/24fbed0a2a45f5f379ef2b53bd2abe58be1142ad" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4dad7e870c7e5178f71b5e1e4f67934b9e8cc207", "url": "https://git.kernel.org/stable/c/4dad7e870c7e5178f71b5e1e4f67934b9e8cc207" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9a77a7639dfdc3eca417cd37620ce64da79c80c4", "url": "https://git.kernel.org/stable/c/9a77a7639dfdc3eca417cd37620ce64da79c80c4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4d05032e9af7137eab8f3af2855073f896ca843", "url": "https://git.kernel.org/stable/c/b4d05032e9af7137eab8f3af2855073f896ca843" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c1a276a731d02cbb728d0530f327a68728f2d8b0", "url": "https://git.kernel.org/stable/c/c1a276a731d02cbb728d0530f327a68728f2d8b0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/efa96a22613b86e05cd81229ce0be411c1a4a79a", "url": "https://git.kernel.org/stable/c/efa96a22613b86e05cd81229ce0be411c1a4a79a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f7c67c97b37c11f2a95c204092fb8159f2779e8f", "url": "https://git.kernel.org/stable/c/f7c67c97b37c11f2a95c204092fb8159f2779e8f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ffa0aa5b625fe0bed7463ac613f8b06676ff4542", "url": "https://git.kernel.org/stable/c/ffa0aa5b625fe0bed7463ac613f8b06676ff4542" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-68405", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock\n\nieee80211_do_stop() removes AP_VLAN packets from the parent AP\nps->bc_buf while holding ps->bc_buf.lock with IRQs disabled. It then\ncalls ieee80211_free_txskb() before dropping the lock.\n\nieee80211_free_txskb() is not just a passive SKB release. For SKBs with\nTX status state it can report a dropped frame through cfg80211/nl80211,\nand that path can reach netlink tap transmit. This is the same reason\nthe pending queue cleanup in ieee80211_do_stop() already unlinks SKBs\nunder the queue lock and frees them after IRQ state is restored.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nAP_VLAN management TX: AP_VLAN stop:\n1. attach ACK-status state 1. clear the running state\n2. queue a multicast SKB on 2. take ps->bc_buf.lock with IRQs\n parent ps->bc_buf disabled\n 3. unlink the AP_VLAN SKB\n 4. call ieee80211_free_txskb()\n\nUnlink matching AP_VLAN SKBs from ps->bc_buf under the existing lock,\nbut move them to a local free queue. Drop the lock and restore IRQ state\nbefore calling ieee80211_free_txskb().\n\nWARNING: kernel/softirq.c:430 at __local_bh_enable_ip", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68405" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0d2619e708e2ef02ba1c91642ea261d3f19d8f9a", "url": "https://git.kernel.org/stable/c/0d2619e708e2ef02ba1c91642ea261d3f19d8f9a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4b8abf43bf34791c99d99dc3be13f897adefc461", "url": "https://git.kernel.org/stable/c/4b8abf43bf34791c99d99dc3be13f897adefc461" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/659a81b62a61440b85e02c09903be861ae7679e5", "url": "https://git.kernel.org/stable/c/659a81b62a61440b85e02c09903be861ae7679e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/962f755a47d7ec3bbf6c709697d7f4c5f798441d", "url": "https://git.kernel.org/stable/c/962f755a47d7ec3bbf6c709697d7f4c5f798441d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a424985c3ef2a87ce6057a853e18d0c441a86be8", "url": "https://git.kernel.org/stable/c/a424985c3ef2a87ce6057a853e18d0c441a86be8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aa01ef0ebbc3289154229ef58e65baf289eb9789", "url": "https://git.kernel.org/stable/c/aa01ef0ebbc3289154229ef58e65baf289eb9789" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/be9dfcb0654c1f6c0fce7ba2a909683bb6f1e0ef", "url": "https://git.kernel.org/stable/c/be9dfcb0654c1f6c0fce7ba2a909683bb6f1e0ef" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f3858d5b1432098c1936e03d6e03dd0e33facf60", "url": "https://git.kernel.org/stable/c/f3858d5b1432098c1936e03d6e03dd0e33facf60" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-93140", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Mark LVID buffer as uptodate before marking it dirty\n\nWhen an I/O error occurs while writing the Logical Volume Integrity\nDescriptor (LVID) buffer to the block device, the block layer's completion\nhandler (`end_buffer_write_sync()`) clears the `BH_Uptodate` flag on the\nbuffer. However, the buffer still contains valid LVID data in memory. If\nthe filesystem is subsequently remounted read-write or synced,\n`udf_open_lvid()` or `udf_sync_fs()` will modify the LVID buffer and call\n`mark_buffer_dirty()`. This triggers a spurious\n`WARN_ON_ONCE(!buffer_uptodate(bh))` warning in `mark_buffer_dirty()`\nbecause the buffer is not marked uptodate, even though its in-memory\ncontents are valid and are about to be overwritten.\n\nTo prevent this spurious warning, unconditionally set the `BH_Uptodate`\nflag before calling `mark_buffer_dirty()` in `udf_open_lvid()` and\n`udf_sync_fs()`. This acknowledges that the in-memory buffer is valid and\nmatches the workaround previously applied to `udf_close_lvid()` in commit\n853a0c25baf9 (\"udf: Mark LVID buffer as uptodate before marking it dirty\").\nExtending this workaround ensures consistent behavior across all LVID\nupdates.\n\nBuffer I/O error on dev loop0, logical block 128, lost sync page write\n------------[ cut here ]------------\n!buffer_uptodate(bh)\nWARNING: fs/buffer.c:1087 at mark_buffer_dirty+0x299/0x410 fs/buffer.c:1087\n...\nCall Trace:\n \n udf_open_lvid+0x369/0x5b0 fs/udf/super.c:2078\n udf_reconfigure+0x336/0x540 fs/udf/super.c:679\n reconfigure_super+0x232/0x8f0 fs/super.c:1080\n vfs_cmd_reconfigure fs/fsopen.c:268 [inline]\n vfs_fsconfig_locked+0x171/0x320 fs/fsopen.c:297\n __do_sys_fsconfig fs/fsopen.c:463 [inline]\n __se_sys_fsconfig+0x6b9/0x810 fs/fsopen.c:350\n do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94\n ", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-93140" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11afe1912140f79d5af3091a54b181ef72fce1a5", "url": "https://git.kernel.org/stable/c/11afe1912140f79d5af3091a54b181ef72fce1a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/359cea636f4a74a96c01a8050f155e12840c079a", "url": "https://git.kernel.org/stable/c/359cea636f4a74a96c01a8050f155e12840c079a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8034ddf4751d9143c5ef7eebe3d4f33218fdd378", "url": "https://git.kernel.org/stable/c/8034ddf4751d9143c5ef7eebe3d4f33218fdd378" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a4c4e38b356ad4c1f90478124922917489137c08", "url": "https://git.kernel.org/stable/c/a4c4e38b356ad4c1f90478124922917489137c08" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c4058355d27488a3cd31c60c032335f77c4fdcfc", "url": "https://git.kernel.org/stable/c/c4058355d27488a3cd31c60c032335f77c4fdcfc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e6461ef34f91ad7dbffdf912b3d661a7dd892931", "url": "https://git.kernel.org/stable/c/e6461ef34f91ad7dbffdf912b3d661a7dd892931" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee477e5204f764444e60699280abf5936c2a6ae6", "url": "https://git.kernel.org/stable/c/ee477e5204f764444e60699280abf5936c2a6ae6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fb0601134c7e51728bd098abc6909315de1e5d86", "url": "https://git.kernel.org/stable/c/fb0601134c7e51728bd098abc6909315de1e5d86" } ], "release_date": "2026-09-17T17:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-93251", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: bus: Introduce acpi_bus_get_primary_device()\n\nThe function used for obtaining the first \"physical\" device for which\nthe given ACPI one is the ACPI companion, acpi_get_first_physical_node(),\nmay return a stale device pointer (mostly in theory) because\nacpi_unbind_one() may run as a whole after dropping the ACPI device's\nphysical_node_lock in acpi_get_first_physical_node() and before it\nreturns. The last reference to the \"physical\" device may be dropped\nthen before the pointer to it is returned to the caller.\n\nIf that happens and the acpi_get_first_physical_node() caller invokes\nget_device() on the pointer obtained from it, which is done by the\nmajority of its callers, a use-after-free will occur.\n\nTo prepare for addressing this problem, introduce a new function for\ngetting the first \"physical\" device associated with the given ACPI one\n(the \"primary physical device\") that will also reference count the\ndevice in question before returning a pointer to it.\n\nMake that new function and acpi_get_first_physical_node() share the\nphysical node list lookup code.\n\nNo intentional functional impact.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-93251" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/50ddd82b88b1d1cc467b5df953344c1a9feec268", "url": "https://git.kernel.org/stable/c/50ddd82b88b1d1cc467b5df953344c1a9feec268" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5657859851abb65105220a6cdb5804926249f714", "url": "https://git.kernel.org/stable/c/5657859851abb65105220a6cdb5804926249f714" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/72530e1f72b0515a73fd88292254d04fecf03649", "url": "https://git.kernel.org/stable/c/72530e1f72b0515a73fd88292254d04fecf03649" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ebdd932dc24c1cf7cc31710b7730515e4e66d886", "url": "https://git.kernel.org/stable/c/ebdd932dc24c1cf7cc31710b7730515e4e66d886" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fd4f907b558721716da30acd6630191acf811b95", "url": "https://git.kernel.org/stable/c/fd4f907b558721716da30acd6630191acf811b95" } ], "release_date": "2026-09-24T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-74544", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: validate offshift to prevent shift-out-of-bounds\n\nu32_change() copies the user-provided tc_u32_sel.offshift (unsigned char,\n0-255) into the kernel knode object without bounds validation. When a\npacket later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates\n`ntohs(offmask & *data) >> offshift` where the left operand is a 16-bit\nvalue promoted to a 32-bit int. Any offshift >= 32 is undefined behavior\nper C11 6.5.7p3, triggerable by an unprivileged user via user/network\nnamespaces.\n\nUBSAN: shift-out-of-bounds in net/sched/cls_u32.c:236:43\nshift exponent 32 is too large for 32-bit type int\n\nFix this by rejecting offshift >= 16 during filter creation in\nu32_change().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74544" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/006a4598da9a6b02e0ddc3ca5042b97224774364", "url": "https://git.kernel.org/stable/c/006a4598da9a6b02e0ddc3ca5042b97224774364" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/313cb9ffc4101a885d791facf4b5ea3d5e06144d", "url": "https://git.kernel.org/stable/c/313cb9ffc4101a885d791facf4b5ea3d5e06144d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/724c8edbacf1259988829cb9967f751222121d8a", "url": "https://git.kernel.org/stable/c/724c8edbacf1259988829cb9967f751222121d8a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9990cac513e8b191de2ee589051ea7ebf3cee940", "url": "https://git.kernel.org/stable/c/9990cac513e8b191de2ee589051ea7ebf3cee940" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aef96eead2860cbfa371e4471d4f04412213b958", "url": "https://git.kernel.org/stable/c/aef96eead2860cbfa371e4471d4f04412213b958" } ], "release_date": "2026-08-15T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89672", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs2 setacl by argp->mask\n\nThe NFSACL v2 SETACL path shares the decoder convention used by its\nv3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access\nonly when NFS_ACL is set in the request mask and argp->acl_default\nonly when NFS_DFACL is set, leaving the other pointer NULL because\nthe argument buffer is zeroed up to pc_argzero before decode.\n\nnfsacld_proc_setacl() then hands both pointers to set_posix_acl()\nunconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS\n\"remove this ACL type\" operation, so an omitted arm is\nindistinguishable from an explicit request to delete that ACL. A\nSETACL carrying only NFS_ACL silently strips the directory's default\nACL; mask=0 strips both.\n\nThis is the same defect just fixed in nfsd3_proc_setacl(); apply the\nsame remedy. Gate each set_posix_acl() call on its mask bit and\ninitialize error to 0 so that a request with neither bit set leaves\nthe on-disk ACLs untouched and returns success. The out_drop_lock\npath and the unconditional posix_acl_release() in\nnfsaclsvc_release_setacl() already tolerate the skipped arms.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89672" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c", "url": "https://git.kernel.org/stable/c/37eea38e7898538f0ec5f1eb8b18d8646e4be41c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5", "url": "https://git.kernel.org/stable/c/8e4422b05f410f95c51b68a0db4bf1d87f6d22f5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769", "url": "https://git.kernel.org/stable/c/a3a7e20ed66d3f04d37883c398da8a113b430769" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b", "url": "https://git.kernel.org/stable/c/e41d173d9dc735cecb15ab7aa63ecab09338f81b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb", "url": "https://git.kernel.org/stable/c/f951b22dbeec46f2e0fba81cb80d1b0c686b61eb" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80706", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: softing: fw_parse(): validate firmware record spans\n\nfw_parse() reads a fixed record header, a firmware-provided payload,\nand a trailing checksum without knowing the end of the firmware blob. A\ntruncated record can therefore make those reads exceed the blob.\n\nThe same record also supplies addresses and lengths for writes into\nDPRAM. The generic loader uses wrap-prone mixed signed arithmetic for its\nbounds check, while the application loader does not bound the staging\ncopy at all.\n\nPass the firmware end to the parser and validate the full source record.\nUse a signed wide offset for generic DPRAM records and validate the\napplication staging span against the mapped DPRAM before copying.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80706" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2ee477e541a6d5e434d6a4041c6b677ab42e1d82", "url": "https://git.kernel.org/stable/c/2ee477e541a6d5e434d6a4041c6b677ab42e1d82" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1", "url": "https://git.kernel.org/stable/c/808ed899dcf8bdef66894fda5eb7ee4bb0eb8dc1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/84c850b08fc0d671c245144b619683129b55690a", "url": "https://git.kernel.org/stable/c/84c850b08fc0d671c245144b619683129b55690a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/856d6cb04e5407523566b075841dcd6423757d1c", "url": "https://git.kernel.org/stable/c/856d6cb04e5407523566b075841dcd6423757d1c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ad331e26fd213a19fee0de18cdacd67b7ff5b478", "url": "https://git.kernel.org/stable/c/ad331e26fd213a19fee0de18cdacd67b7ff5b478" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae588e5b9cc268de1aabf30f939f0870717ca164", "url": "https://git.kernel.org/stable/c/ae588e5b9cc268de1aabf30f939f0870717ca164" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50", "url": "https://git.kernel.org/stable/c/d0eac0ea7cf493e787fd7b4a556e43ef03cb4b50" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f6d9a6a9512430b395a1940d7b216394fd02d30b", "url": "https://git.kernel.org/stable/c/f6d9a6a9512430b395a1940d7b216394fd02d30b" } ], "release_date": "2026-08-28T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-63916", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: Fix OOB write in wacom_hid_set_device_mode()\n\nwacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE\nusage is always located in the first field (field[0]) of the feature report.\nHowever, a device can specify HID_DG_INPUTMODE in a different field.\n\nIf HID_DG_INPUTMODE is in a field other than the first one and the first\nfield has a report_count smaller than the usage_index of HID_DG_INPUTMODE,\nthis leads to an out-of-bounds write to r->field[0]->value.\n\nFix this by storing the field index of HID_DG_INPUTMODE in 'struct\nhid_data' during feature mapping. In wacom_hid_set_device_mode(), use\nthis stored field index to access the correct field and add bounds\nchecks to ensure both the field index and the value index are within\nvalid ranges before writing.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-63916" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2add311d99646c9d235b2c44f9c169ba30f5db3a", "url": "https://git.kernel.org/stable/c/2add311d99646c9d235b2c44f9c169ba30f5db3a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/43e7c02d6090a82fd60d63491f6871aec906345e", "url": "https://git.kernel.org/stable/c/43e7c02d6090a82fd60d63491f6871aec906345e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5716a293fb19d382ca2336e08fd28a619a5f3c25", "url": "https://git.kernel.org/stable/c/5716a293fb19d382ca2336e08fd28a619a5f3c25" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5db3fca0cec7b33bc5379411d0a60d792c9f9bc0", "url": "https://git.kernel.org/stable/c/5db3fca0cec7b33bc5379411d0a60d792c9f9bc0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/83bd8a5756a3c4a413ed8f6253f9eb2821e1ccaf", "url": "https://git.kernel.org/stable/c/83bd8a5756a3c4a413ed8f6253f9eb2821e1ccaf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b8338111e14183972359009c12d0dbd81d2e1e16", "url": "https://git.kernel.org/stable/c/b8338111e14183972359009c12d0dbd81d2e1e16" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c0a8899e02ddebd51e2589835182c239c2e224ae", "url": "https://git.kernel.org/stable/c/c0a8899e02ddebd51e2589835182c239c2e224ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ed598de9f61582902406d352d99f2073d8e00298", "url": "https://git.kernel.org/stable/c/ed598de9f61582902406d352d99f2073d8e00298" } ], "release_date": "2026-07-19T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-54067", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race when deleting free space root from the dirty cow roots list\n\nWhen deleting the free space tree we are deleting the free space root\nfrom the list fs_info->dirty_cowonly_roots without taking the lock that\nprotects it, which is struct btrfs_fs_info::trans_lock.\nThis unsynchronized list manipulation may cause chaos if there's another\nconcurrent manipulation of this list, such as when adding a root to it\nwith ctree.c:add_root_to_dirty_list().\n\nThis can result in all sorts of weird failures caused by a race, such as\nthe following crash:\n\n [337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI\n [337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1\n [337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n [337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]\n [337571.279928] Code: 85 38 06 00 (...)\n [337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206\n [337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000\n [337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070\n [337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b\n [337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600\n [337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48\n [337571.281723] FS: 00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000\n [337571.281950] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0\n [337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n [337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n [337571.282874] Call Trace:\n [337571.283101] \n [337571.283327] ? __die_body+0x1b/0x60\n [337571.283570] ? die_addr+0x39/0x60\n [337571.283796] ? exc_general_protection+0x22e/0x430\n [337571.284022] ? asm_exc_general_protection+0x22/0x30\n [337571.284251] ? commit_cowonly_roots+0x11f/0x250 [btrfs]\n [337571.284531] btrfs_commit_transaction+0x42e/0xf90 [btrfs]\n [337571.284803] ? _raw_spin_unlock+0x15/0x30\n [337571.285031] ? release_extent_buffer+0x103/0x130 [btrfs]\n [337571.285305] reset_balance_state+0x152/0x1b0 [btrfs]\n [337571.285578] btrfs_balance+0xa50/0x11e0 [btrfs]\n [337571.285864] ? __kmem_cache_alloc_node+0x14a/0x410\n [337571.286086] btrfs_ioctl+0x249a/0x3320 [btrfs]\n [337571.286358] ? mod_objcg_state+0xd2/0x360\n [337571.286577] ? refill_obj_stock+0xb0/0x160\n [337571.286798] ? seq_release+0x25/0x30\n [337571.287016] ? __rseq_handle_notify_resume+0x3ba/0x4b0\n [337571.287235] ? percpu_counter_add_batch+0x2e/0xa0\n [337571.287455] ? __x64_sys_ioctl+0x88/0xc0\n [337571.287675] __x64_sys_ioctl+0x88/0xc0\n [337571.287901] do_syscall_64+0x38/0x90\n [337571.288126] entry_SYSCALL_64_after_hwframe+0x72/0xdc\n [337571.288352] RIP: 0033:0x7f478aaffe9b\n\nSo fix this by locking struct btrfs_fs_info::trans_lock before deleting\nthe free space root from that list.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-54067" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6f1c81886b0b56cb88b311e5d2f203625474d892", "url": "https://git.kernel.org/stable/c/6f1c81886b0b56cb88b311e5d2f203625474d892" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8ce9139aea5e60a247bde5af804312f54975f443", "url": "https://git.kernel.org/stable/c/8ce9139aea5e60a247bde5af804312f54975f443" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/babebf023e661b90b1c78b2baa384fb03a226879", "url": "https://git.kernel.org/stable/c/babebf023e661b90b1c78b2baa384fb03a226879" } ], "release_date": "2025-12-24T12:23:12Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98501", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: fix use-after-free on input2 registration failure\n\nalps_input_configured() stores data->input2 before calling\ninput_register_device(). If registration fails, input_free_device()\nfrees the input device but data->input2 still points to the freed memory.\nalps_input_configured() calls hid_hw_open() before allocating input2, so\nURBs are already active and raw_event can fire during the failure window.\nA U1_SP_ABSOLUTE_REPORT_ID report arriving then causes u1_raw_event()\nto dereference the freed data->input2 -> use-after-free.\n\nFix by only storing input2 into drvdata after successful registration\nand adding a NULL guard in the raw_event path.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98501" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2e55d76e6e8a756f6d87c241de975599f82b02fa", "url": "https://git.kernel.org/stable/c/2e55d76e6e8a756f6d87c241de975599f82b02fa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/443f6b93442b10b972a16f57ceaaea75b77892b6", "url": "https://git.kernel.org/stable/c/443f6b93442b10b972a16f57ceaaea75b77892b6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/47e5e177e9e4e10da6f2759d5ce8d049e33efdc4", "url": "https://git.kernel.org/stable/c/47e5e177e9e4e10da6f2759d5ce8d049e33efdc4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a8ad63158165bacd6a1d7420e0fe5364c913b06", "url": "https://git.kernel.org/stable/c/5a8ad63158165bacd6a1d7420e0fe5364c913b06" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/64f824dccfd316fd3db8ea1cc4e8a76ad6a02740", "url": "https://git.kernel.org/stable/c/64f824dccfd316fd3db8ea1cc4e8a76ad6a02740" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/925da1d2a24787f24872de13a4680437c54de179", "url": "https://git.kernel.org/stable/c/925da1d2a24787f24872de13a4680437c54de179" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d3aba3442798ce4a4c8ce3104d7b286d61e605f9", "url": "https://git.kernel.org/stable/c/d3aba3442798ce4a4c8ce3104d7b286d61e605f9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b", "url": "https://git.kernel.org/stable/c/ef8ca5bb4c8b9696f38b1bebce1c851baa02b77b" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89515", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()\n\nDuring fuzz testing, the following issue was discovered:\n\nBUG: KMSAN: uninit-value in __dma_map_sg_attrs+0x217/0x310\n __dma_map_sg_attrs+0x217/0x310\n dma_map_sg_attrs+0x4a/0x70\n ata_qc_issue+0x9f8/0x1420\n __ata_scsi_queuecmd+0x1657/0x1740\n ata_scsi_queuecmd+0x79a/0x920\n scsi_queue_rq+0x4472/0x4f40\n blk_mq_dispatch_rq_list+0x1cca/0x3ee0\n __blk_mq_sched_dispatch_requests+0x458/0x630\n blk_mq_sched_dispatch_requests+0x15b/0x340\n __blk_mq_run_hw_queue+0xe5/0x250\n __blk_mq_delay_run_hw_queue+0x138/0x780\n blk_mq_run_hw_queue+0x4bb/0x7e0\n blk_mq_sched_insert_request+0x2a7/0x4c0\n blk_execute_rq+0x497/0x8a0\n sg_io+0xbe0/0xe20\n scsi_ioctl+0x2b36/0x3c60\n sr_block_ioctl+0x319/0x440\n blkdev_ioctl+0x80f/0xd70\n __se_sys_ioctl+0x219/0x420\n __x64_sys_ioctl+0x93/0xe0\n x64_sys_call+0x1d6c/0x3ad0\n do_syscall_64+0x4c/0xa0\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nUninit was created at:\n __alloc_pages+0x5c0/0xc80\n alloc_pages+0xe0e/0x1050\n blk_rq_map_user_iov+0x2b77/0x6100\n blk_rq_map_user_io+0x2fa/0x4d0\n sg_io+0xad6/0xe20\n scsi_ioctl+0x2b36/0x3c60\n sr_block_ioctl+0x319/0x440\n blkdev_ioctl+0x80f/0xd70\n __se_sys_ioctl+0x219/0x420\n __x64_sys_ioctl+0x93/0xe0\n x64_sys_call+0x1d6c/0x3ad0\n do_syscall_64+0x4c/0xa0\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nBytes 14-15 of 16 are uninitialized\nMemory access of size 16 starts at ffff88800cbdb000\n\nWhen processing the last unaligned element of the scatterlist, it is\nsupplemented with missing bytes in the amount of pad_len. These bytes\nremain uninitialized, which leads to a problem.\n\nExtend last_sg->length by pad_len first, then use sg_zero_buffer() to\nzero those pad_len bytes. sg_zero_buffer() uses sg_miter internally,\nwhich correctly handles sg entries spanning multiple pages and padding\nthat crosses a page boundary.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89515" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1aa6df61cef1f47f503c3ccf60d08c4dd931fdc1", "url": "https://git.kernel.org/stable/c/1aa6df61cef1f47f503c3ccf60d08c4dd931fdc1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/28ed5343666ff424ce5e248fa1c5a402303b4aff", "url": "https://git.kernel.org/stable/c/28ed5343666ff424ce5e248fa1c5a402303b4aff" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/626147717bea776b61ed3631d2c26283760c4cc4", "url": "https://git.kernel.org/stable/c/626147717bea776b61ed3631d2c26283760c4cc4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6da140ebdfdd6aa3773945f2c0ebba01d2ef33d8", "url": "https://git.kernel.org/stable/c/6da140ebdfdd6aa3773945f2c0ebba01d2ef33d8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6fd1cce5018fdcc8d928e00a6a1dd2997d5b9409", "url": "https://git.kernel.org/stable/c/6fd1cce5018fdcc8d928e00a6a1dd2997d5b9409" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a4353ec7742bdf87dcdde5875270feb3a1982a51", "url": "https://git.kernel.org/stable/c/a4353ec7742bdf87dcdde5875270feb3a1982a51" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e7143c3f4e5c0a7986733c6f27009274bf6c4264", "url": "https://git.kernel.org/stable/c/e7143c3f4e5c0a7986733c6f27009274bf6c4264" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fd2cbe08c6ccba7fc1ddb830653a93bb7e2d833c", "url": "https://git.kernel.org/stable/c/fd2cbe08c6ccba7fc1ddb830653a93bb7e2d833c" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80875", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: use parsed transport offset in TCP state lookup\n\nTCP state handling reparses the skb to find the TCP header. For IPv6 it\nuses sizeof(struct ipv6hdr), while the surrounding IPVS code already\nparsed the packet with ip_vs_fill_iph_skb() and has the real\ntransport-header offset in iph.len.\n\nThis makes TCP state handling look at the wrong bytes when an IPv6\npacket carries extension headers. Use the parsed transport offset passed\ndown from ip_vs_set_state() when reading the TCP header.\n\nFor IPv4 and for IPv6 packets without extension headers, the passed\noffset matches the previous value.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80875" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2500fa3958b1ba51c2b065e39db1b04dfa7e23a2", "url": "https://git.kernel.org/stable/c/2500fa3958b1ba51c2b065e39db1b04dfa7e23a2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2d06e0897ce18228d199887f0823b431d841dd03", "url": "https://git.kernel.org/stable/c/2d06e0897ce18228d199887f0823b431d841dd03" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5848e914b85e360a2dd9d19c00a72e2ea9617dd0", "url": "https://git.kernel.org/stable/c/5848e914b85e360a2dd9d19c00a72e2ea9617dd0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/816efb7fc0aeae986e63ac73b428dd97a4ef69f5", "url": "https://git.kernel.org/stable/c/816efb7fc0aeae986e63ac73b428dd97a4ef69f5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c2ee845e292c278fac75bf28d96bc892607fd5c4", "url": "https://git.kernel.org/stable/c/c2ee845e292c278fac75bf28d96bc892607fd5c4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d45f73c274435703e8d7bc9d8b742a5d9111ab6e", "url": "https://git.kernel.org/stable/c/d45f73c274435703e8d7bc9d8b742a5d9111ab6e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d73f4249776dd970ad65a69cfc51613dd8a034bb", "url": "https://git.kernel.org/stable/c/d73f4249776dd970ad65a69cfc51613dd8a034bb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f6f550f26562d191c30b2818e7925dcb1c7f166c", "url": "https://git.kernel.org/stable/c/f6f550f26562d191c30b2818e7925dcb1c7f166c" } ], "release_date": "2026-09-04T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98177", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Avoid integer underflow in EOP ring size calculation.\n\nThe low 6 bits of cp_hqd_eop_control store the base-2 logarithm\nof the EOP ring size. This was calculated as\n\norder_base_2(q->eop_ring_buffer_size / 4) - 1\n\nBut order_base_2 can in theory return 0, so this could underflow\n(although in practice the ring buffer size cannot be less than 4096).\n\nChange this to\n\norder_base_2(q->eop_ring_buffer_size / 8)\n\nusing properties of logarithms.\n\nAlso add to the above comment to make the mathematics more clear.\n\n(cherry picked from commit f0f43fcf8b2b3a924cad9444340921c96ed5f634)", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98177" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/287a34c4d712e0bdb67751e21316d9c8d75a528a", "url": "https://git.kernel.org/stable/c/287a34c4d712e0bdb67751e21316d9c8d75a528a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8ee521b8b189799e361d4233c5180ba56656d4d4", "url": "https://git.kernel.org/stable/c/8ee521b8b189799e361d4233c5180ba56656d4d4" } ], "release_date": "2026-10-06T09:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89659", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during delegation revoke\n\nA delegation stateid holds only a bare pointer to its owning\nnfs4_client and does not keep it alive. The client survives its\nstateids only because __destroy_client() drains cl_delegations and\ncl_revoked before free_client() runs.\n\nnfs4_laundromat() breaks that invariant: it unhashes an\nexpired delegation from cl_delegations, drops deleg_lock, then\nrevoke_delegation() relinks it onto cl_revoked under cl_lock. In that\nwindow the delegation is on neither list, so client_has_state() can\nreport no remaining state.\n\nEvery teardown path first requires cl_rpc_users to be zero, but\nthe laundromat holds no such reference. A client whose recalled\ndelegation has just timed out can therefore reach free_client()\nwhile revoke_delegation() is still about to dereference cl_lock,\na use-after-free.\n\nPin the client with cl_rpc_users across the revoke so teardown blocks\nuntil it completes, then reap the delegation from cl_revoked. A client\nalready expiring reaps its own, so skip it and leave the delegation on\ndel_recall_lru.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89659" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0dd276b1324a5e08e83c6f675919946c9f0d61c9", "url": "https://git.kernel.org/stable/c/0dd276b1324a5e08e83c6f675919946c9f0d61c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2a9d637c2a8fd8ac29ad9b29f28d122ef75c1a56", "url": "https://git.kernel.org/stable/c/2a9d637c2a8fd8ac29ad9b29f28d122ef75c1a56" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3c0a53ee0b442348d8d2286d6960d3f07bb3a3d3", "url": "https://git.kernel.org/stable/c/3c0a53ee0b442348d8d2286d6960d3f07bb3a3d3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4683ca76b3b7e5808338491c6eb3c20e6b4894d5", "url": "https://git.kernel.org/stable/c/4683ca76b3b7e5808338491c6eb3c20e6b4894d5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/94f0c73797c30a35812ffb32d11b8737d245c405", "url": "https://git.kernel.org/stable/c/94f0c73797c30a35812ffb32d11b8737d245c405" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98359", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Reject unregistering netdevs in ib_get_eth_speed\n\nib_device_get_netdev() intentionally returns a referenced net_device even\nwhen it is unregistering, so matching and cleanup callers can still find\nthe association. The reference keeps struct net_device allocated, but does\nnot guarantee that the device remains operational.\n\nib_get_eth_speed() uses the returned device operationally by invoking its\nethtool callback. Although that call is made under RTNL, the function does\nnot verify the registration state first. An asynchronous RDMA port query\ncan therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit\nhave completed.\n\nCheck for NETREG_REGISTERED while holding RTNL and return -ENODEV for a\ndevice which is being unregistered. Keeping RTNL across the check and the\nethtool operation prevents unregister from starting between them.\n\nKeep the speed fallback and warning under RTNL as well, so the warning can\nsafely read netdev->name. Drop the netdev reference before releasing RTNL\nonce all accesses to the device are complete.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98359" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/45c60ffc79771bad154f224a05753191cf1b37bc", "url": "https://git.kernel.org/stable/c/45c60ffc79771bad154f224a05753191cf1b37bc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e", "url": "https://git.kernel.org/stable/c/520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5bd42f74ec3b4f4687fb600f367af0828d513b3c", "url": "https://git.kernel.org/stable/c/5bd42f74ec3b4f4687fb600f367af0828d513b3c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a219459fbd1b2598e63c81a52847eba6c28b72d2", "url": "https://git.kernel.org/stable/c/a219459fbd1b2598e63c81a52847eba6c28b72d2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/be4b44c8b47c67a04c08b1a0aba18006b749ae6a", "url": "https://git.kernel.org/stable/c/be4b44c8b47c67a04c08b1a0aba18006b749ae6a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5", "url": "https://git.kernel.org/stable/c/ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5" } ], "release_date": "2026-10-06T09:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80628", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: oss: Serialize readq reset state with q->lock\n\nsnd_seq_oss_readq_clear() resets qlen, head, and tail without\nq->lock even though the normal reader and producer paths serialize the\nsame ring state under that spinlock. A reset can therefore race\nsnd_seq_oss_readq_free() or snd_seq_oss_readq_put_event() and leave\nstale records in the queue, drop freshly queued ones, or report the\nwrong readiness after wakeup. KCSAN reports a data race between\nsnd_seq_oss_readq_clear() and snd_seq_oss_readq_free().\n\nTake q->lock while clearing the ring and resetting input_time. Factor\nthe enqueue logic into a caller-locked helper so\nsnd_seq_oss_readq_put_timestamp() updates its suppression state under\nthe same lock instead of racing the reset path.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nreset path: locked readq updater:\n1. snd_seq_oss_reset() or 1. A reader or callback producer\n release reaches takes q->lock on the same queue.\n snd_seq_oss_readq_clear().\n2. snd_seq_oss_readq_clear() 2. The updater tests or modifies\n resets qlen, head, tail, qlen, head, and tail.\n and input_time.\n3. snd_seq_oss_readq_clear() 3. The updater completes its\n wakes sleepers on read-modify-write sequence.\n q->midi_sleep.\n4. Without q->lock, the reset 4. The resulting ring state drives\n can overlap the locked later reads and readiness.\n update.\n\nKCSAN reports:\n\nBUG: KCSAN: data-race in snd_seq_oss_readq_clear /\nsnd_seq_oss_readq_free\n\nwrite to 0xffff8881069fe608 of 4 bytes by task 120516 on cpu 0:\n snd_seq_oss_readq_free+0x6c/0x80\n snd_seq_oss_read+0xcb/0x250\n odev_read+0x38/0x60\n vfs_read+0xff/0x600\n ksys_read+0xb4/0x140\n __x64_sys_read+0x46/0x60\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nread to 0xffff8881069fe608 of 4 bytes by task 120517 on cpu 1:\n snd_seq_oss_readq_clear+0x1f/0x90\n snd_seq_oss_reset+0xa7/0xf0\n snd_seq_oss_ioctl+0x6f6/0x7e0\n odev_ioctl+0x56/0xc0\n __x64_sys_ioctl+0xd1/0x120\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x00000001 -> 0x00000000", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80628" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/287d506d4e0865918cec82bb1361f283a08c979b", "url": "https://git.kernel.org/stable/c/287d506d4e0865918cec82bb1361f283a08c979b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/43e10709b1ba288bcbabb9b9cb6e518b2a5d8506", "url": "https://git.kernel.org/stable/c/43e10709b1ba288bcbabb9b9cb6e518b2a5d8506" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/49ce92d207820f588b0406add82f053decfbe5d9", "url": "https://git.kernel.org/stable/c/49ce92d207820f588b0406add82f053decfbe5d9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/af74390983cae3e5e551a533d6fcfc9b8c1a8b9e", "url": "https://git.kernel.org/stable/c/af74390983cae3e5e551a533d6fcfc9b8c1a8b9e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bf862fdee4831fe1dbde20891db4b29b8f9972f7", "url": "https://git.kernel.org/stable/c/bf862fdee4831fe1dbde20891db4b29b8f9972f7" } ], "release_date": "2026-08-28T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72021", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: use parsed transport offset in SCTP state lookup\n\nset_sctp_state() reads the SCTP chunk header again in order to drive the\nIPVS SCTP state table. For IPv6 it computes the offset with\nsizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from\nip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped\nextension headers and found the real transport header.\n\nThis makes the state machine read from the wrong offset for IPv6 SCTP\npackets that carry extension headers. For example, an INIT packet with an\n8-byte destination options header can be scheduled correctly by\nsctp_conn_schedule(), but set_sctp_state() reads the first byte of the\nSCTP verification tag as a DATA chunk type. The connection then moves\nfrom NONE to ESTABLISHED instead of INIT1, gets the longer established\ntimeout, and updates the active/inactive destination counters\nincorrectly. This happens even though the SCTP handshake has not\ncompleted.\n\nUse the parsed transport offset passed down from ip_vs_set_state() for\nthe SCTP chunk-header lookup. For IPv4 and IPv6 packets without\nextension headers this preserves the existing offset.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72021" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/247d055504dcc852e539b9f7f30d19f9741474bf", "url": "https://git.kernel.org/stable/c/247d055504dcc852e539b9f7f30d19f9741474bf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/290e9e8389b556efc603522e28bd1543846aa336", "url": "https://git.kernel.org/stable/c/290e9e8389b556efc603522e28bd1543846aa336" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2f75c0faa3361b28e36cc0512b3299e163e25789", "url": "https://git.kernel.org/stable/c/2f75c0faa3361b28e36cc0512b3299e163e25789" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9cb5ac594ca76d3a71803b23b74c835b0721e628", "url": "https://git.kernel.org/stable/c/9cb5ac594ca76d3a71803b23b74c835b0721e628" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9f94573ab962a9e81954b755da016fa3cd2f5039", "url": "https://git.kernel.org/stable/c/9f94573ab962a9e81954b755da016fa3cd2f5039" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a4a2d2e483d79cc2ad3a170674cf159644acf22b", "url": "https://git.kernel.org/stable/c/a4a2d2e483d79cc2ad3a170674cf159644acf22b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d2b8b1557ec07ea1bb5dddbceaf4dfe63d388e27", "url": "https://git.kernel.org/stable/c/d2b8b1557ec07ea1bb5dddbceaf4dfe63d388e27" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e5d0bb8871668f20de8f3c94b5ae3f372346bc6e", "url": "https://git.kernel.org/stable/c/e5d0bb8871668f20de8f3c94b5ae3f372346bc6e" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-50751", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: fix possible memory leak in configfs_create_dir()\n\nkmemleak reported memory leaks in configfs_create_dir():\n\nunreferenced object 0xffff888009f6af00 (size 192):\n comm \"modprobe\", pid 3777, jiffies 4295537735 (age 233.784s)\n backtrace:\n kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273)\n new_fragment (./include/linux/slab.h:600 fs/configfs/dir.c:163)\n configfs_register_subsystem (fs/configfs/dir.c:1857)\n basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic\n do_one_initcall (init/main.c:1296)\n do_init_module (kernel/module/main.c:2455)\n ...\n\nunreferenced object 0xffff888003ba7180 (size 96):\n comm \"modprobe\", pid 3777, jiffies 4295537735 (age 233.784s)\n backtrace:\n kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273)\n configfs_new_dirent (./include/linux/slab.h:723 fs/configfs/dir.c:194)\n configfs_make_dirent (fs/configfs/dir.c:248)\n configfs_create_dir (fs/configfs/dir.c:296)\n configfs_attach_group.isra.28 (fs/configfs/dir.c:816 fs/configfs/dir.c:852)\n configfs_register_subsystem (fs/configfs/dir.c:1881)\n basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic\n do_one_initcall (init/main.c:1296)\n do_init_module (kernel/module/main.c:2455)\n ...\n\nThis is because the refcount is not correct in configfs_make_dirent().\nFor normal stage, the refcount is changing as:\n\nconfigfs_register_subsystem()\n configfs_create_dir()\n configfs_make_dirent()\n configfs_new_dirent() # set s_count = 1\n dentry->d_fsdata = configfs_get(sd); # s_count = 2\n...\nconfigfs_unregister_subsystem()\n configfs_remove_dir()\n remove_dir()\n configfs_remove_dirent() # s_count = 1\n dput() ...\n *dentry_unlink_inode()*\n configfs_d_iput() # s_count = 0, release\n\nHowever, if we failed in configfs_create():\n\nconfigfs_register_subsystem()\n configfs_create_dir()\n configfs_make_dirent() # s_count = 2\n ...\n configfs_create() # fail\n ->out_remove:\n configfs_remove_dirent(dentry)\n configfs_put(sd) # s_count = 1\n return PTR_ERR(inode);\n\nThere is no inode in the error path, so the configfs_d_iput() is lost\nand makes sd and fragment memory leaked.\n\nTo fix this, when we failed in configfs_create(), manually call\nconfigfs_put(sd) to keep the refcount correct.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-50751" } ], "release_date": "2025-12-24T13:05:46Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90383", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: sgi-gru: remove interrupt-context page-table walks\n\nThe GRU TLB miss handler walks a process's page tables without holding\npage-table locks or a reference to the mapped page. It also uses a kernel\npage-table accessor on user page tables and supports only PMD-level large\nmappings on x86-64.\n\nRemove the direct walker. Send interrupt faults directly to user polling\nmode so the existing call-OS fallback retries them in process context.\n\nRemove the mmap-lock failure statistic that can no longer be incremented.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90383" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a540ced720b4397306337cab34af1af4b30827c", "url": "https://git.kernel.org/stable/c/5a540ced720b4397306337cab34af1af4b30827c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6248eb1833ff0adfdbbadd5f846c2f22e02a01b0", "url": "https://git.kernel.org/stable/c/6248eb1833ff0adfdbbadd5f846c2f22e02a01b0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/877423f595b60f8fe7c18b64a5d283d9e1732a13", "url": "https://git.kernel.org/stable/c/877423f595b60f8fe7c18b64a5d283d9e1732a13" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/928a8e9f523df845fc496bcb9811013b67aabec5", "url": "https://git.kernel.org/stable/c/928a8e9f523df845fc496bcb9811013b67aabec5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef81e4a1628ecfb9cfc442de10883f383faf17a1", "url": "https://git.kernel.org/stable/c/ef81e4a1628ecfb9cfc442de10883f383faf17a1" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-97518", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: reject duplicate wiphy cipher suite entries\n\nDuplicate entries in wiphy->cipher_suites do not describe any\nadditional capability, but cfg80211 currently accepts them and leaves\nindividual consumers to deal with them.\n\nOne such consumer is the WEXT compatibility code, which appends a WEP\nkey length for each WEP cipher entry it sees. Repeated WEP entries can\ntherefore overflow the fixed iw_range::encoding_size array returned by\nSIOCGIWRANGE.\n\nReject duplicate cipher suite entries in wiphy_register() instead.\nThis keeps the cipher suite invariant in one place and makes malformed\nwiphy descriptions fail early with -EINVAL, rather than relying on a\nsingle cfg80211 user to handle duplicates correctly.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97518" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1305f8b925fe92edf5fec183588dfc7db719180b", "url": "https://git.kernel.org/stable/c/1305f8b925fe92edf5fec183588dfc7db719180b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923", "url": "https://git.kernel.org/stable/c/4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7187d145d9042b037e4f10538f70cf95e380219f", "url": "https://git.kernel.org/stable/c/7187d145d9042b037e4f10538f70cf95e380219f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d12e92e72db914e1ea777c6f246f6be75985438e", "url": "https://git.kernel.org/stable/c/d12e92e72db914e1ea777c6f246f6be75985438e" } ], "release_date": "2026-09-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-63990", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: refuse to enslave CAN devices\n\nsyzbot reported a kernel paging request crash in\ncan_rx_unregister() inside net/can/af_can.c. The crash occurs\nbecause a virtual CAN device (vxcan) is being enslaved to a\nbonding master.\n\nDuring the enslavement process, the bonding driver mutates\nand modifies the network device states to fit an Ethernet-like\naggregation model. However, CAN devices operate on a completely\ndifferent Layer 2 architecture, relying on the CAN mid-layer\nprivate data structure (can_ml_priv) instead of standard\nEthernet structures. Since bonding does not initialize or\nmaintain these CAN structures, subsequent operations on the\nhalf-enslaved interface (such as closing associated sockets\nvia isotp_release) lead to a null-pointer dereference when\naccessing the CAN receiver lists.\n\nBonding CAN interfaces is architecturally invalid as CAN lacks\nMAC addresses, ARP capabilities, and standard Ethernet\nlink-layer mechanisms. While generic loopback devices are\nblocked globally in net/core/dev.c, virtual CAN devices\nbypass this check because they do not carry the IFF_LOOPBACK\nflag, despite acting as local software-loopbacks.\n\nFix this by explicitly blocking network devices of type\nARPHRD_CAN from being enslaved at the very beginning of\nbond_enslave(). This prevents illegal state mutations,\neliminates the resulting KASAN crashes, and avoids potential\nmemory leaks from incomplete socket cleanups.\n\nAs the CAN support has been added a long time after bonding\nthe Fixes-tag points to the introduction of ARPHRD_CAN that\nwould have needed a specific handling in bonding_main.c.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-63990" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/02f1c87ded33b43d48b4a1d665da15f2157b30d8", "url": "https://git.kernel.org/stable/c/02f1c87ded33b43d48b4a1d665da15f2157b30d8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/41e8478c4cd896d3abbe33d41afc90c84ac66602", "url": "https://git.kernel.org/stable/c/41e8478c4cd896d3abbe33d41afc90c84ac66602" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/563090e5d450c665f70d955a39f9587afc7842eb", "url": "https://git.kernel.org/stable/c/563090e5d450c665f70d955a39f9587afc7842eb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/69b78b5f3033272e53a2dc2dad675962654a5b38", "url": "https://git.kernel.org/stable/c/69b78b5f3033272e53a2dc2dad675962654a5b38" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8ba68464e4787b6a7ec938826e16124df20fd23d", "url": "https://git.kernel.org/stable/c/8ba68464e4787b6a7ec938826e16124df20fd23d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9ea8a648d9120f7652bcde1ce2c4ad66871af707", "url": "https://git.kernel.org/stable/c/9ea8a648d9120f7652bcde1ce2c4ad66871af707" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f4d78a81f57df82e9d82a2c07471fed1a1235893", "url": "https://git.kernel.org/stable/c/f4d78a81f57df82e9d82a2c07471fed1a1235893" } ], "release_date": "2026-07-19T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-89783", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full\n\nThe depth check in xfrm6_input_addr() is off by one:\n\n if (1 + sp->len == XFRM_MAX_DEPTH)\n goto drop;\n ...\n sp->xvec[sp->len++] = x;\n\nxfrm_input() can leave sp->len == XFRM_MAX_DEPTH, and the transport-mode\nreceive path re-enters IPv6 input via xfrm_trans_reinject() with that\nsecpath preserved. If the inner packet carries a destination-options HAO\noption or a type-2 routing header, xfrm6_input_addr() is called with\nsp->len == XFRM_MAX_DEPTH; the check (1 + 6 == 6) is false, so\nsp->xvec[sp->len++] writes one slot past the 6-element xvec[]. The write\nstays within the sec_path allocation (invisible to KASAN); UBSAN_BOUNDS\nflags it and panics under panic_on_warn.\n\nUse \"sp->len >= XFRM_MAX_DEPTH\", matching xfrm_input(). This also\nrestores one chain level the old check rejected at sp->len == 5.\n\n UBSAN: array-index-out-of-bounds in net/ipv6/xfrm6_input.c:309:10\n index 6 is out of range for type 'xfrm_state *[6]'", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89783" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0f679e0523ddfff3fb554336ceb874b0e51e9cd3", "url": "https://git.kernel.org/stable/c/0f679e0523ddfff3fb554336ceb874b0e51e9cd3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/48996649222e95008cdb98cd58579e3fc8e5ee06", "url": "https://git.kernel.org/stable/c/48996649222e95008cdb98cd58579e3fc8e5ee06" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc", "url": "https://git.kernel.org/stable/c/5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5f35a29a5eed3d80befd32050843ac88dea3d61a", "url": "https://git.kernel.org/stable/c/5f35a29a5eed3d80befd32050843ac88dea3d61a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/68e8737fe8e72f085c608cff322b3d2de8340af1", "url": "https://git.kernel.org/stable/c/68e8737fe8e72f085c608cff322b3d2de8340af1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8fe2c53fb81f5ad5be43af2ad09583f7c78b4b77", "url": "https://git.kernel.org/stable/c/8fe2c53fb81f5ad5be43af2ad09583f7c78b4b77" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/91fc387f63c00ddfb5221127a17bac97549a8343", "url": "https://git.kernel.org/stable/c/91fc387f63c00ddfb5221127a17bac97549a8343" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bdcda866c89f9a8b1acdabf02d26cde9fbe501d8", "url": "https://git.kernel.org/stable/c/bdcda866c89f9a8b1acdabf02d26cde9fbe501d8" } ], "release_date": "2026-09-16T09:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-50076", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: prevent kernel-infoleak in con_font_get()\n\nfont.data may not initialize all memory spaces depending on the implementation\nof vc->vc_sw->con_font_get. This may cause info-leak, so to prevent this, it\nis safest to modify it to initialize the allocated memory space to 0, and it\ngenerally does not affect the overall performance of the system.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-50076" } ], "release_date": "2024-10-29T00:50:18Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80783", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()\n\nmagicmouse_raw_event() handles DOUBLE_REPORT_ID (0xf7) packets, which pack\ntwo touch reports into one, by splitting the packet and calling itself on\neach half. The only guard against runaway recursion is a \"size < 1\" check,\nwhich stops zero-sized calls but does not bound the recursion depth.\n\nA malicious HID device that matches this driver can send a report starting\nwith DOUBLE_REPORT_ID and filled with the sequence [0xf7, 0x00]. Each level\nconsumes two bytes and recurses on the remainder, so an incoming report of\nup to HID_MAX_BUFFER_SIZE (16 KiB) drives roughly 8000 nested calls. That\neasily exhausts the 16 KiB kernel stack, leading to a stack overflow: a\npanic with CONFIG_VMAP_STACK, or memory corruption without it.\n\nA double report only ever wraps two normal reports; it is never\nlegitimately nested. Refuse to re-enter the DOUBLE_REPORT_ID case from a\nrecursive call so the recursion depth is bounded to two, while all valid\npackets keep being parsed exactly as before.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80783" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26c45abed62536aabf4033fb6d64cf72e93374e9", "url": "https://git.kernel.org/stable/c/26c45abed62536aabf4033fb6d64cf72e93374e9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/70589b0c005db003f6d8ae4db3c4d54fed7b83e4", "url": "https://git.kernel.org/stable/c/70589b0c005db003f6d8ae4db3c4d54fed7b83e4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8a10a624996f16628234306b46f0cf36707d78bd", "url": "https://git.kernel.org/stable/c/8a10a624996f16628234306b46f0cf36707d78bd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a33a596d3ad8dfe6c96a368097a028abeee16c17", "url": "https://git.kernel.org/stable/c/a33a596d3ad8dfe6c96a368097a028abeee16c17" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bec338b07beb883726b32192c8f01c601bc76fda", "url": "https://git.kernel.org/stable/c/bec338b07beb883726b32192c8f01c601bc76fda" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d095de37f78c5f32a4252ef0f99b84ba76550b86", "url": "https://git.kernel.org/stable/c/d095de37f78c5f32a4252ef0f99b84ba76550b86" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d16df755b4493b6d37803c628b2c621d096796a8", "url": "https://git.kernel.org/stable/c/d16df755b4493b6d37803c628b2c621d096796a8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/db8d634128d2ba88d79c0b601e983ebe14bb0519", "url": "https://git.kernel.org/stable/c/db8d634128d2ba88d79c0b601e983ebe14bb0519" } ], "release_date": "2026-09-04T16:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89784", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6\n\nrpcb_register_inet4() and rpcb_register_inet6() store the result of\nrpc_sockaddr2uaddr() into map->r_addr without checking it for NULL.\nrpc_sockaddr2uaddr() returns NULL when its final kstrdup() fails, and\nthe unchecked NULL is then carried into the synchronous RPCBPROC_SET\nencode path: rpcb_register_call() -> rpc_call_sync() ->\nrpcb_enc_getaddr() -> encode_rpcb_string(), whose first statement is\nstrlen(string), dereferencing NULL and oopsing the kernel.\n\nThe crash reproduces under failslab on v6.12; with KASAN the NULL\ndereference surfaces as a fault on the shadow of address zero:\n\n Oops: general protection fault, probably for non-canonical address\n 0xdffffc0000000000 [#1] PREEMPT SMP KASAN\n RIP: 0010:strlen (lib/string.c:409)\n Call Trace:\n encode_rpcb_string (net/sunrpc/rpcb_clnt.c:890)\n rpcb_enc_getaddr (net/sunrpc/rpcb_clnt.c:910)\n rpcauth_wrap_req_encode (net/sunrpc/auth.c:745)\n call_encode (net/sunrpc/clnt.c:1966)\n __rpc_execute (net/sunrpc/sched.c:952)\n rpc_run_task (net/sunrpc/clnt.c:1243)\n rpc_call_sync (net/sunrpc/clnt.c:1272)\n rpcb_v4_register (net/sunrpc/rpcb_clnt.c:500)\n svc_generic_rpcbind_set\n nfsd_rpcbind_set\n svc_register\n svc_setup_socket\n svc_addsock\n write_ports\n nfsctl_transaction_write\n vfs_write\n\nThe crash is reachable when an in-kernel RPC service (nfsd, lockd,\nnfs-callback) registers with the local rpcbind under enough memory\npressure for the small GFP_KERNEL kstrdup() in rpc_sockaddr2uaddr() to\nfail. The asynchronous getport path already handles this exact failure\nmode by returning -ENOMEM; only the two register helpers omit the check.\n\nMirror that handling: bail out with -ENOMEM when rpc_sockaddr2uaddr()\nreturns NULL, before the address is fed into the encoder.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89784" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/04441b792ec40eb66349b5fab34b6a2090b5b2dd", "url": "https://git.kernel.org/stable/c/04441b792ec40eb66349b5fab34b6a2090b5b2dd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/12bf3e0182ccdaf3b412756a756d3944a7dacaa9", "url": "https://git.kernel.org/stable/c/12bf3e0182ccdaf3b412756a756d3944a7dacaa9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4a6095de8cb1858e05bdf70b3e7d6d7645c25041", "url": "https://git.kernel.org/stable/c/4a6095de8cb1858e05bdf70b3e7d6d7645c25041" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4e01022974355732e748ec8ebc97c558cb624ffe", "url": "https://git.kernel.org/stable/c/4e01022974355732e748ec8ebc97c558cb624ffe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a51c49ddb37b883566874aecc66bc5a2e617a96", "url": "https://git.kernel.org/stable/c/5a51c49ddb37b883566874aecc66bc5a2e617a96" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cda4aacfb0bbf5c0f90fd0b42c72c749635d1368", "url": "https://git.kernel.org/stable/c/cda4aacfb0bbf5c0f90fd0b42c72c749635d1368" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eb476289c12cc22c8766f8a84eeb7ab46c4e8fb6", "url": "https://git.kernel.org/stable/c/eb476289c12cc22c8766f8a84eeb7ab46c4e8fb6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fd22370226a0d8109045d0831fd5aaadee921693", "url": "https://git.kernel.org/stable/c/fd22370226a0d8109045d0831fd5aaadee921693" } ], "release_date": "2026-09-16T09:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89965", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/btt: reject an arena whose nfree is below the lane count\n\nThe BTT info block's nfree field, the number of reserve free blocks, is\nread from the medium without validation. btt_freelist_init() and\nbtt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree,\nbut the I/O path indexes them by the lane from nd_region_acquire_lane(),\nwhich is bounded by nd_region->num_lanes (ND_MAX_LANES), not by nfree.\nA crafted or foreign arena whose nfree is below the lane count makes\nfreelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write.\n\nbtt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the\ncode does not currently honor: num_lanes is ND_MAX_LANES regardless of\nnfree. Reject an arena whose nfree is below num_lanes at discovery,\nbefore the per-lane arrays are allocated, enforcing that invariant.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89965" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/59d5cd1f42b4bab3609512c3cb3d3540d3d21da7", "url": "https://git.kernel.org/stable/c/59d5cd1f42b4bab3609512c3cb3d3540d3d21da7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6a1f2e5ed9267ca19187038ac635393c165213ac", "url": "https://git.kernel.org/stable/c/6a1f2e5ed9267ca19187038ac635393c165213ac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b1faf1f099f7060b5f1f2f0d024132581f1726e", "url": "https://git.kernel.org/stable/c/6b1faf1f099f7060b5f1f2f0d024132581f1726e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6f79d1a5f2611a3d36e9312be5425cd9cb397c51", "url": "https://git.kernel.org/stable/c/6f79d1a5f2611a3d36e9312be5425cd9cb397c51" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9dfa11cef4750b67591307f2c62e47a23d60e4b7", "url": "https://git.kernel.org/stable/c/9dfa11cef4750b67591307f2c62e47a23d60e4b7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eb491343d2d1784121ad9af91c25b338c28913c3", "url": "https://git.kernel.org/stable/c/eb491343d2d1784121ad9af91c25b338c28913c3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f6c5313aae794ecca8f762c1a3493de5c266f120", "url": "https://git.kernel.org/stable/c/f6c5313aae794ecca8f762c1a3493de5c266f120" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f9bf05c63b77d000e9c01f3e47af36973887d350", "url": "https://git.kernel.org/stable/c/f9bf05c63b77d000e9c01f3e47af36973887d350" } ], "release_date": "2026-09-16T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72284", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs\n\nIgnore KVM's internal \"service pending PV EOI\" request if the vCPU has\ndisabled PV EOIs since the request was made. Asserting that PV EOIs are\nenabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e.\nif pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables\nPV EOIs.\n\n kernel BUG at arch/x86/kvm/lapic.c:3338!\n Oops: invalid opcode: 0000 [#1] SMP\n CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm]\n Call Trace:\n \n kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm]\n kvm_vcpu_ioctl+0x2d5/0x980 [kvm]\n __x64_sys_ioctl+0x8a/0xd0\n do_syscall_64+0xb5/0xb40\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \n Modules linked in: kvm_intel kvm irqbypass\n ---[ end trace 0000000000000000 ]---", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72284" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/038b9ce6fafda1babd1e33d52cbc6039747a6d87", "url": "https://git.kernel.org/stable/c/038b9ce6fafda1babd1e33d52cbc6039747a6d87" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e", "url": "https://git.kernel.org/stable/c/32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8e9f7a95279bf608cf4c331ed89612e28c04564f", "url": "https://git.kernel.org/stable/c/8e9f7a95279bf608cf4c331ed89612e28c04564f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9285e4070df2c40585c3d7ec9571faa7a2b97e17", "url": "https://git.kernel.org/stable/c/9285e4070df2c40585c3d7ec9571faa7a2b97e17" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/97542f15dc4cf6cd3fdc035e482dca54246ddf48", "url": "https://git.kernel.org/stable/c/97542f15dc4cf6cd3fdc035e482dca54246ddf48" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ebd7845ca0471d251a1cb48d84eb165aff5b7123", "url": "https://git.kernel.org/stable/c/ebd7845ca0471d251a1cb48d84eb165aff5b7123" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72243", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: check connect-related permissions on TCP Fast Open\n\nSimilar to Landlock, SELinux was not updated when TCP Fast Open\nsupport was introduced to ensure connect-related permissions are\nchecked when using TCP Fast Open. Update its socket_sendmsg() hook to\ncall selinux_socket_connect() when MSG_FASTOPEN is passed.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72243" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11406d0d7e11b4e525bb2ace2c70107031d058da", "url": "https://git.kernel.org/stable/c/11406d0d7e11b4e525bb2ace2c70107031d058da" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/44c74d27d1b9aaa99fa8a83640c1223575262b80", "url": "https://git.kernel.org/stable/c/44c74d27d1b9aaa99fa8a83640c1223575262b80" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/646ebbc5f2ff9147d084e1213143f091026a611c", "url": "https://git.kernel.org/stable/c/646ebbc5f2ff9147d084e1213143f091026a611c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d028bc080a0dcd6a7f8e1ae1bd32dda696505ba3", "url": "https://git.kernel.org/stable/c/d028bc080a0dcd6a7f8e1ae1bd32dda696505ba3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e507633bf76bccf1a6af27771fb0d6e2862b7eac", "url": "https://git.kernel.org/stable/c/e507633bf76bccf1a6af27771fb0d6e2862b7eac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fc633a598206d4f23af782db7c0b5f3a82751d2c", "url": "https://git.kernel.org/stable/c/fc633a598206d4f23af782db7c0b5f3a82751d2c" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64351", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kalmia: bound RX frame length in kalmia_rx_fixup()\n\nkalmia_rx_fixup() computes usb_packet_length = skb->len - (2 *\nKALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that\nskb->len is at least KALMIA_HEADER_LENGTH, which is 6. A device can\ndeliver a short bulk-IN frame with skb->len in the 6 to 11 range, or\nleave a short trailing remainder on a later loop iteration. Either case\nunderflows usb_packet_length to about 65530.\n\nThat bypasses the usb_packet_length < ether_packet_length truncation path.\nThe device-supplied ether_packet_length, a le16 up to 65535 read from\nheader_start[2], then drives a memcmp() and the following skb_trim() and\nskb_pull() past the end of the rx buffer. The rx buffer is hard_mtu * 10,\nwhich is 14000 bytes. That is an out of bounds read.\n\nRequire both the start and end framing headers to be present before\nsubtracting them, on every loop iteration.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64351" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a", "url": "https://git.kernel.org/stable/c/2d04c37ed4e1d0f733ad39ec35b5a5d8818b4f4a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/391706889a5112feafdc0c68db3ecc7ed325d09c", "url": "https://git.kernel.org/stable/c/391706889a5112feafdc0c68db3ecc7ed325d09c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/46ab32870d010e9a057bc5659cea22b7e728ca88", "url": "https://git.kernel.org/stable/c/46ab32870d010e9a057bc5659cea22b7e728ca88" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/47b6bcef6e679593d2e86e04ee72c46a4e2f7139", "url": "https://git.kernel.org/stable/c/47b6bcef6e679593d2e86e04ee72c46a4e2f7139" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/51e65f1d78457ea4f9513d90ab22c9dccbb35110", "url": "https://git.kernel.org/stable/c/51e65f1d78457ea4f9513d90ab22c9dccbb35110" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b", "url": "https://git.kernel.org/stable/c/aa4eef2cbb66ea3dfcfc24bdce798dd78a81b54b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c466097d85d52f3aa200736cb4759e66d4bbf6e3", "url": "https://git.kernel.org/stable/c/c466097d85d52f3aa200736cb4759e66d4bbf6e3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e24eb271061db384a3c3ef6f107fe515e68ef222", "url": "https://git.kernel.org/stable/c/e24eb271061db384a3c3ef6f107fe515e68ef222" } ], "release_date": "2026-07-25T10:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-64115", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: fix UAF when peer resets connection during handshake\n\nvmci_transport_recv_connecting_server() returned err = 0 for a peer\nRST in its default switch arm:\n\n\terr = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;\n\nThat made vmci_transport_recv_listen() skip vsock_remove_pending(),\nleaving the pending socket on the listener's pending_links with\nsk_state = TCP_CLOSE while destroy: still dropped the explicit\nreference taken before schedule_delayed_work().\n\nOne second later vsock_pending_work() observed is_pending=true and\nperformed full cleanup: vsock_remove_pending() then the two trailing\nsock_put(sk) calls -- the first reached refcount 0 and __sk_freed\nthe socket, and the second wrote into the freed object:\n\n BUG: KASAN: slab-use-after-free in refcount_warn_saturate\n Write of size 4 at addr ffff88800b1cac80 by task kworker\n Workqueue: events vsock_pending_work\n\nTreat peer RST like any other unexpected packet type (err = -EINVAL).\nAll destroy: arms now return err < 0, so vmci_transport_recv_listen()\nremoves pending from pending_links synchronously and\nvsock_pending_work() takes the is_pending=false / !rejected branch,\ndropping only its own work reference. This also closes the\nmulti-packet race Sashiko reported on v2: pending is removed from\nthe list before any subsequent packet can find it.\n\nThe pre-existing sk_acceptq_removed() gap on the err < 0 path of\nvmci_transport_recv_listen() that Sashiko also noted is not\nintroduced or changed by this patch.\n\nTested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64115" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb", "url": "https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6", "url": "https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4", "url": "https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9", "url": "https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf", "url": "https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26", "url": "https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb", "url": "https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145", "url": "https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145" } ], "release_date": "2026-07-19T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-97938", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nreboot: fix cad_pid use-after-free race\n\ncad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()\nreads it and passes it to pid_vnr() without protecting the lifetime of\nthe referenced struct pid. A concurrent writer can replace cad_pid and\ndrop the final reference to the old struct pid after the reader has\nloaded the pointer but before pid_vnr() has finished dereferencing it,\ncausing a use-after-free.\n\nkill_cad_pid() has the same lifetime race when it passes cad_pid to\nkill_pid().\n\nAt the time this issue was reported, an unprivileged user could reach the\nsysctl through user and PID namespaces because cad_pid was registered in\npid_table[]. Moving cad_pid back to the global reboot sysctl table\ncorrected that namespace and permission mismatch, but did not fix the\nunderlying lifetime race.\n\nFix this by treating cad_pid as an RCU-protected pointer at both read\nsites and by waiting for a grace period before dropping the old reference\non the write side.\n\ncall_rcu(&old_pid->rcu, ...) cannot be used here because free_pid()\nalso queues pid->rcu; queueing the same rcu_head twice can corrupt the\nRCU callback list.\n\nOriginal KASAN crash stack:\n kernel/pid.c:545 pid_nr_ns() # reads freed pid->level\n kernel/pid.c:556 pid_vnr() # calls pid_nr_ns()\n kernel/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97938" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c1a966bc047af2801a70b8eb13f9df5d7ab925f", "url": "https://git.kernel.org/stable/c/0c1a966bc047af2801a70b8eb13f9df5d7ab925f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a88f78df753993469dab4d1831f8fb4256a9468", "url": "https://git.kernel.org/stable/c/5a88f78df753993469dab4d1831f8fb4256a9468" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9a17b0e053197a6a42cdc75e75a35b17aa662088", "url": "https://git.kernel.org/stable/c/9a17b0e053197a6a42cdc75e75a35b17aa662088" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ad72e2566643fff7f01666d845fb026898155e1f", "url": "https://git.kernel.org/stable/c/ad72e2566643fff7f01666d845fb026898155e1f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae3e53fe3c1241855e3a88f74877738349948c78", "url": "https://git.kernel.org/stable/c/ae3e53fe3c1241855e3a88f74877738349948c78" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72250", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag\n\nnf_ct_frag6_reasm() slides the packet head forward to drop the IPv6\nfragment header and then unconditionally advances skb->mac_header:\n\n\tskb->mac_header += sizeof(struct frag_hdr);\n\nOn the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header\nyet, so skb->mac_header is still the \"not set\" sentinel (u16)~0U. Adding\nsizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 == 7),\nafter which skb_mac_header_was_set() wrongly reports a MAC header is\npresent and skb_mac_header() points into the headroom.\n\nThe reassembler has done this unconditional add since it was introduced;\nit was harmless while mac_header was a bare pointer, but wrong once\nmac_header became a u16 offset whose unset state is the ~0U sentinel\ntested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c\ndoes the same relocation and does guard the adjustment; mirror the\nguard here.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72250" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/00bdce2fda7e430d24cfbc96764a1b96deb31f82", "url": "https://git.kernel.org/stable/c/00bdce2fda7e430d24cfbc96764a1b96deb31f82" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2a95ec21824a8ad81ad660b12231456fc0ac9830", "url": "https://git.kernel.org/stable/c/2a95ec21824a8ad81ad660b12231456fc0ac9830" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9", "url": "https://git.kernel.org/stable/c/3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/53ef70a315420ed31581d38343684b3bf9a3c76d", "url": "https://git.kernel.org/stable/c/53ef70a315420ed31581d38343684b3bf9a3c76d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6e8cd710ca35c576f5f2e5a396047c9ac61f75e5", "url": "https://git.kernel.org/stable/c/6e8cd710ca35c576f5f2e5a396047c9ac61f75e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a58230f3a7c4f6c3261786bc1efb72c42e68cd25", "url": "https://git.kernel.org/stable/c/a58230f3a7c4f6c3261786bc1efb72c42e68cd25" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bbcdef2061b170af45702ce6b359c02c12acfc94", "url": "https://git.kernel.org/stable/c/bbcdef2061b170af45702ce6b359c02c12acfc94" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cd0d7bbc027b4d3329712cdcdeb4e5567ffd0d58", "url": "https://git.kernel.org/stable/c/cd0d7bbc027b4d3329712cdcdeb4e5567ffd0d58" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80847", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: clamp route advmss to TCP_MIN_MSS\n\ntcp_select_initial_window() assumes that callers never pass an MSS\nsmaller than 1, but route-derived advmss values can violate that\nassumption.\n\nA too-small explicit RTAX_ADVMSS is one way to get there, but it is not\nthe only one. The same divide-by-zero can also be reached through the\n\"default advmss\" path when RTAX_ADVMSS is left at 0 and the effective\nadvmss is later driven down by route MTU and min_adv_mss.\n\nIntroduce a tcp_dst_advmss() helper that clamps route advmss to\nTCP_MIN_MSS before TCP consumes it, and use it in the TCP paths that\nderive advmss from dst metrics. This keeps the effective MSS from\ndropping to zero before tcp_select_initial_window() rounds the receive\nwindow.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80847" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/31cf2349361902769dc323e4dbf4b449795ec288", "url": "https://git.kernel.org/stable/c/31cf2349361902769dc323e4dbf4b449795ec288" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b8c20bf61924dfc38fefb145c9f7406d73fae53", "url": "https://git.kernel.org/stable/c/6b8c20bf61924dfc38fefb145c9f7406d73fae53" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/788fbbf7d61f9742298417c207c91b6db159fbbc", "url": "https://git.kernel.org/stable/c/788fbbf7d61f9742298417c207c91b6db159fbbc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/870a9e42ecc6fe1b8c25d87af043cb0d9c178fe1", "url": "https://git.kernel.org/stable/c/870a9e42ecc6fe1b8c25d87af043cb0d9c178fe1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cfb44c6028e6f979720315e0772bbd0d4d33ed61", "url": "https://git.kernel.org/stable/c/cfb44c6028e6f979720315e0772bbd0d4d33ed61" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eaf4af9bd6975c2eff8d48820937c83032d968dc", "url": "https://git.kernel.org/stable/c/eaf4af9bd6975c2eff8d48820937c83032d968dc" } ], "release_date": "2026-09-04T16:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98489", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1c: fix soft lockup on out-of-range tpd_cons read\n\nThe hardware can report an out-of-range tpd_cons (seen as 0xffff)\nwhile the PCIe link/MAC is resetting. An out-of-range value can\nnever be reached and the loop below would spin forever. To avoid\na soft lockup treat it as \"nothing new to clean\" instead.\n\nReproduced on two machines, same NIC (Qualcomm Atheros AR8151 v2.0,\n4-port), triggered by rebooting a Mikrotik CCR2004 PCIe card that\nthe ports are directly linked to:\n\n- Ubuntu 26.04.1 LTS, kernel 7.0.0-31-generic. The link-flap\n precursor, before the lockup was captured with a full trace\n elsewhere:\n\n atl1c 0000:05:00.0 enp5s0f0: NETDEV WATCHDOG: CPU: 4: transmit queue 2 timed out 489984 ms\n atl1c 0000:05:00.0: MAC state machine can't be idle since disabled for 10ms second\n atl1c 0000:05:00.0: atl1c: enp5s0f0 NIC Link is Up<65535 Mbps Full Duplex>\n\n 65535 (0xffff) here is the same value tpd_cons reads back once the\n loop below gets stuck.\n\n- Proxmox VE, kernel 7.0.14-11-pve. Same NIC/trigger, this time\n caught by the soft lockup watchdog with a full stack trace:\n\n watchdog: BUG: soft lockup - CPU#12 stuck for 354s! [napi/eth%d-0:329]\n CPU: 12 UID: 0 PID: 329 Comm: napi/eth%d-0 Tainted: P O L 7.0.14-11-pve #1 PREEMPT(lazy)\n RIP: 0010:atl1c_clean_tx+0x142/0x2d0 [atl1c]\n Call Trace:\n \n __napi_poll+0x32/0x1e0\n napi_threaded_poll_loop+0x286/0x2e0\n napi_threaded_poll+0xfd/0x140\n kthread+0xf7/0x130\n ret_from_fork+0x2da/0x3a0\n ret_from_fork_asm+0x1a/0x30\n ", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98489" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/36c2009d90f2210ef92e6f4f2850e8b57b09e754", "url": "https://git.kernel.org/stable/c/36c2009d90f2210ef92e6f4f2850e8b57b09e754" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4daf80da0c38b8cd92c111ad96cb38322aabf586", "url": "https://git.kernel.org/stable/c/4daf80da0c38b8cd92c111ad96cb38322aabf586" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/57b55367b6e3accc55a989afeaf127063e3614dc", "url": "https://git.kernel.org/stable/c/57b55367b6e3accc55a989afeaf127063e3614dc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/586847400b1168a88917287ac02c2c91a620b841", "url": "https://git.kernel.org/stable/c/586847400b1168a88917287ac02c2c91a620b841" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5ea2576a4f5ec476f33169fdbe9090d2b038ad13", "url": "https://git.kernel.org/stable/c/5ea2576a4f5ec476f33169fdbe9090d2b038ad13" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9f2cc71a2e2799d9c993c73f1bd36507eef6ae43", "url": "https://git.kernel.org/stable/c/9f2cc71a2e2799d9c993c73f1bd36507eef6ae43" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d4ab263e40fcf7cfa38a43ec774067d32eb94e16", "url": "https://git.kernel.org/stable/c/d4ab263e40fcf7cfa38a43ec774067d32eb94e16" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f", "url": "https://git.kernel.org/stable/c/e7acd4cdeccbcdfd407adeb72b1eba14d1145b6f" } ], "release_date": "2026-10-18T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89559", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibnvdimm/labels: Prevent integer overflow in __nd_label_validate()\n\nThe on-media namespace index field nslot is a u32 read from the DIMM\nlabel storage area. __nd_label_validate() bounds it against the config\narea size, but sizeof_namespace_label() returns unsigned, so the product\nnslot * label_size is evaluated in 32-bit and wraps modulo 2^32 before\nthe comparison. A crafted nslot passes the bound and is then used as the\nloop trip count in nd_label_data_init(), whose memset() walks off the end\nof the config_size buffer: an out-of-bounds write.\n\nThe field is not trusted -- it comes from the medium, or from userspace\nvia ND_CMD_SET_CONFIG_DATA. Evaluate the product in 64-bit so the bound\ncheck is exact; conforming labels are unaffected.\n\nThe check was safe when introduced by commit 4a826c83db4e (\"libnvdimm:\nnamespace indices: read and validate\"): it multiplied by sizeof(struct\nnd_namespace_label), a size_t, so on a 64-bit build the product did not\nwrap. Commit 564e871aa66f (\"libnvdimm, label: add v1.2 nvdimm label\ndefinitions\") narrowed it to 32 bits when the label size became a runtime\nvalue read via sizeof_namespace_label().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89559" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/037770686126155eafc44501312989e2837b9659", "url": "https://git.kernel.org/stable/c/037770686126155eafc44501312989e2837b9659" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/09e649117c54b7e1c004f22eaa19efbadd9ac856", "url": "https://git.kernel.org/stable/c/09e649117c54b7e1c004f22eaa19efbadd9ac856" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1c391696d2791f82ae462e11da9a0d96f90b240c", "url": "https://git.kernel.org/stable/c/1c391696d2791f82ae462e11da9a0d96f90b240c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6030597ec683d1e5b46445f888bb5c7776b5a0c4", "url": "https://git.kernel.org/stable/c/6030597ec683d1e5b46445f888bb5c7776b5a0c4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/69a734359639fca16a0dd73ab17a34943e76c68b", "url": "https://git.kernel.org/stable/c/69a734359639fca16a0dd73ab17a34943e76c68b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/93967bfb17dab66642c57e609c99e1a91fe11278", "url": "https://git.kernel.org/stable/c/93967bfb17dab66642c57e609c99e1a91fe11278" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4975f2ff6c82adc24ae547f029f82530ba43cfe", "url": "https://git.kernel.org/stable/c/b4975f2ff6c82adc24ae547f029f82530ba43cfe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e057efcc9c71d90099d9ee00bed0748d0e9fd586", "url": "https://git.kernel.org/stable/c/e057efcc9c71d90099d9ee00bed0748d0e9fd586" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90235", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE\n\nxprtsock replaces and restores sk->sk_data_ready and\nsk->sk_write_space on live sockets with plain stores, and\nxs_udp_do_set_buffer_size() invokes sk->sk_write_space via a plain\nload. These callback pointers are shared with generic socket and\nprotocol paths that may read or invoke them concurrently, so xprtsock\nneeds the same READ_ONCE()/WRITE_ONCE() callback visibility contract\nthat the validated 4022 family applied elsewhere.\n\nWhen SUNRPC takes over an AF_LOCAL, UDP, or TCP socket and later\nrestores the lower-socket callbacks during teardown, another CPU may\nstill hold an earlier callback snapshot. The plain replace/restore\npattern leaves the same visibility hole as the validated 4022 family,\nso a stale snapshot can still invoke xs_data_ready() or\nxs_udp_write_space() after the live callback fields have already been\nrestored to the lower-socket handlers.\n\nUse WRITE_ONCE() for the shared sk_data_ready and sk_write_space\nstores in xs_local_finish_connecting(), xs_udp_finish_connecting(),\nxs_tcp_finish_connecting(), and xs_restore_old_callbacks(). Use\nREAD_ONCE() for the direct sk_write_space invocation in\nxs_udp_do_set_buffer_size(). This matches the required callback\nvisibility contract while leaving adjacent sk_state_change and\nsk_error_report handling unchanged.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90235" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/33930840b5f0a79f826e7c69dc6cd78f72a67481", "url": "https://git.kernel.org/stable/c/33930840b5f0a79f826e7c69dc6cd78f72a67481" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/589f761236e05ff9de1bdfd6a5258f113e6457fe", "url": "https://git.kernel.org/stable/c/589f761236e05ff9de1bdfd6a5258f113e6457fe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d8f0b83753809761a560c4b33249388548ba6e43", "url": "https://git.kernel.org/stable/c/d8f0b83753809761a560c4b33249388548ba6e43" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/da652cb17f9faeea1fa44b7215e8869a0b10b664", "url": "https://git.kernel.org/stable/c/da652cb17f9faeea1fa44b7215e8869a0b10b664" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ed80d009b154aa204f541d390884851b3d4f15ae", "url": "https://git.kernel.org/stable/c/ed80d009b154aa204f541d390884851b3d4f15ae" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80659", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: defer reset until cmd_mutex is unlocked\n\nvub300_cmndwork_thread() holds cmd_mutex while it sends a command and\nwaits for the command response. If the response wait times out,\n__vub300_command_response() kills the command URBs and then synchronously\nresets the USB device through usb_reset_device().\n\nThat reset path re-enters the driver through vub300_pre_reset(), which\nalso takes cmd_mutex. The worker therefore tries to acquire the same\nmutex recursively while it is still holding it from the command path.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the real worker and timeout/reset carrier:\n\n vub300_cmndwork_thread()\n __vub300_command_response()\n usb_lock_device_for_reset()\n usb_reset_device()\n vub300_pre_reset()\n\nLockdep reported the same-task recursive acquisition on cmd_mutex:\n\n WARNING: possible recursive locking detected\n ... (&test_vub300.cmd_mutex) ... at: usb_reset_device... [vuln_msv]\n ... (&test_vub300.cmd_mutex) ... at: vub300_cmndwork_thread+0x12/0x20 [vuln_msv]\n Workqueue: vub300_cmd_wq vub300_cmndwork_thread [vuln_msv]\n *** DEADLOCK ***\n\nReturn a flag from __vub300_command_response() when the timeout path needs\na device reset, then perform the reset after vub300_cmndwork_thread() has\ncleared the in-flight command state and dropped cmd_mutex. The reset is\nstill attempted before mmc_request_done(), preserving the existing request\ncompletion ordering while avoiding the recursive lock.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80659" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2e6b9a394206c76dd417c991312f349435ef35e6", "url": "https://git.kernel.org/stable/c/2e6b9a394206c76dd417c991312f349435ef35e6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7ee7a77ec2f446109ab52cc80ace7acc22ab6211", "url": "https://git.kernel.org/stable/c/7ee7a77ec2f446109ab52cc80ace7acc22ab6211" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8344611477c9241f45f20981990780fc5f0996f8", "url": "https://git.kernel.org/stable/c/8344611477c9241f45f20981990780fc5f0996f8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8672b8bdbd2063b3fcbd75f729e4706fcdad2257", "url": "https://git.kernel.org/stable/c/8672b8bdbd2063b3fcbd75f729e4706fcdad2257" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9f5e04235a0b59e6e30af9f45511addf2604d757", "url": "https://git.kernel.org/stable/c/9f5e04235a0b59e6e30af9f45511addf2604d757" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bf9848a22a8e50d39d5e8d871581f0a8110f16b3", "url": "https://git.kernel.org/stable/c/bf9848a22a8e50d39d5e8d871581f0a8110f16b3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c2e1d33929565fa14c48d8a5a45edc3ebfc941b2", "url": "https://git.kernel.org/stable/c/c2e1d33929565fa14c48d8a5a45edc3ebfc941b2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee5fb641c4ccac8406c668d3e947eb20ce44f233", "url": "https://git.kernel.org/stable/c/ee5fb641c4ccac8406c668d3e947eb20ce44f233" } ], "release_date": "2026-08-28T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-63921", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().\n\nAfter patch 1/2 in this series, vti6_update() unlinks and relinks\nthe tunnel through t->net. vti6_siocdevprivate() still uses\ndev_net(dev) for the collision lookup. For a tunnel moved through\nIFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net.\n\nSIOCCHGTUNNEL on a migrated tunnel then runs:\n\n net = dev_net(dev) /* migrated netns */\n t = vti6_locate(net, &p1, false) /* misses target in t->net */\n ...\n t = netdev_priv(dev)\n vti6_update(t, &p1, false) /* mutates t->net's hash */\n\nA caller in the migrated netns picks params that match a tunnel\nin the creation netns. The lookup in dev_net(dev) finds nothing.\nvti6_update() prepends the migrated tunnel at the head of the\ncreation netns hash bucket for those params. Later lookups in\nthe creation netns resolve to the migrated device. xfrm receive\ndelivers the matched packets through a device the caller controls.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts.\n\nSwitch the SIOCCHGTUNNEL path on a non fallback device to use\nt->net for the lookup. The lookup now matches the netns\nvti6_update() operates on.\n\nAlso add ns_capable(self->net->user_ns, CAP_NET_ADMIN) before\nthe lookup. The check at the top of the case is against\ndev_net(dev)->user_ns, which after migration is the attacker's\nnetns. A caller there can pick params absent from self->net,\nthe lookup returns NULL, t becomes self, and vti6_update()\ninserts the device into the creation netns hash. The new check\nrequires CAP_NET_ADMIN in the creation netns user_ns too.\n\nSIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep\ndev_net(dev), which equals init_net there.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-63921" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33", "url": "https://git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906", "url": "https://git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab", "url": "https://git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838", "url": "https://git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6", "url": "https://git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941", "url": "https://git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011", "url": "https://git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf", "url": "https://git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf" } ], "release_date": "2026-07-19T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80819", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept\n\nrfcomm_sock_recvmsg() completes a deferred setup by calling\nrfcomm_dlc_accept() without holding any RFCOMM lock:\n\n\tif (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {\n\t\trfcomm_dlc_accept(d);\n\t\treturn 0;\n\t}\n\nand rfcomm_dlc_accept() dereferences the session on its first line:\n\n\tstruct sock *sk = d->session->sock->sk;\n\nEvery other path that touches d->session runs under rfcomm_mutex:\nrfcomm_dlc_open(), rfcomm_dlc_close(), rfcomm_dlc_exists(),\nrfcomm_dlc_send_rpn(), and the RFCOMM thread through\nrfcomm_process_sessions(). rfcomm_connect_ind() is even documented as\n\"called under rfcomm_lock()\". This call site is the only one that skips\nit.\n\nThe RFCOMM_DEFER_SETUP bit looks like it serialises the accept against\nteardown, since __rfcomm_dlc_close() returns early when it wins the\ntest_and_clear. But rfcomm_recv_disc() forces the state first:\n\n\td->state = BT_CLOSED;\n\t__rfcomm_dlc_close(d, err);\n\nand the early return only covers BT_CONNECT, BT_CONFIG, BT_OPEN and\nBT_CONNECT2. With the state already BT_CLOSED that switch does not\nmatch, the bit is never consulted, and __rfcomm_dlc_close() falls\nthrough to rfcomm_dlc_unlink(), which sets d->session = NULL.\n\nSo a remote DISC on a deferred dlc clears the session while leaving\nRFCOMM_DEFER_SETUP set. The next recvmsg() then passes the\ntest_and_clear and dereferences a NULL session. No timing window is\nneeded: once the DISC has been processed, the dereference is\nunconditional.\n\nGive rfcomm_dlc_accept() the same shape as rfcomm_dlc_open() and\nrfcomm_dlc_close(): an exported wrapper that takes rfcomm_mutex and\nre-checks the session, around a __rfcomm_dlc_accept() that the two\nin-core callers, which already hold the mutex, keep using.\n\nReproduced on a KASAN + PROVE_LOCKING kernel with a BR/EDR peer emulated\nover /dev/vhci: the peer brings up an ACL link, opens L2CAP on the\nRFCOMM PSM, starts a session, opens a dlc on a channel bound with\nBT_DEFER_SETUP, and sends DISC after the socket is accepted. recv() on\nthe accepted socket then hits:\n\n Oops: general protection fault\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n RIP: 0010:rfcomm_dlc_accept+0x54/0x350\n Call Trace:\n rfcomm_sock_recvmsg+0x1cd/0x230\n sock_recvmsg+0x166/0x1c0\n __sys_recvfrom+0x20d/0x300\n\n0x10 is the offset of sock in struct rfcomm_session. With this patch the\nsame run completes with recv() returning 0 and no report, and lockdep\nstays quiet, confirming rfcomm_mutex is still taken before lock_sock on\nthis path as it is on the thread side.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80819" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/355bfd57ca4ca881c6eb03ca813b440a094b1f44", "url": "https://git.kernel.org/stable/c/355bfd57ca4ca881c6eb03ca813b440a094b1f44" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/362726c9c6e56eea4262109183e49868c39ccd3a", "url": "https://git.kernel.org/stable/c/362726c9c6e56eea4262109183e49868c39ccd3a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/43a556b2fd43f2df6dded59c2e26560a27874c24", "url": "https://git.kernel.org/stable/c/43a556b2fd43f2df6dded59c2e26560a27874c24" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/56f0aa75c7640e46397ef73bea251fcbef9150c0", "url": "https://git.kernel.org/stable/c/56f0aa75c7640e46397ef73bea251fcbef9150c0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/825b95561d7b7c393df9e7bc295451aaeadc3d18", "url": "https://git.kernel.org/stable/c/825b95561d7b7c393df9e7bc295451aaeadc3d18" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b405c2f96ae2e37375105881890f7738833b1d62", "url": "https://git.kernel.org/stable/c/b405c2f96ae2e37375105881890f7738833b1d62" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d4b1a13b1eff2e80925c7368ffdeaaa50cba93df", "url": "https://git.kernel.org/stable/c/d4b1a13b1eff2e80925c7368ffdeaaa50cba93df" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d8d686dd5662a7c4745e4515f1237a9f3b7df181", "url": "https://git.kernel.org/stable/c/d8d686dd5662a7c4745e4515f1237a9f3b7df181" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eb71d5a1ea8ff2683e394b48ae3cd676037ab4c2", "url": "https://git.kernel.org/stable/c/eb71d5a1ea8ff2683e394b48ae3cd676037ab4c2" } ], "release_date": "2026-09-04T16:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64465", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix sleep in atomic context in xhci_free_streams()\n\nWhen a USB device with active stream endpoints is disconnected,\nxhci_free_streams() is called from the hub_event workqueue to\nfree the stream resources. It calls xhci_free_stream_info()\nwhile holding xhci->lock with irqs disabled.\n\nxhci_free_stream_info() invokes xhci_free_stream_ctx(), which\ncalls dma_free_coherent() for large stream context arrays.\n\ndma_free_coherent() can sleep (e.g. via vunmap), triggering\na BUG when called from atomic context.\n\nCall trace:\n dma_free_attrs+0x174/0x220\n xhci_free_stream_info+0xd0/0x11c\n xhci_free_streams+0x278/0x37c\n usb_free_streams+0x98/0xc0\n usb_unbind_interface+0x1b8/0x2f8\n device_release_driver_internal+0x1d4/0x2cc\n device_release_driver+0x18/0x28\n bus_remove_device+0x160/0x1a4\n device_del+0x1ec/0x350\n usb_disable_device+0x98/0x214\n usb_disconnect+0xf0/0x35c\n hub_event+0xab4/0x19ec\n process_one_work+0x278/0x63c\n\nFix this by saving the stream_info pointers and clearing the\nep references under the lock, then calling xhci_free_stream_info()\noutside the lock where sleeping is allowed.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64465" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/10666ac9c552990204e791af653abf8e9d9ff619", "url": "https://git.kernel.org/stable/c/10666ac9c552990204e791af653abf8e9d9ff619" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1e45aa722c4ce5663e987102aac18c8ad6a83fdd", "url": "https://git.kernel.org/stable/c/1e45aa722c4ce5663e987102aac18c8ad6a83fdd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/42c37c4b75d38b51d84f31a8e29427f5e06a7c2a", "url": "https://git.kernel.org/stable/c/42c37c4b75d38b51d84f31a8e29427f5e06a7c2a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/93cd037da94fcb93183bfb2457e3a56d3eb4c8f4", "url": "https://git.kernel.org/stable/c/93cd037da94fcb93183bfb2457e3a56d3eb4c8f4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d107eb316144c5fb958486e7fe604cd7f1b35cda", "url": "https://git.kernel.org/stable/c/d107eb316144c5fb958486e7fe604cd7f1b35cda" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e623e4a203f56d5c57519a9a3cb29600551534ad", "url": "https://git.kernel.org/stable/c/e623e4a203f56d5c57519a9a3cb29600551534ad" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f7b022ae07685e7526fc39f387ce65b5d309dd3b", "url": "https://git.kernel.org/stable/c/f7b022ae07685e7526fc39f387ce65b5d309dd3b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f90586129cf9e1fbdb718ef602eea3f15dc1c31c", "url": "https://git.kernel.org/stable/c/f90586129cf9e1fbdb718ef602eea3f15dc1c31c" } ], "release_date": "2026-07-25T10:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-26T01:09:24.032380Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962", "product_ids": [ "CentOS-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els1.noarch", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.i686", "CentOS-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1792976962" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }