{
"document": {
"aggregate_severity": {
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "TuxCare License Agreement",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
"title": "Terms of Use"
},
{
"category": "details",
"text": "wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex {CVE-2023-53715}\n- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver {CVE-2026-98406}\n- wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE {CVE-2026-98827}\n- ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}\n- RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path {CVE-2026-74377}\n- gfs2: fix use-after-free in gfs2_qd_dealloc {CVE-2026-63804}\n- smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() {CVE-2026-97563}\n- inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}\n- ACPI: platform: Use acpi_bus_get_primary_device() {CVE-2026-100072}\n- ALSA: usb: 6fire: Avoid embedded URBs {CVE-2026-98428}\n- crypto: qat - fix DMA transfer direction {CVE-2022-50774}\n- scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot {CVE-2026-98386}\n- scsi: libiscsi_tcp: Check the data direction of a Data-In PDU {CVE-2026-98479}\n- net: iptunnel: fix stale transport header during tunnel decapsulation {CVE-2026-98401}\n- drop_monitor: fix out-of-bounds write in reset_per_cpu_data() {CVE-2026-98419}\n- wifi: mac80211: don't warn when an IBSS has no channel to scan {CVE-2026-98425}\n- net/sched: codel: bound the dropping loop per dequeue call {CVE-2026-98427}\n- net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393}\n- Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461}\n- Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}\n- Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}\n- net: openvswitch: conntrack: fix helper UAF due to extensions realloc {CVE-2026-98490}\n- net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry {CVE-2026-98491}\n- Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough {CVE-2026-98602}\n- Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown {CVE-2026-98734}\n- Bluetooth: hci_core: Serialize ACL scheduling with channel deletion {CVE-2026-98735}\n- ipvs: filter some flags received in the backup server {CVE-2026-98794}\n- sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}\n- USB: serial: fix port tear down use-after-free {CVE-2026-98772}\n- perf: Fix addr_filter_ranges lifetime {CVE-2026-93817}\n- thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}\n- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}\n- fbcon: Avoid OOB font access if console rotation fails {CVE-2026-46191}\n- security/keys: fix missed RCU read section on lookup {CVE-2026-64015}\n- KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() {CVE-2026-63806}\n- kdb: Fix buffer overflow during tab-complete {CVE-2024-39480}\n- HID: appleir: fix UAF on pending key_up_timer in remove() {CVE-2026-64363}\n- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list {CVE-2026-53230}\n- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887}\n- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888}\n- wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180}\n- fuse: re-lock request before replacing page cache folio {CVE-2026-53388}\n- nfsd: fix posix_acl leak on SETACL decode failure {CVE-2026-53397}\n- nfsd: release layout stid on setlease failure {CVE-2026-53399}\n- ubi: Fix use-after-free when volume resizing failed {CVE-2023-53800}\n- mrp: introduce active flags to prevent UAF when applicant uninit {CVE-2022-50697}\n- svcrdma: Reject Read lists that exceed the page budget {CVE-2026-89528}\n- svcrdma: Reject inline replies that overflow the pull-up buffer {CVE-2026-89530}\n- svcrdma: Fix double svc_rdma_send_ctxt_put() in an error path {CVE-2026-89530}\n- libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}\n- libceph: replace BUG_ON with bounds check for map->max_osd {CVE-2025-68283}\n- net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}\n- netpoll: fix a use-after-free on shutdown path {CVE-2026-64424}\n- sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}\n- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}\n- ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}\n- ip6: vti: Use ip6_tnl.net in vti6_changelink(). {CVE-2026-63917}\n- net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen {CVE-2026-74267}\n- ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289}\n- net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}\n- net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}\n- ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}\n- net/sched: defer qdisc freeing after failed creation {CVE-2026-98017}\n- sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}\n- xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}\n- net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}\n- Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}\n- ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500}\n- ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207}\n- block: mtip32xx: synchronize ioctls with device removal {CVE-2026-90180}\n- lockd, nfsd: RCU-protect nlmsvc_ops dispatch {CVE-2026-89709}\n- md: do overflow check for sb->bblog_shift in super_1_load() {CVE-2026-89557}\n- ipvs: fix the checksum validations {CVE-2026-80901}\n- selinux: require every boolean value to be defined {CVE-2026-80913}\n- params: fix charp corruption on allocation failure {CVE-2026-89552}\n- scsi: qla2xxx: Fix premature hw access after PCI error {CVE-2022-49157}\n- crypto: api - Use work queue in crypto_destroy_instance {CVE-2023-53799}\n- posix-timers: Ensure timer ID search-loop limit is valid {CVE-2023-53728}\n- dccp: fix data-race around dp->dccps_mss_cache {CVE-2023-53839}\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() {CVE-2026-80829}\n- nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE {CVE-2026-89665}\n- nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown {CVE-2026-89708}\n- ceph: fix UAF in check_new_map() on session freed during unlock {CVE-2026-89654}\n- nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}\n- SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537}\n- af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742}\n- ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}\n- fbdev: fix use-after-free in store_modes() {CVE-2026-63826}\n- sctp: add INIT verification after cookie unpacking {CVE-2026-72398}\n- ipvs: fix more places with wrong ipv6 transport offsets {CVE-2026-68477}\n- scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}\n- netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types {CVE-2026-72436}\n- net: lock the socket in sock_gettstamp() {CVE-2026-98276}\n- btrfs: do not allow relocation of partially dropped subvolumes {CVE-2025-39738}\n- bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}\n- media: pwc: Return queued buffers on start_streaming() failure {CVE-2026-68216}",
"title": "Details"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://tuxcare.com/contact/",
"name": "TuxCare",
"namespace": "https://tuxcare.com/"
},
"references": [
{
"category": "self",
"summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux7els/advisories/2026/clsa-2026_1793353561.json"
}
],
"tracking": {
"current_release_date": "2026-10-30T09:51:45Z",
"generator": {
"date": "2026-10-30T09:51:45Z",
"engine": {
"name": "pyCSAF"
}
},
"id": "CLSA-2026:1793353561",
"initial_release_date": "2026-10-30T09:51:45Z",
"revision_history": [
{
"date": "2026-10-30T09:51:45Z",
"number": "1",
"summary": "Initial version"
}
],
"status": "final",
"version": "1"
},
"title": "kernel: Fix of 90 CVEs"
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Oracle Linux 7",
"product": {
"name": "Oracle Linux 7",
"product_id": "Oracle-Linux-7",
"product_identification_helper": {
"cpe": "cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_family",
"name": "Oracle Linux"
}
],
"category": "vendor",
"name": "Oracle Corporation"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product": {
"name": "kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_id": "kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/kernel-tools@3.10.0-1160.167.2.el7.tuxcare.els2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product": {
"name": "kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_id": "kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/kernel-debug@3.10.0-1160.167.2.el7.tuxcare.els2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product": {
"name": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_id": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/kernel-headers@3.10.0-1160.167.2.el7.tuxcare.els2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product": {
"name": "kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_id": "kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/kernel-debug-devel@3.10.0-1160.167.2.el7.tuxcare.els2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product": {
"name": "kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_id": "kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/kernel-devel@3.10.0-1160.167.2.el7.tuxcare.els2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product": {
"name": "perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_id": "perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/perf@3.10.0-1160.167.2.el7.tuxcare.els2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product": {
"name": "kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_id": "kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/kernel-tools-libs@3.10.0-1160.167.2.el7.tuxcare.els2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product": {
"name": "bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_id": "bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/bpftool@3.10.0-1160.167.2.el7.tuxcare.els2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product": {
"name": "kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_id": "kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/kernel-tools-libs-devel@3.10.0-1160.167.2.el7.tuxcare.els2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product": {
"name": "python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_id": "python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/python-perf@3.10.0-1160.167.2.el7.tuxcare.els2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product": {
"name": "kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_id": "kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/kernel@3.10.0-1160.167.2.el7.tuxcare.els2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"product": {
"name": "kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"product_id": "kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/kernel-doc@3.10.0-1160.167.2.el7.tuxcare.els2?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"product": {
"name": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"product_id": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"product_identification_helper": {
"purl": "pkg:rpm/tuxcare/kernel-headers@3.10.0-1160.167.2.el7.tuxcare.els2?arch=i686"
}
}
}
],
"category": "architecture",
"name": "i686"
}
],
"category": "vendor",
"name": "TuxCare"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
},
"product_reference": "kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"relates_to_product_reference": "Oracle-Linux-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
},
"product_reference": "kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"relates_to_product_reference": "Oracle-Linux-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch"
},
"product_reference": "kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"relates_to_product_reference": "Oracle-Linux-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
},
"product_reference": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"relates_to_product_reference": "Oracle-Linux-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686 as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686"
},
"product_reference": "kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"relates_to_product_reference": "Oracle-Linux-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
},
"product_reference": "kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"relates_to_product_reference": "Oracle-Linux-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
},
"product_reference": "kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"relates_to_product_reference": "Oracle-Linux-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
},
"product_reference": "perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"relates_to_product_reference": "Oracle-Linux-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
},
"product_reference": "kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"relates_to_product_reference": "Oracle-Linux-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
},
"product_reference": "bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"relates_to_product_reference": "Oracle-Linux-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
},
"product_reference": "kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"relates_to_product_reference": "Oracle-Linux-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
},
"product_reference": "python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"relates_to_product_reference": "Oracle-Linux-7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64 as a component of Oracle Linux 7",
"product_id": "Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
},
"product_reference": "kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"relates_to_product_reference": "Oracle-Linux-7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-97940",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix fib6 walker UAF on seq stop\n\nipv6_route_iter_active() treats a walker in FWS_U at the table root as\nalready unlinked. fib6_del_route() can move a still-linked walker into\nthat same state when the current leaf is the last route at the root,\nso ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq\nprivate object can then be freed while it remains on\nnet->ipv6.fib6_walkers. A later route deletion walks the dangling list\nand uses the freed walker.\n\nUse the list head as membership state and reinitialize it when\nunlinking. Keep the existing w->node check so a never-started iterator\nwith a zeroed private object is not treated as linked.\n\nThe same stop helper is used by /proc/net/ipv6_route and by the BPF\nipv6_route iterator. The BPF show path only widens the race.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-97940"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/05b687ee04f816658f4a9cf586f4d2f129157943",
"url": "https://git.kernel.org/stable/c/05b687ee04f816658f4a9cf586f4d2f129157943"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0eede1689610e9eeaf729ba86fd1321799eb91a0",
"url": "https://git.kernel.org/stable/c/0eede1689610e9eeaf729ba86fd1321799eb91a0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/14fdaba201fdff92a3e45994e02bccda409cb19d",
"url": "https://git.kernel.org/stable/c/14fdaba201fdff92a3e45994e02bccda409cb19d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/19b4ed644d68098cc62ab612727f40d30f43476c",
"url": "https://git.kernel.org/stable/c/19b4ed644d68098cc62ab612727f40d30f43476c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02",
"url": "https://git.kernel.org/stable/c/4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/63407cddabc5992b5ac03af165559f4a1968a032",
"url": "https://git.kernel.org/stable/c/63407cddabc5992b5ac03af165559f4a1968a032"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/9a3f73d62c86271614eda4c43315230896a37018",
"url": "https://git.kernel.org/stable/c/9a3f73d62c86271614eda4c43315230896a37018"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b89b691dd00bf39b9ba39ab9446f8c62f419fa7b",
"url": "https://git.kernel.org/stable/c/b89b691dd00bf39b9ba39ab9446f8c62f419fa7b"
}
],
"release_date": "2026-09-25T11:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-53136",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp VBIOS HDMI retimer register count to array size\n\n[Why & How]\nThe VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and\nHdmi6GRegNum fields that are used as loop bounds when copying retimer I2C\nregister settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9]\nand dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated\nbefore use, so a malformed VBIOS can specify values up to 255, causing an\nout-of-bounds heap write during driver probe.\n\nClamp each register count to the destination array size using min_t()\nbefore the copy loops, in both get_integrated_info_v11() and\nget_integrated_info_v2_1().\n\n(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)",
"title": "Vulnerability description"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-53136"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/029571d51140650783be4fb98fe7cb4754752086",
"url": "https://git.kernel.org/stable/c/029571d51140650783be4fb98fe7cb4754752086"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3f32d52ec604c659725d865cf8cc6a17a33f9c6a",
"url": "https://git.kernel.org/stable/c/3f32d52ec604c659725d865cf8cc6a17a33f9c6a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4d1c3c26c2ab1842e139e61983395d64bd2e518b",
"url": "https://git.kernel.org/stable/c/4d1c3c26c2ab1842e139e61983395d64bd2e518b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5f8b39452fb16f507c9e4d8b4a83ce27e893307c",
"url": "https://git.kernel.org/stable/c/5f8b39452fb16f507c9e4d8b4a83ce27e893307c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117",
"url": "https://git.kernel.org/stable/c/8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d6be8e59af412623e3d874be3a048406c0edfe60",
"url": "https://git.kernel.org/stable/c/d6be8e59af412623e3d874be3a048406c0edfe60"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/fb0707ce00eef4e2d60c3020e1c0432739703e4a",
"url": "https://git.kernel.org/stable/c/fb0707ce00eef4e2d60c3020e1c0432739703e4a"
}
],
"release_date": "2026-06-25T09:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
]
},
{
"cve": "CVE-2026-53230",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list\n\nmlx5_query_nic_vport_mac_list() sizes its firmware command buffer using\nthe PF's log_max_current_uc/mc_list capabilities. When querying a VF\nvport with a larger configured max (via devlink), the firmware response\ncan overflow this buffer:\n\n BUG: KASAN: slab-out-of-bounds in mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core]\n Read of size 4 at addr ff1100013ffc8a12 by task kworker/u96:2/385\n\n CPU: 12 UID: 0 PID: 385 Comm: kworker/u96:2 Not tainted 7.0.0-rc6+ #1 PREEMPT\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)\n Workqueue: mlx5_esw_wq esw_vport_change_handler [mlx5_core]\n Call Trace:\n \n dump_stack_lvl+0x69/0xa0\n print_report+0x176/0x4e4\n kasan_report+0xc8/0x100\n mlx5_query_nic_vport_mac_list+0x453/0x4c0 [mlx5_core]\n esw_update_vport_addr_list+0x2e3/0xda0 [mlx5_core]\n esw_vport_change_handle_locked+0xa1f/0x1060 [mlx5_core]\n esw_vport_change_handler+0x6a/0x90 [mlx5_core]\n process_one_work+0x87f/0x15e0\n worker_thread+0x62b/0x1020\n kthread+0x375/0x490\n ret_from_fork+0x4dc/0x810\n ret_from_fork_asm+0x11/0x20\n \n\nFix by querying the vport's own HCA caps to size the buffer correctly.\nRefactor the function to allocate and return the MAC list internally,\nremoving the caller's dependency on knowing the correct max.",
"title": "Vulnerability description"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-53230"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0f807764bb122fd63aa45f4229cb1ef2679fbd40",
"url": "https://git.kernel.org/stable/c/0f807764bb122fd63aa45f4229cb1ef2679fbd40"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2398e497389ed4be43f7cfbab499b49cec7dae1a",
"url": "https://git.kernel.org/stable/c/2398e497389ed4be43f7cfbab499b49cec7dae1a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/41781f2789309462520a93822e946521ed78f97f",
"url": "https://git.kernel.org/stable/c/41781f2789309462520a93822e946521ed78f97f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/537d87784e81c3d7037525b99416455cee088cdc",
"url": "https://git.kernel.org/stable/c/537d87784e81c3d7037525b99416455cee088cdc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/894e036a24a26a6dd7b17d8d3fb5c53ab48a6074",
"url": "https://git.kernel.org/stable/c/894e036a24a26a6dd7b17d8d3fb5c53ab48a6074"
}
],
"release_date": "2026-06-25T09:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
]
},
{
"cve": "CVE-2026-74387",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: midi: Serialize output teardown with event_input\n\nevent_process_midi() borrows msynth->output_rfile.output and then\npasses the substream to dump_midi() and snd_rawmidi_kernel_write()\nwithout synchronizing with the output open/close transition.\nmidisynth_use() also publishes output_rfile before\nsnd_rawmidi_output_params() has finished.\n\nThe last midisynth_unuse() can therefore release the same rawmidi file\nand free substream->runtime before snd_rawmidi_kernel_write1() takes\nits runtime buffer reference. That leaves the event_input path using a\nstale substream or runtime and can end in a NULL-deref or use-after-free.\n\nFix this with two pieces of synchronization. Keep a short IRQ-safe\nspinlock only for publishing or clearing output_rfile and for pairing\nthe output snapshot with an snd_use_lock_t reference. Once\nevent_process_midi() has taken that in-flight reference, it drops the\nspinlock before calling snd_seq_dump_var_event(), dump_midi(), or\nsnd_rawmidi_kernel_write(). midisynth_unuse() now detaches the visible\nrawmidi file under the same spinlock, waits for the in-flight writers\nto drain, and only then drains and releases the saved file.\nmidisynth_use() likewise opens into a local snd_rawmidi_file and\npublishes it only after snd_rawmidi_output_params() succeeds.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nevent_input path: last unuse path:\n1. event_process_midi() snapshots 1. midisynth_unuse() starts\n output_rfile.output. tearing down output_rfile.\n2. dump_midi() reaches 2. snd_rawmidi_kernel_release()\n snd_rawmidi_kernel_write() closes the output file.\n before runtime is pinned. 3. close_substream() frees\n3. The callback keeps using substream->runtime.\n the borrowed substream.\n\nValidation reproduced this kernel report:\nKASAN null-ptr-deref in snd_rawmidi_kernel_write1+0x56/0x360\nRIP: 0033:0x7fde7dd0837f\nRIP: 0010:snd_rawmidi_kernel_write1+0x56/0x360",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-74387"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/11165fe2c5ea0516debe486d91df67abbe36905e",
"url": "https://git.kernel.org/stable/c/11165fe2c5ea0516debe486d91df67abbe36905e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/718f6a56b40875f19e6915799044a02df9abfd52",
"url": "https://git.kernel.org/stable/c/718f6a56b40875f19e6915799044a02df9abfd52"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/936641af564c3d92721704b781e36aaf223efdd2",
"url": "https://git.kernel.org/stable/c/936641af564c3d92721704b781e36aaf223efdd2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d6fd2afb137f52bf00c5210cc44d08ed54dcffb4",
"url": "https://git.kernel.org/stable/c/d6fd2afb137f52bf00c5210cc44d08ed54dcffb4"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ef7607ab1c8adc6258fb1b27d08e26aecdc18a58",
"url": "https://git.kernel.org/stable/c/ef7607ab1c8adc6258fb1b27d08e26aecdc18a58"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f5d470b808bc01f70978e22e595c6f7768313406",
"url": "https://git.kernel.org/stable/c/f5d470b808bc01f70978e22e595c6f7768313406"
}
],
"release_date": "2026-08-15T06:22:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-92500",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: use fsdata to track inline data write state and fix race\n\nInstead of checking the live inode state (ext4_has_inline_data(inode)\nand ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) in the\nwrite_end handlers, use the fsdata parameter of the address space\noperations to explicitly pass down the state in which write_begin\nprepared the write.\n\nA concurrent thread (such as ext4_page_mkwrite()) can convert the\ninline data to an extent between write_begin and write_end. If this\nhappens, the write_end handlers would previously miss the inline\nwrite_end path and fall through to extent-based write_end logic.\nHowever, since block buffers were never allocated in write_begin,\nthis resulted in NULL pointer dereferences or data loss because\nfolio_buffers(folio) was NULL.\n\nDefine EXT4_WRITE_DATA_INLINE (4) as a bit flag (Bit 2), treating\nfsdata as bitwise flags rather than mutually exclusive enums to keep\nstates of the write path independent. Communicate this state via\nfsdata:\n1) ext4_write_begin() and ext4_da_write_begin() set the\n EXT4_WRITE_DATA_INLINE bit in *fsdata via bitwise OR when an inline\n write is successfully prepared.\n2) On entry, ext4_write_begin() clears the EXT4_WRITE_DATA_INLINE bit\n to safely handle VFS retries (where generic_perform_write() bypasses\n the fsdata initialization on its retry jump).\n3) The write_end handlers perform a bitwise AND to check if the\n EXT4_WRITE_DATA_INLINE bit is set and invoke the inline write_end\n helper accordingly.\n\nFurthermore, during a buffered write, ext4_write_inline_data_end()\nacquires the xattr lock after preparing the write. If a concurrent\npage fault (ext4_page_mkwrite()) converts the inline data to an extent\nafter the write_end handlers check the state but before\next4_write_inline_data_end() acquires the xattr write lock, the\nsubsequent check will trigger a kernel panic via\nBUG_ON(!ext4_has_inline_data(inode)).\n\nTo keep git history working and bisectability clean, replace the\nBUG_ON check in ext4_write_inline_data_end() with a graceful error-\nhandling retry path in this same commit. If the inline data is cleared\nafter locking the xattr, we safely release all resources (releasing\niloc.bh, unlocking/putting the folio, stopping the active journal\ntransaction handle) and return 0 (VFS retry) to let the generic write\npath retry the operation safely.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-92500"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/439aedfd7ae868d1d7b4930afe66091cb979cd5c",
"url": "https://git.kernel.org/stable/c/439aedfd7ae868d1d7b4930afe66091cb979cd5c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7edbb323bab2b2a609016014caafdb651c898249",
"url": "https://git.kernel.org/stable/c/7edbb323bab2b2a609016014caafdb651c898249"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bd8d74bd46d09905164255b8635fa58b45f41068",
"url": "https://git.kernel.org/stable/c/bd8d74bd46d09905164255b8635fa58b45f41068"
}
],
"release_date": "2026-09-17T17:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-74289",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: Don't dump dying fib_info in fib_leaf_notify().\n\nsyzbot reported use-after-free in nsim_fib4_prepare_event(). [0]\n\nThe problem is that the following functions call fib_info_hold() /\nrefcount_inc() while dumping fib_info under RCU, which is unsafe.\n\n * mlxsw_sp_router_fib4_event()\n * rocker_router_fib_event()\n * nsim_fib4_prepare_event()\n\nrefcount_inc_not_zero() must be used, but it would be too late\nthere.\n\nLet's guarantee the lifetime of fib_info in fib_leaf_notify().\n\nNote that IPv6 does not need the corresponding change since\nfib6_table_dump() holds fib6_table.tb6_lock.\n\n[0]:\nrefcount_t: addition on 0; use-after-free.\nWARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#0: kworker/u8:15/3420\nModules linked in:\nCPU: 0 UID: 0 PID: 3420 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026\nWorkqueue: netns cleanup_net\nRIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25\nCode: eb 66 85 db 74 3e 83 fb 01 75 4c e8 1b f1 22 fd 48 8d 3d 84 cb f1 0a 67 48 0f b9 3a eb 4a e8 08 f1 22 fd 48 8d 3d 81 cb f1 0a <67> 48 0f b9 3a eb 37 e8 f5 f0 22 fd 48 8d 3d 7e cb f1 0a 67 48 0f\nRSP: 0018:ffffc9000f2c7270 EFLAGS: 00010293\nRAX: ffffffff84a18858 RBX: 0000000000000002 RCX: ffff888032ff9ec0\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8f9353e0\nRBP: 0000000000000000 R08: ffff888032ff9ec0 R09: 0000000000000005\nR10: 0000000000000100 R11: 0000000000000004 R12: ffff8880570cc000\nR13: dffffc0000000000 R14: ffff88802b40563c R15: ffff8880570cc000\nFS: 0000000000000000(0000) GS:ffff888126173000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fb1f4d5d000 CR3: 000000006072a000 CR4: 00000000003526f0\nCall Trace:\n \n __refcount_add include/linux/refcount.h:-1 [inline]\n __refcount_inc include/linux/refcount.h:366 [inline]\n refcount_inc include/linux/refcount.h:383 [inline]\n fib_info_hold include/net/ip_fib.h:629 [inline]\n nsim_fib4_prepare_event drivers/net/netdevsim/fib.c:930 [inline]\n nsim_fib_event_schedule_work drivers/net/netdevsim/fib.c:1000 [inline]\n nsim_fib_event_nb+0x1055/0x1240 drivers/net/netdevsim/fib.c:1043\n call_fib_notifier+0x45/0x80 net/core/fib_notifier.c:25\n call_fib_entry_notifier net/ipv4/fib_trie.c:90 [inline]\n fib_leaf_notify net/ipv4/fib_trie.c:2176 [inline]\n fib_table_notify net/ipv4/fib_trie.c:2194 [inline]\n fib_notify+0x36b/0x5e0 net/ipv4/fib_trie.c:2217\n fib_net_dump net/core/fib_notifier.c:70 [inline]\n register_fib_notifier+0x184/0x360 net/core/fib_notifier.c:108\n nsim_fib_create+0x85d/0x9f0 drivers/net/netdevsim/fib.c:1596\n nsim_dev_reload_create drivers/net/netdevsim/dev.c:1604 [inline]\n nsim_dev_reload_up+0x374/0x7c0 drivers/net/netdevsim/dev.c:1058\n devlink_reload+0x501/0x8d0 net/devlink/dev.c:475\n devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:558\n ops_pre_exit_list net/core/net_namespace.c:161 [inline]\n ops_undo_list+0x187/0x940 net/core/net_namespace.c:234\n cleanup_net+0x56e/0x800 net/core/net_namespace.c:702\n process_one_work kernel/workqueue.c:3314 [inline]\n process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397\n worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478\n kthread+0x388/0x470 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n ",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-74289"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/06b693d2eb6651a63ad85bad8673de3b7d4edd6d",
"url": "https://git.kernel.org/stable/c/06b693d2eb6651a63ad85bad8673de3b7d4edd6d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/676482da8d938ea72c26da0fc86af2d2ec238ab2",
"url": "https://git.kernel.org/stable/c/676482da8d938ea72c26da0fc86af2d2ec238ab2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7907a395701b339c2d68f37456d395e953c74795",
"url": "https://git.kernel.org/stable/c/7907a395701b339c2d68f37456d395e953c74795"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7980a13add57f97c5da1dc961d0145a6ad2a7f98",
"url": "https://git.kernel.org/stable/c/7980a13add57f97c5da1dc961d0145a6ad2a7f98"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8bdb20b8a581495062b5879f4e9d435da648b3b0",
"url": "https://git.kernel.org/stable/c/8bdb20b8a581495062b5879f4e9d435da648b3b0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bea03e887db5a8a79234531faf14cf2c4d8816c3",
"url": "https://git.kernel.org/stable/c/bea03e887db5a8a79234531faf14cf2c4d8816c3"
}
],
"release_date": "2026-08-15T06:22:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-53397",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix posix_acl leak on SETACL decode failure\n\nnfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each\ncall nfs_stream_decode_acl() twice, first for NFS_ACL and then for\nNFS_DFACL. Each successful call transfers ownership of a freshly\nallocated posix_acl into argp->acl_access or argp->acl_default. If\nthe first call succeeds but the second fails, the decoder returns\nfalse and argp->acl_access is left dangling.\n\nACLPROC2_SETACL.pc_release was wired to nfssvc_release_attrstat and\nACLPROC3_SETACL.pc_release was wired to nfs3svc_release_fhandle.\nBoth only call fh_put() and have no knowledge of the ACL fields on\nargp. The posix_acl_release() pairs sat at the out: labels inside\nnfsacld_proc_setacl() and nfsd3_proc_setacl(), but svc_process()\nskips pc_func when pc_decode returns false, so that cleanup is\nunreachable on decode failure:\n\n svc_process_common()\n pc_decode() /* decode_setaclargs: false */\n /* pc_func skipped */\n pc_release() /* fh_put only -- ACLs leaked */\n\nThe orphaned posix_acl is leaked for the lifetime of the server.\n\nFix by adding nfsaclsvc_release_setacl() and nfs3svc_release_setacl(),\nwhich release both argp->acl_access and argp->acl_default in addition\nto fh_put(), and wiring them as pc_release for their respective SETACL\nprocedures. pc_release runs on every path svc_process() takes after\ndecode, including decode failure, so the posix_acl_release() pairs are\nremoved from the proc functions' out: labels to keep ownership in one\nplace. This matches the existing release_getacl() pattern used by\nthe sibling GETACL procedures.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-53397"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0853ac544c590880d797b04daa33fcb72b6be0e1",
"url": "https://git.kernel.org/stable/c/0853ac544c590880d797b04daa33fcb72b6be0e1"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/136b416593f1349cf6f72c8e3d18f0f204ee8545",
"url": "https://git.kernel.org/stable/c/136b416593f1349cf6f72c8e3d18f0f204ee8545"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1e96239fddcefacf6afe6c498357be68eacbcabc",
"url": "https://git.kernel.org/stable/c/1e96239fddcefacf6afe6c498357be68eacbcabc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/887f92ceccf3eacd5f2402db21254d66372fae00",
"url": "https://git.kernel.org/stable/c/887f92ceccf3eacd5f2402db21254d66372fae00"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a5b42c1e4ff2befaa6b96f7cbf32174751eba083",
"url": "https://git.kernel.org/stable/c/a5b42c1e4ff2befaa6b96f7cbf32174751eba083"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b2eb1ffd511d1b3c3e21122f97cbbccea411e277",
"url": "https://git.kernel.org/stable/c/b2eb1ffd511d1b3c3e21122f97cbbccea411e277"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b94c4be77682aab06d65ca7296149e3bcfb37353",
"url": "https://git.kernel.org/stable/c/b94c4be77682aab06d65ca7296149e3bcfb37353"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bd69a825485168ef74e815ecb286754b570fdcc7",
"url": "https://git.kernel.org/stable/c/bd69a825485168ef74e815ecb286754b570fdcc7"
}
],
"release_date": "2026-07-19T12:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98401",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: iptunnel: fix stale transport header during tunnel decapsulation\n\nSyzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale\ntransport_header offset after tunnel decapsulation.\n\nBUG: unable to handle page fault for address: ffffed102091a42e\nOops: Oops: 0000 [#1] SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 340 Comm: qdisc_uaf_repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:__asan_load2\n\nqdisc_pkt_len_segs_init (net/core/dev.c:4145)\n__dev_queue_xmit (net/core/dev.c:4787)\nbr_dev_queue_push_xmit (net/bridge/br_forward.c:53)\nbr_handle_frame_finish (net/bridge/br_input.c:229)\nbr_handle_frame (net/bridge/br_input.c:315)\n__netif_receive_skb_core.constprop.0 (net/core/dev.c:6099)\n__netif_receive_skb_list_core (net/core/dev.c:6287)\nnetif_receive_skb_list_internal (net/core/dev.c:6445)\nnapi_complete_done (net/core/dev.c:6813)\ngro_cell_poll (net/core/gro_cells.c:74)\n__napi_poll (net/core/dev.c:7735)\nnet_rx_action (net/core/dev.c:7798 net/core/dev.c:7955)\nhandle_softirqs (kernel/softirq.c:622)\ndo_softirq (kernel/softirq.c:523 kernel/softirq.c:510 )\n__local_bh_enable_ip (kernel/softirq.c:450)\ntun_get_user (drivers/net/tun.c:1986 (discriminator 1))\ntun_chr_write_iter (drivers/net/tun.c:2032)\n\nThe issue is completely latent until qdisc read transport header in\ncommit 7fb4c1967011 (\"net: pull headers in qdisc_pkt_len_segs_init()\").\nThe crash requires four conditions to line up:\n\n1. The incoming packet is encapsulated and carries GSO metadata. The outer\n transport header offset is stored in skb->transport_header while the\n packet is still in the outer tunnel context.\n2. The tunnel receiver strips the outer headers. skb->data is advanced to\n the inner frame, but skb->transport_header is left pointing to the\n now-removed outer L4 header, so it becomes a negative offset relative to\n the new data.\n3. The inner frame is not delivered to the local IP stack. Instead, it\n is forwarded at L2 by a bridge or HSR, so ip_rcv_core() never runs and\n the transport header is not reset to the inner L4 offset.\n4. The forwarding path calls __dev_queue_xmit(), which enters\n qdisc_pkt_len_segs_init(). That function computes the GSO header length\n from skb_transport_offset(skb). Because the offset is negative, the\n unsigned cast overflows and pskb_may_pull(skb, hdr_len +\n sizeof(struct tcphdr)) reads past the end of the skb, triggering a\n KASAN fault or page fault.\n\nThe issue specifically requires GSO packets (shinfo->gso_size != 0), which\nare processed/aggregated through gro_cells. Fix this by clearing\ntransport_header to the ~0U sentinel in gro_cell for all tunnnel driver.\nGTP does not support GRO/GSO, drop the evil GSO packets in GTP directly.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98401"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/28a57fb2c5df4deb42a06e52fd36c14b37aa0034",
"url": "https://git.kernel.org/stable/c/28a57fb2c5df4deb42a06e52fd36c14b37aa0034"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3340b8565b85631cfeb0df049e8b46e3ef8bd7bd",
"url": "https://git.kernel.org/stable/c/3340b8565b85631cfeb0df049e8b46e3ef8bd7bd"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8c3d4dfcecf7670c1d752f1ae74b21b2af5feac1",
"url": "https://git.kernel.org/stable/c/8c3d4dfcecf7670c1d752f1ae74b21b2af5feac1"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e4a5b01e59f7102169762b8f566c8e052d05c0ff",
"url": "https://git.kernel.org/stable/c/e4a5b01e59f7102169762b8f566c8e052d05c0ff"
}
],
"release_date": "2026-10-14T14:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98461",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sock: validate event length before filtering\n\nis_filtered_packet() reads the event code from skb->data[0] without first\nchecking that the skb is nonempty. When an opcode filter is configured,\nit also reads the command opcode at offsets 3 or 4 without checking that\na Command Complete or Command Status event is long enough.\n\nhci_send_to_sock() invokes the filter before hci_event_packet() validates\nthe event header. A malformed event supplied by a controller or a vhci\ndevice can therefore cause an out-of-bounds read.\n\nKeep the unmasked event code for the opcode checks. The masked value is\nneeded for the 64-bit event bitmap, but using it to identify command events\naliases event codes above 0x3f. In particular, Synchronous Train Complete\n(0x4f) was treated as Command Status (0x0f) even though its payload has no\nopcode.\n\nReject actual command events that are too short for the field being\ninspected. A truncated command event cannot match a configured opcode.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98461"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1a92763c2ba721bf113cd83f913fe8c511b4a4dc",
"url": "https://git.kernel.org/stable/c/1a92763c2ba721bf113cd83f913fe8c511b4a4dc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2501a3b7b7144d1d11939b355a48ed01f83d0c62",
"url": "https://git.kernel.org/stable/c/2501a3b7b7144d1d11939b355a48ed01f83d0c62"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3976bbcd43b9b94c53ac9b0fd28888011588f4cc",
"url": "https://git.kernel.org/stable/c/3976bbcd43b9b94c53ac9b0fd28888011588f4cc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/39e99d85071bca0feeec3164a9437ca1bff297fc",
"url": "https://git.kernel.org/stable/c/39e99d85071bca0feeec3164a9437ca1bff297fc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b0a6cf99afd57a39598b1beca0e86ef5004980de",
"url": "https://git.kernel.org/stable/c/b0a6cf99afd57a39598b1beca0e86ef5004980de"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/dca25c204f71be0556a15177dbe037237ac43e5e",
"url": "https://git.kernel.org/stable/c/dca25c204f71be0556a15177dbe037237ac43e5e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ebdd49cec380731844ed9df4092a29a014623df4",
"url": "https://git.kernel.org/stable/c/ebdd49cec380731844ed9df4092a29a014623df4"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f894f6292d5122cd62d30600736b4a0ae79f7770",
"url": "https://git.kernel.org/stable/c/f894f6292d5122cd62d30600736b4a0ae79f7770"
}
],
"release_date": "2026-10-18T16:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-63806",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()\n\nDrop a BUG_ON() that has been reachable since it was first added, way back\nin 2009, and instead use get_unaligned() to perform potentially-unaligned\naccesses.\n\nFor a given store, KVM x86's emulator tracks the entire value in the\ndestination operand, x86_emulate_ctxt.dst. If the destination is memory,\nand the target splits multiple pages and/or is emulated MMIO, then KVM\nhandles each fragment independently. E.g. on a page split starting at page\noffset 0xffc, KVM writes 4 bytes to the first page, then the remaining\nbytes to the second page, using ctxt->dst as the source for both (with\nappropriate offsets).\n\nIf the destination splits a page *and* hits emulated MMIO on the second\npage, then KVM will complete the write to the first page, then emulate the\nMMIO access to the second page. If there is a datamatch-enabled ioeventfd\nat offset 0 of the second page, then KVM will process the remainder of the\nstore as a potential ioeventfd signal.\n\nPutting it all together, if the guest emits a store that splits a page\nstarting at page offset N, and the second page has a datamatch-enabled\nioeventfd at offset 0, then KVM will check for datamatch using\n&dst.valptr[N] as the source. Due to dst (and thus dst.valptr) being\n32-byte aligned, if N is not aligned to @len, the BUG_ON() fires.\n\nE.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8,\nall initial checks in ioeventfd_in_range() will succeed, and the BUG_ON()\nfires due to @val being 4-byte aligned, but not 8-byte aligned.\n\n ------------[ cut here ]------------\n kernel BUG at arch/x86/kvm/../../../virt/kvm/eventfd.c:783!\n Oops: invalid opcode: 0000 [#1] SMP\n CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:ioeventfd_write+0x6c/0x70 [kvm]\n Call Trace:\n \n __kvm_io_bus_write+0x85/0xb0 [kvm]\n kvm_io_bus_write+0x53/0x80 [kvm]\n vcpu_mmio_write+0x66/0xf0 [kvm]\n emulator_read_write_onepage+0x12a/0x540 [kvm]\n emulator_read_write+0x109/0x2b0 [kvm]\n x86_emulate_insn+0x4f8/0xfb0 [kvm]\n x86_emulate_instruction+0x181/0x790 [kvm]\n kvm_mmu_page_fault+0x313/0x630 [kvm]\n vmx_handle_exit+0x18a/0x590 [kvm_intel]\n kvm_arch_vcpu_ioctl_run+0xc81/0x1c90 [kvm]\n kvm_vcpu_ioctl+0x2d5/0x970 [kvm]\n __x64_sys_ioctl+0x8a/0xd0\n do_syscall_64+0xb7/0x890\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n RIP: 0033:0x7f19c931a9bf\n \n Modules linked in: kvm_intel kvm irqbypass\n ---[ end trace 0000000000000000 ]---\n\nIn a perfect world, the fix would be to simply delete the BUG_ON(), as KVM\nx86 doesn't perform alignment checks on \"normal\" memory accesses at CPL0.\nSadly, C99 ruins all the fun; while the x86 architecture plays nice,\ndereferencing an unaligned pointer directly is undefined behavior in C,\ne.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-63806"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2426c15c1395b7d5ccf1e5025ca898af7f3decb6",
"url": "https://git.kernel.org/stable/c/2426c15c1395b7d5ccf1e5025ca898af7f3decb6"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/36ff44fb3d89960391e013fb9d91e23dbc48be47",
"url": "https://git.kernel.org/stable/c/36ff44fb3d89960391e013fb9d91e23dbc48be47"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4186c850789906b875a1d263377a4d37c078e317",
"url": "https://git.kernel.org/stable/c/4186c850789906b875a1d263377a4d37c078e317"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5c87b47374682f69686068ad0a7779365a527b1c",
"url": "https://git.kernel.org/stable/c/5c87b47374682f69686068ad0a7779365a527b1c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5da9b1a87ec7cc3489c27016313524769f12d9e0",
"url": "https://git.kernel.org/stable/c/5da9b1a87ec7cc3489c27016313524769f12d9e0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/92fc631b69deb1c7d56aec2663003600799dcd75",
"url": "https://git.kernel.org/stable/c/92fc631b69deb1c7d56aec2663003600799dcd75"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bf89e3738480d33cd515b4a18900e8443d40cd2e",
"url": "https://git.kernel.org/stable/c/bf89e3738480d33cd515b4a18900e8443d40cd2e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f1edbed787ba67988ed34e0132ca128b052b6ce8",
"url": "https://git.kernel.org/stable/c/f1edbed787ba67988ed34e0132ca128b052b6ce8"
}
],
"release_date": "2026-07-19T12:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2022-50774",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix DMA transfer direction\n\nWhen CONFIG_DMA_API_DEBUG is selected, while running the crypto self\ntest on the QAT crypto algorithms, the function add_dma_entry() reports\na warning similar to the one below, saying that overlapping mappings\nare not supported. This occurs in tests where the input and the output\nscatter list point to the same buffers (i.e. two different scatter lists\nwhich point to the same chunks of memory).\n\nThe logic that implements the mapping uses the flag DMA_BIDIRECTIONAL\nfor both the input and the output scatter lists which leads to\noverlapped write mappings. These are not supported by the DMA layer.\n\nFix by specifying the correct DMA transfer directions when mapping\nbuffers. For in-place operations where the input scatter list\nmatches the output scatter list, buffers are mapped once with\nDMA_BIDIRECTIONAL, otherwise input buffers are mapped using the flag\nDMA_TO_DEVICE and output buffers are mapped with DMA_FROM_DEVICE.\nOverlapping a read mapping with a write mapping is a valid case in\ndma-coherent devices like QAT.\nThe function that frees and unmaps the buffers, qat_alg_free_bufl()\nhas been changed accordingly to the changes to the mapping function.\n\n DMA-API: 4xxx 0000:06:00.0: cacheline tracking EEXIST, overlapping mappings aren't supported\n WARNING: CPU: 53 PID: 4362 at kernel/dma/debug.c:570 add_dma_entry+0x1e9/0x270\n ...\n Call Trace:\n dma_map_page_attrs+0x82/0x2d0\n ? preempt_count_add+0x6a/0xa0\n qat_alg_sgl_to_bufl+0x45b/0x990 [intel_qat]\n qat_alg_aead_dec+0x71/0x250 [intel_qat]\n crypto_aead_decrypt+0x3d/0x70\n test_aead_vec_cfg+0x649/0x810\n ? number+0x310/0x3a0\n ? vsnprintf+0x2a3/0x550\n ? scnprintf+0x42/0x70\n ? valid_sg_divisions.constprop.0+0x86/0xa0\n ? test_aead_vec+0xdf/0x120\n test_aead_vec+0xdf/0x120\n alg_test_aead+0x185/0x400\n alg_test+0x3d8/0x500\n ? crypto_acomp_scomp_free_ctx+0x30/0x30\n ? __schedule+0x32a/0x12a0\n ? ttwu_queue_wakelist+0xbf/0x110\n ? _raw_spin_unlock_irqrestore+0x23/0x40\n ? try_to_wake_up+0x83/0x570\n ? _raw_spin_unlock_irqrestore+0x23/0x40\n ? __set_cpus_allowed_ptr_locked+0xea/0x1b0\n ? crypto_acomp_scomp_free_ctx+0x30/0x30\n cryptomgr_test+0x27/0x50\n kthread+0xe6/0x110\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x1f/0x30",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2022-50774"
}
],
"release_date": "2025-12-24T13:06:04Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98419",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n al = sizeof(struct net_dm_alert_msg);\n al += dm_hit_limit * sizeof(struct net_dm_drop_point);\n al += sizeof(struct nlattr);\n\n skb = genlmsg_new(al, GFP_KERNEL);\n ...\n nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n ...\n msg = nla_data(nla);\n memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98419"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202",
"url": "https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8",
"url": "https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9",
"url": "https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c",
"url": "https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6",
"url": "https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855",
"url": "https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631",
"url": "https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9",
"url": "https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9"
}
],
"release_date": "2026-10-14T14:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-80590",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.\ninet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first\nfragment's skb as the head of the reassembled datagram, including its\nshinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments\non frag_list with whatever linear/paged layout they arrived with.\n\nAfter ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the\nreassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and\nthe next software segmentation point - udp_rcv_segment() on local\ndelivery, validate_xmit_skb(), or the ip_finish_output_gso() slow\npath - hands it to skb_segment(). skb_segment()'s frag_list walk\nassumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to\na tap by an unprivileged user in its own userns are enough:\n\n kernel BUG at net/core/skbuff.c:4899!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2\n RIP: 0010:skb_segment+0x20ca/0x48b0\n Call Trace:\n \n __udp_gso_segment+0x29a/0x27d0\n udp4_ufo_fragment+0x458/0x6c0\n inet_gso_segment+0x429/0x1340\n skb_mac_gso_segment+0x233/0x4f0\n __skb_gso_segment+0x308/0x660\n udp_queue_rcv_skb+0x440/0xad0\n udp_unicast_rcv_skb+0xc7/0x2c0\n udp_rcv+0x16ce/0x2260\n ip_protocol_deliver_rcu+0x197/0x2d0\n ip_local_deliver+0x430/0x690\n ip_rcv+0x16f/0x1f0\n __netif_receive_skb_one_core+0x15e/0x1c0\n __netif_receive_skb+0x1e/0x110\n netif_receive_skb+0xf6/0x5c0\n tun_rx_batched.isra.0+0x3ab/0x790\n tun_get_user+0x17c3/0x3550\n tun_chr_write_iter+0xba/0x1b0\n vfs_write+0x646/0x1130\n \n Kernel panic - not syncing: Fatal exception in interrupt\n\nThis runs with BH disabled, so it is a panic rather than an oops. The\nsame is reachable with CAP_NET_RAW in a netns where a defrag point\nprecedes a GSO point, and from a guest whose VMM forwards\nvirtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by\ncommit 3dcbdb134f32 (\"net: gso: Fix skb_segment splat when splitting\ngso_size mangled skb having linear-headed frag_list\") and by\ncommit 9e4b7a99a03a (\"net: gso: fix panic on frag_list with mixed head\nalloc types\") do not cover it: page-backed heads skip them, and kmalloc\nheads skip them when gso_size == skb_headlen(head), which the sender\ncontrols.\n\nAn skb entering a frag queue is an IP fragment by definition and\ncannot legitimately carry GSO state: GRO does not merge fragments and\nthe stack segments before it fragments, so only untrusted sources are\naffected. This has been reachable since\ncommit f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\"), the first\npath that let userspace attach GSO metadata to an IP fragment. Reset\nthe GSO fields of every fragment as it is queued, in\ninet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and\n6lowpan reassembly share; then neither the head nor the frag_list\nmembers of the reassembled skb carry them (the members matter too:\nthe ip_do_fragment()/ip6_fragment() fast paths send them out as they\nare). The head may remain CHECKSUM_PARTIAL; that is already accepted\non receive and resolved by skb_checksum_help() in\nip_do_fragment()/ip6_fragment() on forward.\n\nTested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer\nabove, two further IPv4 frag_list geometries that reach\nBUG_ON(i >= nfrags) and BUG_ON(!list_skb->head_frag), and an IPv6\nfragment-header variant (udp6_ufo_fragment()) each panic the unpatched\nkernel; with this patch all four datagrams are delivered intact and\nnothing is logged.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-80590"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234",
"url": "https://git.kernel.org/stable/c/14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/29dda278a5ed272f2230ff4eaa23cf403107bba0",
"url": "https://git.kernel.org/stable/c/29dda278a5ed272f2230ff4eaa23cf403107bba0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3edf721bb4b99d272c336631b44e3d8ff9a4f31b",
"url": "https://git.kernel.org/stable/c/3edf721bb4b99d272c336631b44e3d8ff9a4f31b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/69b73b74d9eb45f5560a8fe4fa406ada580e1340",
"url": "https://git.kernel.org/stable/c/69b73b74d9eb45f5560a8fe4fa406ada580e1340"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace",
"url": "https://git.kernel.org/stable/c/c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee",
"url": "https://git.kernel.org/stable/c/cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d5dc1e69fd7258ea605c9952e5d5947539159ae3",
"url": "https://git.kernel.org/stable/c/d5dc1e69fd7258ea605c9952e5d5947539159ae3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/da857e448322a2e871ce3ecc2900027041160d43",
"url": "https://git.kernel.org/stable/c/da857e448322a2e871ce3ecc2900027041160d43"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/dec2edb7aaf12a8878b3a03172ea8fc277b8eaad",
"url": "https://git.kernel.org/stable/c/dec2edb7aaf12a8878b3a03172ea8fc277b8eaad"
}
],
"release_date": "2026-08-28T08:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98130",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix a TOCTOU race in SCTP_CMD_TIMER_START\n\nThe SCTP_CMD_TIMER_START handler checks timer_pending() before calling\ntimer_reduce(). The timer can expire and detach between these operations,\ncausing timer_reduce() to rearm the timer without taking the association\nreference required for the newly armed timer.\n\nThe timer callback later unconditionally drops its association reference,\nwhich can leave the association reference count unbalanced and result in\nuse-after-free during association teardown.\n\nUse the return value of timer_reduce() to determine whether the timer was\nactually armed. Take the association reference only when timer_reduce()\nsuccessfully starts a new timer, closing the race between checking the\ntimer state and rearming it.\n\nThis issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero\nDay Initiative.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98130"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/00b841bac10230c557be6b38efc48508198fe23e",
"url": "https://git.kernel.org/stable/c/00b841bac10230c557be6b38efc48508198fe23e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/09e7f9290d63178f56095d5c18fb9f9470153db5",
"url": "https://git.kernel.org/stable/c/09e7f9290d63178f56095d5c18fb9f9470153db5"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2188569e7e1b0bc3f3b557dc97ab7a02befc11c8",
"url": "https://git.kernel.org/stable/c/2188569e7e1b0bc3f3b557dc97ab7a02befc11c8"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3205a20f837f5b1f009427ac3d9f706bf8a6fbec",
"url": "https://git.kernel.org/stable/c/3205a20f837f5b1f009427ac3d9f706bf8a6fbec"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3d698d1e6c8bc41e3e1707777a016f1bdd07842d",
"url": "https://git.kernel.org/stable/c/3d698d1e6c8bc41e3e1707777a016f1bdd07842d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/755d70ca845fd9b87c7b338ae6ae832b08cd0005",
"url": "https://git.kernel.org/stable/c/755d70ca845fd9b87c7b338ae6ae832b08cd0005"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/cbf2df9aac4202f9fb0b361a7fe8c79b29fad92c",
"url": "https://git.kernel.org/stable/c/cbf2df9aac4202f9fb0b361a7fe8c79b29fad92c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e42ba56281ca3ae2dcb3558bebee9a1c9a4831d9",
"url": "https://git.kernel.org/stable/c/e42ba56281ca3ae2dcb3558bebee9a1c9a4831d9"
}
],
"release_date": "2026-09-25T11:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98532",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not let ipv6_find_hdr() return an offset past the packet end\n\nipv6_find_hdr() walks the extension header chain, skipping each header by\nthe length that header itself declares. ipv6_optlen() returns up to 2048,\nand the skip is never checked against skb->len, so the offset stored in\n*offset can point past the end of the packet.\n\nopenvswitch installs that offset as the transport header, and\nupdate_ipv6_checksum() then reads and writes the transport checksum field\nout of bounds:\n\n BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470\n Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629\n CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348\n Call Trace:\n inet_proto_csum_replace16+0x445/0x470\n set_ipv6_addr+0x3dd/0x460\n do_execute_actions+0x6a3d/0x7c40\n ovs_execute_actions+0xfd/0x480\n ovs_packet_cmd_execute+0xc38/0xf20\n genl_rcv_msg+0x59e/0x870\n netlink_rcv_skb+0x18b/0x450\n genl_rcv+0x2d/0x40\n netlink_unicast+0x6bc/0xa20\n\n The buggy address belongs to the object at ffff88810b754980\n which belongs to the cache skbuff_small_head of size 704\n The buggy address is located 390 bytes inside of\n freed 704-byte region [ffff88810b754980, ffff88810b754c40)\n\nOther callers use that offset too, so bound it here rather than in one\ncaller.\n\nReject a header whose declared length does not fit in the packet.\nipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this\nadds no new failure mode.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98532"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1c70275ca87e769e1a52abc644d61372d8c016cb",
"url": "https://git.kernel.org/stable/c/1c70275ca87e769e1a52abc644d61372d8c016cb"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1d42828565889632068fbc2983c34d57c66af4e0",
"url": "https://git.kernel.org/stable/c/1d42828565889632068fbc2983c34d57c66af4e0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4254d5878c320c19961dd0b8e1d0aca4800d8b7d",
"url": "https://git.kernel.org/stable/c/4254d5878c320c19961dd0b8e1d0aca4800d8b7d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/531255de8971c06d5d5986f85fdc2525d707ba71",
"url": "https://git.kernel.org/stable/c/531255de8971c06d5d5986f85fdc2525d707ba71"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/543354c6efb27eae3372a3a9674aeaa2a86e2b2c",
"url": "https://git.kernel.org/stable/c/543354c6efb27eae3372a3a9674aeaa2a86e2b2c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ca96b38730e31357ef4a9d76af1336958ac670d7",
"url": "https://git.kernel.org/stable/c/ca96b38730e31357ef4a9d76af1336958ac670d7"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/dc92cb972e86790b8078337ec41015b748b8f8e5",
"url": "https://git.kernel.org/stable/c/dc92cb972e86790b8078337ec41015b748b8f8e5"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ee319bd3a0e976af5087cbe59ebc50a66f31d202",
"url": "https://git.kernel.org/stable/c/ee319bd3a0e976af5087cbe59ebc50a66f31d202"
}
],
"release_date": "2026-10-18T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-53388",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: re-lock request before replacing page cache folio\n\nfuse_try_move_folio() unlocks the request on entry but does not\nre-lock it on the success path. This means fuse_chan_abort() can end the\nrequest and free the fuse_io_args (eg fuse_readpages_end()) while the\nsubsequent copy chain logic after fuse_try_move_folio() accesses the\nfuse_io_args, leading to use-after-free issues.\n\nFix this by calling lock_request() before replace_page_cache_folio().\nThis ensures the request is locked on the success path which will\nprevent the fuse_io_args from being freed while the later copying logic\nruns, and also ensures that the ap->folios[i]->mapping is never null\nsince ap->folios[i] will always point to the newfolio after\nreplace_page_cache_folio().",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-53388"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0223f452532d9cd8a5e87c45de828fd93c99bd25",
"url": "https://git.kernel.org/stable/c/0223f452532d9cd8a5e87c45de828fd93c99bd25"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/030fe3e9d8abdee303dd7e9e42f45082d382a407",
"url": "https://git.kernel.org/stable/c/030fe3e9d8abdee303dd7e9e42f45082d382a407"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/46473ddccdc5065033e397d6e62c280dbcd3d9c2",
"url": "https://git.kernel.org/stable/c/46473ddccdc5065033e397d6e62c280dbcd3d9c2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5927b43a4f8d89e86930f524bf63e9c7e66f61b4",
"url": "https://git.kernel.org/stable/c/5927b43a4f8d89e86930f524bf63e9c7e66f61b4"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7c18691e0cfda29672f79bafde8abdb7710674f6",
"url": "https://git.kernel.org/stable/c/7c18691e0cfda29672f79bafde8abdb7710674f6"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a078484921052d0badd827fcc2770b5cfc1d4120",
"url": "https://git.kernel.org/stable/c/a078484921052d0badd827fcc2770b5cfc1d4120"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/af2892249d982a1c036ca456cc135374e68b6677",
"url": "https://git.kernel.org/stable/c/af2892249d982a1c036ca456cc135374e68b6677"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e28db6ac4792d065ab32565fd9f0a2361c3d4666",
"url": "https://git.kernel.org/stable/c/e28db6ac4792d065ab32565fd9f0a2361c3d4666"
}
],
"release_date": "2026-07-19T12:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-100072",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: platform: Use acpi_bus_get_primary_device()\n\nThe acpi_get_first_physical_node() usage in acpi_platform_fill_resource()\nand acpi_create_platform_device() is generally unsafe because in theory\nthe device returned by it may be freed at any time [1].\n\nIt is also inefficient because acpi_get_first_physical_node() is called\nmultiple times for the same argument which can be avoided.\n\nAddress these issues by using acpi_bus_get_primary_device() instead of\nacpi_get_first_physical_node() and adjusting the code to call it just\nonce at the beginning of and acpi_create_platform_device() and drop\nthe device reference acquired by it upon the return from that function.",
"title": "Vulnerability description"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-100072"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/527a497fb2ef77a95170eefe2007e2c4c957bd2c",
"url": "https://git.kernel.org/stable/c/527a497fb2ef77a95170eefe2007e2c4c957bd2c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a75e5de593ef158feb17989bff7730c5a3d82503",
"url": "https://git.kernel.org/stable/c/a75e5de593ef158feb17989bff7730c5a3d82503"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd",
"url": "https://git.kernel.org/stable/c/a9ba4dd2f18bf3f439d9ef0d8f375f90360ba1bd"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71",
"url": "https://git.kernel.org/stable/c/c9d202d3b6c28e8c779cd2f2b10d2f7ab665ca71"
}
],
"release_date": "2026-09-25T14:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
]
},
{
"cve": "CVE-2026-98772",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix port tear down use-after-free\n\nSome drivers for multiport devices access port driver data from\ncompletion handlers of shared URBs submitted at attach() or first open()\nand stopped at disconnect() or last close(), respectively.\n\nA simple NULL check before accessing the driver data makes sure that a\nport state container has at least been allocated, but a completion\nhandler can still race with port tear down.\n\nReorder the disconnect handling so that ports are not deregistered (and\ntheir driver data freed) until after all ports have been hung up and the\ndriver disconnect() callback has run so that all I/O has been stopped.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98772"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/33c920f7c5952dfc42d1b8ea6efe16b1f0bb0c5b",
"url": "https://git.kernel.org/stable/c/33c920f7c5952dfc42d1b8ea6efe16b1f0bb0c5b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5e8980a81af195c49084be5b4c031085b56c7443",
"url": "https://git.kernel.org/stable/c/5e8980a81af195c49084be5b4c031085b56c7443"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/60cc9379c3e650d1ebfba4de63f1242537a62a32",
"url": "https://git.kernel.org/stable/c/60cc9379c3e650d1ebfba4de63f1242537a62a32"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e4a6883ad9b4686a5f4bd90ff55a44d7ab65bd3c",
"url": "https://git.kernel.org/stable/c/e4a6883ad9b4686a5f4bd90ff55a44d7ab65bd3c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e80ee74206f260eb1282e7d1339ff146a4a410d0",
"url": "https://git.kernel.org/stable/c/e80ee74206f260eb1282e7d1339ff146a4a410d0"
}
],
"release_date": "2026-10-18T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-74377",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Copy WQE to local buffer in non-SRQ receive path\n\nFor non-SRQ QPs, the responder reads WQE fields directly from the\nshared queue buffer mapped into userspace. This allows a malicious\nuser to modify fields like num_sge or sge entries while the kernel\nis processing the WQE, leading to out-of-bounds reads in\nrxe_resp_check_length() and copy_data().\n\nIntroduce get_recv_wqe() that validates num_sge and copies the WQE\nto a kernel-local buffer before processing, matching the approach\nalready used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is\nreused since SRQ and non-SRQ paths are mutually exclusive per QP.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-74377"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2e60378fb3c8b51c94103bb40014c4fe38fa5033",
"url": "https://git.kernel.org/stable/c/2e60378fb3c8b51c94103bb40014c4fe38fa5033"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5420eebf3b3c162bfaf965f30e61cd1d689e5732",
"url": "https://git.kernel.org/stable/c/5420eebf3b3c162bfaf965f30e61cd1d689e5732"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/9fa785137303f7109c23dea779b8dedc67c9b531",
"url": "https://git.kernel.org/stable/c/9fa785137303f7109c23dea779b8dedc67c9b531"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a211b7904aed365e4e4f08a48ec6e6dd1ea7b16b",
"url": "https://git.kernel.org/stable/c/a211b7904aed365e4e4f08a48ec6e6dd1ea7b16b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d6ab440240a04b8737ee4c7bb21af9182e451733",
"url": "https://git.kernel.org/stable/c/d6ab440240a04b8737ee4c7bb21af9182e451733"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/fc72fd61cc8b2e2e3e92ae4c0e9cc30c9a7ecb78",
"url": "https://git.kernel.org/stable/c/fc72fd61cc8b2e2e3e92ae4c0e9cc30c9a7ecb78"
}
],
"release_date": "2026-08-15T06:22:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-64109",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix UAF read of tail->len in unix_stream_data_wait()\n\nunix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without\nholding any lock that prevents SKBs on that queue from being dequeued and\nfreed.\nThis has been the case since commit 79f632c71bea (\"unix/stream: fix\npeeking with an offset larger than data in queue\").\nThe first consequence of this is that the pointer comparison\n`tail != last` can be false even if `last` semantically refers to an\nalready-freed SKB while `tail` is a new SKB allocated at the same address;\nwhich can cause unix_stream_data_wait() to wrongly keep blocking after new\ndata has arrived, but only in a weird scenario where a peeking recv() and\na normal recv() on the same socket are racing, which is probably not a\nreal problem.\n\nBut since commit 2b514574f7e8 (\"net: af_unix: implement splice for stream\naf_unix sockets\"), `tail` is actually dereferenced, which can cause UAF in\nthe following race scenario (where test_setup() runs single-threaded,\nand afterwards, test_thread1() and test_thread2() run concurrently in\ntwo threads:\n```\nstatic int socks[2];\nvoid test_setup(void) {\n socketpair(AF_UNIX, SOCK_STREAM, 0, socks);\n send(socks[1], \"A\", 1, 0);\n int peekoff = 1;\n setsockopt(socks[0], SOL_SOCKET, SO_PEEK_OFF, &peekoff, sizeof(peekoff));\n}\nvoid test_thread1(void) {\n char dummy;\n recv(socks[0], &dummy, 1, MSG_PEEK);\n}\nvoid test_thread2(void) {\n char dummy;\n recv(socks[0], &dummy, 1, 0);\n shutdown(socks[1], SHUT_WR);\n}\n```\n\nwhen racing like this:\n```\nthread1 thread2\nunix_stream_read_generic\n mutex_lock(&u->iolock)\n skb_peek(&sk->sk_receive_queue)\n skb_peek_next(skb, &sk->sk_receive_queue)\n mutex_unlock(&u->iolock)\n unix_stream_read_generic\n unix_state_lock(sk)\n skb_peek(&sk->sk_receive_queue)\n unix_state_unlock(sk)\n unix_stream_data_wait\n unix_state_lock(sk)\n tail = skb_peek_tail(&sk->sk_receive_queue)\n spin_lock(&sk->sk_receive_queue.lock)\n __skb_unlink(skb, &sk->sk_receive_queue)\n spin_unlock(&sk->sk_receive_queue.lock)\n consume_skb(skb) [frees the SKB]\n `tail != last`: false\n `tail`: true\n `tail->len != last_len` ***UAF***\n```\n\nFix the UAF by removing the read of tail->len; checking tail->len would\nonly make sense if SKBs in the receive queue of a UNIX socket could grow,\nwhich can no longer happen.\n\nKuniyuki explained:\n\n> When commit 869e7c62486e (\"net: af_unix: implement stream sendpage\n> support\") added sendpage() support, data could be appended to the last\n> skb in the receiver's queue.\n>\n> That's why we needed to check if the length of the last skb was changed\n> while waiting for new data in unix_stream_data_wait().\n>\n> However, commit a0dbf5f818f9 (\"af_unix: Support MSG_SPLICE_PAGES\") and\n> commit 57d44a354a43 (\"unix: Convert unix_stream_sendpage() to use\n> MSG_SPLICE_PAGES\") refactored sendmsg(), and now data is always added\n> to a new skb.\n\nThat means this fix is not suitable for kernels before 6.5.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-64109"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/26342087fac93b3932e6af61dc91ec029cb8a623",
"url": "https://git.kernel.org/stable/c/26342087fac93b3932e6af61dc91ec029cb8a623"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/38bccb927d83d7d52e5b20015a172a0b6101d11e",
"url": "https://git.kernel.org/stable/c/38bccb927d83d7d52e5b20015a172a0b6101d11e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5f162f95a95834f06a8ec6140889272ad12e842f",
"url": "https://git.kernel.org/stable/c/5f162f95a95834f06a8ec6140889272ad12e842f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/acdff9907478e82208475b1151700d0b71dcdc63",
"url": "https://git.kernel.org/stable/c/acdff9907478e82208475b1151700d0b71dcdc63"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719",
"url": "https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719"
}
],
"release_date": "2026-07-19T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98406",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver\n\nieee80211_set_bitrate_mask() checks if the interface is running via\nieee80211_sdata_running(), but it does not check if the interface is\nstill present in the driver.\n\nWhen sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the\ncall reaches drv_set_bitrate_mask() in driver-ops.h which hits\n\n wlan1: Failed check-sdata-in-driver check, flags: 0x0\n WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask\n\nSyzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows\nwext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling\nioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate()\nin wext-compat.c. That builds a bitrate mask and calls\nrdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in\ncfg.c. The interface is marked running via SDATA_STATE_RUNNING but\nflags is 0, so check_sdata_in_driver() fails.\n\nWhen the interface is being torn down, or when wext ioctl is issued\nduring interface bringup before drv_add_interface() sets IN_DRIVER, the\nrunning check passes while IN_DRIVER is clear.\n\nCheck IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before\ncalling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in\ndriver-ops.h and matches other cfg.c operations that bail early when not\nin driver.\n\nThis change should be safe because wiphy mutex is held in\ncfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared\nunder RTNL and wiphy paths in drv_add_interface() and\ndrv_remove_interface() in driver-ops.c, so the check is race-free\nagainst driver add/remove. Returning -ENETDOWN is the same error other\nnot-running paths use and does not introduce new locking.\n\n[also add second syzbot report]",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98406"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0d1700394e9f5d0bd9bebad8d5a50edf983f52fd",
"url": "https://git.kernel.org/stable/c/0d1700394e9f5d0bd9bebad8d5a50edf983f52fd"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4095b66acae9893dd13deb39a4331651cb2f822b",
"url": "https://git.kernel.org/stable/c/4095b66acae9893dd13deb39a4331651cb2f822b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/432c8532d5ccc2af77da43ed6ef1c80495a4efe8",
"url": "https://git.kernel.org/stable/c/432c8532d5ccc2af77da43ed6ef1c80495a4efe8"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4ba86c44b2fcb1c3175caa2456b6d58f483446ab",
"url": "https://git.kernel.org/stable/c/4ba86c44b2fcb1c3175caa2456b6d58f483446ab"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7978dda63d2b109ea9c3f7a096cd1aac6542cd54",
"url": "https://git.kernel.org/stable/c/7978dda63d2b109ea9c3f7a096cd1aac6542cd54"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306",
"url": "https://git.kernel.org/stable/c/c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c4ee5685af444024e6222ce29f6ed36adc44ffc3",
"url": "https://git.kernel.org/stable/c/c4ee5685af444024e6222ce29f6ed36adc44ffc3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/da2ca406f45a6e21760243152ed8d2e8e72915c2",
"url": "https://git.kernel.org/stable/c/da2ca406f45a6e21760243152ed8d2e8e72915c2"
}
],
"release_date": "2026-10-14T14:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-53399",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release layout stid on setlease failure\n\nnfs4_alloc_stid() publishes the new stid into cl->cl_stateids via\nidr_alloc_cyclic() under cl_lock before returning to\nnfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then\nfails, the error path frees the layout stateid directly with\nkmem_cache_free() without ever calling idr_remove(), leaving the\nIDR slot pointing at freed slab memory. Any subsequent IDR walker\n(states_show, client teardown) dereferences the dangling pointer.\n\nThe correct teardown for an IDR-published stid is nfs4_put_stid(),\nwhich removes the IDR slot under cl_lock, dispatches sc_free\n(nfsd4_free_layout_stateid) to release ls->ls_file via\nnfsd4_close_layout(), and drops the nfs4_file reference in its\ntail.\n\nA second issue blocks that switch: nfsd4_free_layout_stateid()\nunconditionally inspects ls->ls_fence_work via\ndelayed_work_pending() under ls_lock, but\nINIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only\nafter the setlease call. On the setlease-failure path the\ndestructor would touch an uninitialized delayed_work.\n\n nfsd4_alloc_layout_stateid()\n nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */\n nfsd4_layout_setlease() /* fails */\n nfs4_put_stid()\n nfsd4_free_layout_stateid()\n delayed_work_pending(&ls->ls_fence_work) /* needs INIT */\n nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */\n put_nfs4_file()\n\nFix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK\ninitialization above the nfsd4_layout_setlease() call, and replace\nthe manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup\nwith a single nfs4_put_stid(stp).",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-53399"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9",
"url": "https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9",
"url": "https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04",
"url": "https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61",
"url": "https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138",
"url": "https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd",
"url": "https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801",
"url": "https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f",
"url": "https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f"
}
],
"release_date": "2026-07-19T12:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-89671",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs3 setacl by argp->mask\n\nnfsd3_proc_setacl() calls set_posix_acl() unconditionally for both\nACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access and\nargp->acl_default verbatim. The NFSv3 ACL decoder only populates\nthose pointers when the corresponding mask bit is set:\n\n nfs3svc_decode_setaclargs()\n if (args->mask & NFS_ACL) decode into acl_access\n if (args->mask & NFS_DFACL) decode into acl_default\n /* otherwise the pointer stays NULL (pc_argzero) */\n\n nfsd3_proc_setacl()\n set_posix_acl(.., ACL_TYPE_ACCESS, argp->acl_access)\n set_posix_acl(.., ACL_TYPE_DEFAULT, argp->acl_default)\n\nset_posix_acl(idmap, dentry, type, NULL) is the VFS \"remove this\nACL type\" operation. A NULL pointer that means \"the client did not\nsend this arm\" is therefore indistinguishable from \"the client\nasked to remove this ACL\". A SETACL with mask=NFS_ACL silently\ndrops the directory's default ACL; mask=0 drops both.\n\nThe sibling nfsd3_proc_getacl() already consults argp->mask before\ntouching each arm; mirror that in setacl.\n\nFix by wrapping each set_posix_acl() call in the matching mask bit\ncheck and initializing error to 0 before inode_lock so that a\nrequest with neither bit set leaves the on-disk ACLs untouched and\nreturns nfs_ok. The out_drop_lock path and the unconditional\nposix_acl_release() at out: are preserved; both NULL-tolerate the\nskipped arms.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-89671"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3be1d8611dae4829e4608007db29f4a8748c37b2",
"url": "https://git.kernel.org/stable/c/3be1d8611dae4829e4608007db29f4a8748c37b2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/453d7198a0ab07a12d46e0575861ac7b932da17e",
"url": "https://git.kernel.org/stable/c/453d7198a0ab07a12d46e0575861ac7b932da17e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/68a80b26efdff1d09f8ae1773c6a915abb9e191d",
"url": "https://git.kernel.org/stable/c/68a80b26efdff1d09f8ae1773c6a915abb9e191d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b3bff820d068ea59767d4e91a3258231a879da5f",
"url": "https://git.kernel.org/stable/c/b3bff820d068ea59767d4e91a3258231a879da5f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ff99ed007f065198fd723152405c22aa558f700b",
"url": "https://git.kernel.org/stable/c/ff99ed007f065198fd723152405c22aa558f700b"
}
],
"release_date": "2026-09-11T20:19:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-89665",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE\n\nThe NFSv2 sattr decoder converts the wire useconds to nanoseconds in\nsvcxdr_decode_sattr():\n\n\tiap->ia_atime.tv_nsec = tmp2 * NSEC_PER_USEC;\n\ntmp2 is a u32 and NSEC_PER_USEC is 1000, so the product is computed in\nunsigned long. On ILP32 that is 32 bits, and an out-of-range useconds\nvalue such as 4294968 wraps to tv_nsec == 704. The corruption therefore\nhappens during decode, before any proc function can inspect the value,\nand a later range check on tv_nsec would see an in-range result and\naccept it. Rejecting in the decoder yields an RPC GARBAGE_ARGS reply.\nNFSv2 defines no NFSERR_INVAL, so there is no NFS-level status to return\nfor a malformed time argument, and the check cannot move to the proc\nfunction the way the v3/v4 nsec range checks do.\n\nGuard the raw useconds before the multiplication and reject values\ngreater than 1000000. useconds == 1000000 is kept: it is the Sun\nconvention for \"set to the current server time\", and the in-tree Linux\nNFSv2 client emits it in both the atime and the mtime field for a plain\ntouch / utimes(file, NULL) (see encode_sattr() and\nxdr_encode_current_server_time() in fs/nfs/nfs2xdr.c). Rejecting 1000000\nwould turn that common operation into a hard decode failure for both\nSETATTR and CREATE. 1000000 * NSEC_PER_USEC is 10^9, which does not wrap\non ILP32, so the Sun convention value passes through safely. Only\ngenuinely out-of-range values (> 1000000) are rejected. The atime and\nmtime guards are therefore symmetric.\n\nThe decoder only applied the Sun convention in the mtime block, which\nclears ATTR_ATIME_SET|ATTR_MTIME_SET when mtime useconds == 1000000. If a\nclient puts 1000000 in the atime field but not in the mtime field, the\natime block stored an out-of-range tv_nsec (10^9) and left ATTR_ATIME_SET\nset, so the bogus value reached the filesystem. Apply the convention in\nthe atime block as well, clearing ATTR_ATIME_SET so the server uses its\ncurrent time and ignores the value. Only ATTR_ATIME_SET is cleared there.\nThe mtime block keeps its existing behavior, where 1000000 means \"set\nboth atime and mtime to now\".\n\n[ cel: various tweaks, addenda, and clean-ups ]",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-89665"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/09a79d9ab35a39603c834e8f6333603292f9c816",
"url": "https://git.kernel.org/stable/c/09a79d9ab35a39603c834e8f6333603292f9c816"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1195483965a5f63d2dde18054ec7e50a23b9071c",
"url": "https://git.kernel.org/stable/c/1195483965a5f63d2dde18054ec7e50a23b9071c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1db456ffc22e045f49f7b9e62415a26b3f33f200",
"url": "https://git.kernel.org/stable/c/1db456ffc22e045f49f7b9e62415a26b3f33f200"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/26709c8ffe73772eb69e68d553ac71d91228dccc",
"url": "https://git.kernel.org/stable/c/26709c8ffe73772eb69e68d553ac71d91228dccc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5296a2442d12d45d6eea7b4d3ec3ffecc1821cac",
"url": "https://git.kernel.org/stable/c/5296a2442d12d45d6eea7b4d3ec3ffecc1821cac"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a937dd1aa2d92291fe0a1860d17e90d8f206cd22",
"url": "https://git.kernel.org/stable/c/a937dd1aa2d92291fe0a1860d17e90d8f206cd22"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ad02d095439f89cbd6629420c7e3ba476457b83b",
"url": "https://git.kernel.org/stable/c/ad02d095439f89cbd6629420c7e3ba476457b83b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/cdc3299f7072777b09c9582a3b8b65bb163ddcf3",
"url": "https://git.kernel.org/stable/c/cdc3299f7072777b09c9582a3b8b65bb163ddcf3"
}
],
"release_date": "2026-09-11T20:19:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-93817",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix addr_filter_ranges lifetime\n\nLee Jia Jie reported that since event::addr_filter_ranges is used\nunder RCU, it should be RCU freed.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-93817"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1d8e1e99b063de4179cc8af14d08115d74a37abf",
"url": "https://git.kernel.org/stable/c/1d8e1e99b063de4179cc8af14d08115d74a37abf"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6f1853b2b9f38f1343790bae8c0601b3f7554754",
"url": "https://git.kernel.org/stable/c/6f1853b2b9f38f1343790bae8c0601b3f7554754"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1",
"url": "https://git.kernel.org/stable/c/cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e62d4192e593630f355094adc467058a05bdc935",
"url": "https://git.kernel.org/stable/c/e62d4192e593630f355094adc467058a05bdc935"
}
],
"release_date": "2026-09-24T17:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-46180",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task\n\nWatchdog task might end between send_sig() and kthread_stop() calls, what\nresults in the use-after-free issue. Fix this by increasing watchdog task\nreference count before calling send_sig() and dropping it by switching to\nkthread_stop_put().",
"title": "Vulnerability description"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-46180"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/658d2e46c2e9a8eb9b80c5e803ce3c89885b3366",
"url": "https://git.kernel.org/stable/c/658d2e46c2e9a8eb9b80c5e803ce3c89885b3366"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/908b92231e1ded53e43fcfad5e0704d83e1b803c",
"url": "https://git.kernel.org/stable/c/908b92231e1ded53e43fcfad5e0704d83e1b803c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a21f735fb1017ef89c6f9dbf4d799513b4e7bd5a",
"url": "https://git.kernel.org/stable/c/a21f735fb1017ef89c6f9dbf4d799513b4e7bd5a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c623b63580880cc742255eaed3d79804c1b91143",
"url": "https://git.kernel.org/stable/c/c623b63580880cc742255eaed3d79804c1b91143"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d16827cb1d3936f7627d0da6044483f743ebde03",
"url": "https://git.kernel.org/stable/c/d16827cb1d3936f7627d0da6044483f743ebde03"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d616bb10de79e5c2bd8a24230a1128aeaf715615",
"url": "https://git.kernel.org/stable/c/d616bb10de79e5c2bd8a24230a1128aeaf715615"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/df2e90d6a9955510f24f1dada78cfc439fd9fa88",
"url": "https://git.kernel.org/stable/c/df2e90d6a9955510f24f1dada78cfc439fd9fa88"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ed4168d1a50fef5be8eca947fbbf05a28507d265",
"url": "https://git.kernel.org/stable/c/ed4168d1a50fef5be8eca947fbbf05a28507d265"
},
{
"category": "external",
"summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"release_date": "2026-05-28T10:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
]
},
{
"cve": "CVE-2026-98827",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE\n\n__hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a\nsingle tx_buf of MAX_TX_BUF_SIZE (32768) bytes, limiting the batch\nby record count but never by cumulative byte length.\n\nWith large frames (MTU 2304), 20 aggregated frames of 2292 bytes\neach exceed the allocation (20 * 2296 = 45920 bytes), so the\nmemcpy() in the loop writes up to 13152 bytes past tx_buf->buf\nbefore usb_submit_urb().\n\nPeek the queue head and stop before copying any record that would\ncross MAX_TX_BUF_SIZE, then dispatch the current batch. Leftover\nskbs remain queued and are drained on the next URB completion.\n\nThe byte bound changes the loop's exit semantics: it can now exit\nbefore i == tx_skb_cnt - 1. Stock only finalized tx_buf->len on\nthat last index (len += offset), so an early break would submit a\nURB holding only the last record's length while every dequeued skb\nis freed on completion, silently dropping frames. Make tx_buf->len\na running total and advance tx_buf->offset per record instead; the\nstride round_up(nskb->len + 4, 4) is identical to the stock stride\nwhen the loop runs to completion.\n\nTested on hardware with an MTU 2304 flood: the loop stops at\nrecord 15 (len = 32144, offset = 32144, within 32768), no\noversized URB is submitted, and MTU 1500 pings pass 20/20.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98827"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/345ce265cf604e84b5b560c21beaf4c6f269ab14",
"url": "https://git.kernel.org/stable/c/345ce265cf604e84b5b560c21beaf4c6f269ab14"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/aeaca27c1db3106967ffbb2b517d98c835f6d500",
"url": "https://git.kernel.org/stable/c/aeaca27c1db3106967ffbb2b517d98c835f6d500"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c18882768a0fe253c70986c5fe66d9241570fbc4",
"url": "https://git.kernel.org/stable/c/c18882768a0fe253c70986c5fe66d9241570fbc4"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e73a619f91b6cfec47bc1a94aea28df6849e5be3",
"url": "https://git.kernel.org/stable/c/e73a619f91b6cfec47bc1a94aea28df6849e5be3"
}
],
"release_date": "2026-10-18T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-64009",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n install an IPv4 ESP tunnel SA with a large authentication key\n (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n large value. When a single UDP datagram is then sent through the\n tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n esp_output() consumes it as a signed int via:\n\n padto = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))\n esp.tfclen = padto - skb->len (assigned to int)\n\n esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n when passed to memset() inside esp_output_fill_trailer(), producing a\n ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-64009"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93",
"url": "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed",
"url": "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789",
"url": "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90",
"url": "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3",
"url": "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda",
"url": "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2",
"url": "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0",
"url": "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0"
}
],
"release_date": "2026-07-19T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2022-50697",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmrp: introduce active flags to prevent UAF when applicant uninit\n\nThe caller of del_timer_sync must prevent restarting of the timer, If\nwe have no this synchronization, there is a small probability that the\ncancellation will not be successful.\n\nAnd syzbot report the fellowing crash:\n==================================================================\nBUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline]\nBUG: KASAN: use-after-free in enqueue_timer+0x18/0xa4 kernel/time/timer.c:605\nWrite at addr f9ff000024df6058 by task syz-fuzzer/2256\nPointer tag: [f9], memory tag: [fe]\n\nCPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted 6.1.0-rc5-syzkaller-00008-\nge01d50cbd6ee #0\nHardware name: linux,dummy-virt (DT)\nCall trace:\n dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156\n dump_backtrace arch/arm64/kernel/stacktrace.c:162 [inline]\n show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:284 [inline]\n print_report+0x1a8/0x4a0 mm/kasan/report.c:395\n kasan_report+0x94/0xb4 mm/kasan/report.c:495\n __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320\n do_bad_area arch/arm64/mm/fault.c:473 [inline]\n do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749\n do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825\n el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367\n el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427\n el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576\n hlist_add_head include/linux/list.h:929 [inline]\n enqueue_timer+0x18/0xa4 kernel/time/timer.c:605\n mod_timer+0x14/0x20 kernel/time/timer.c:1161\n mrp_periodic_timer_arm net/802/mrp.c:614 [inline]\n mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627\n call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474\n expire_timers+0x98/0xc4 kernel/time/timer.c:1519\n\nTo fix it, we can introduce a new active flags to make sure the timer will\nnot restart.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2022-50697"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1a185fe83c2a60c1e3596fb9d82dbeb148dc09c6",
"url": "https://git.kernel.org/stable/c/1a185fe83c2a60c1e3596fb9d82dbeb148dc09c6"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/563e45fd5046045cc194af3ba17f5423e1c98170",
"url": "https://git.kernel.org/stable/c/563e45fd5046045cc194af3ba17f5423e1c98170"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5d5a481a7fd0234f617535dc464ea010804a1129",
"url": "https://git.kernel.org/stable/c/5d5a481a7fd0234f617535dc464ea010804a1129"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/755eb0879224ffc2a43de724554aeaf0e51e5a64",
"url": "https://git.kernel.org/stable/c/755eb0879224ffc2a43de724554aeaf0e51e5a64"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/78d48bc41f7726113c9f114268d3ab11212814da",
"url": "https://git.kernel.org/stable/c/78d48bc41f7726113c9f114268d3ab11212814da"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/98f53e591940e4c3818be358c5dc684d5b30cb56",
"url": "https://git.kernel.org/stable/c/98f53e591940e4c3818be358c5dc684d5b30cb56"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/aacffc1a8dbf67c5463cb4f67b37143c01ca6fa9",
"url": "https://git.kernel.org/stable/c/aacffc1a8dbf67c5463cb4f67b37143c01ca6fa9"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/aadb1507a77b060c529edfeaf67f803e31461f24",
"url": "https://git.kernel.org/stable/c/aadb1507a77b060c529edfeaf67f803e31461f24"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ab0377803dafc58f1e22296708c1c28e309414d6",
"url": "https://git.kernel.org/stable/c/ab0377803dafc58f1e22296708c1c28e309414d6"
}
],
"release_date": "2025-12-24T11:15:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98276",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lock the socket in sock_gettstamp()\n\nsk->sk_flags must only be changed while holding the socket lock,\nbecause sock_set_flag() and sock_reset_flag() use non atomic\noperations (__set_bit() and __clear_bit()).\n\nsock_gettstamp() is one of the last places where a bit of sk->sk_flags\nis changed from a syscall without owning the socket lock, through\nsock_enable_timestamp(sk, SOCK_TIMESTAMP).\n\nsk_set_memalloc() and sk_clear_memalloc() also change sk->sk_flags\nwithout the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp,\nsunrpc, wireguard) need a careful audit, this will be addressed in a\nseparate patch.\n\nJungwoo Lee and Wongi Lee reported an UDP socket use-after-free\ncaused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind()\ncan cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set,\nbecause both threads perform a read-modify-write on the same word.\n\n CPU 0 (bind) CPU 1 (SIOCGSTAMPNS_NEW)\n -------------------------------- ----------------------------\n read sk_flags = F read sk_flags = F\n compute F | BIT(SOCK_RCU_FREE) compute F | BIT(SOCK_TIMESTAMP)\n store F | BIT(SOCK_RCU_FREE)\n sk_add_node_rcu(sk, ...)\n store F | BIT(SOCK_TIMESTAMP)\n\nAfter the lost update, SOCK_RCU_FREE is clear while the socket is\nvisible to lockless UDP receive lookups. sk_destruct() then frees\nthe socket immediately instead of waiting for a RCU grace period,\nwhile the receive path still holds a reference-less pointer to it:\n\n BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410\n Read of size 8 at addr ffff888008806610 by task exploit/207\n CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1\n ipv4_pktinfo_prepare+0x30/0x410\n udp_queue_rcv_one_skb+0x51c/0x1180\n udp_unicast_rcv_skb+0x109/0x350\n ip_protocol_deliver_rcu+0x14b/0x310\n ip_local_deliver_finish+0x29d/0x390\n ip_local_deliver+0x24d/0x2a0\n\nOnly grab the socket lock when SOCK_TIMESTAMP has to be set,\nto keep the common case lockless.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98276"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f",
"url": "https://git.kernel.org/stable/c/17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/18899e2e4023369a8f7739c2255a59a9748d8d17",
"url": "https://git.kernel.org/stable/c/18899e2e4023369a8f7739c2255a59a9748d8d17"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1f73253add8365d0dad0a4f421acaa8c21d20cef",
"url": "https://git.kernel.org/stable/c/1f73253add8365d0dad0a4f421acaa8c21d20cef"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3b12d3967e96f1b7b977d9fc352ae29a1b299a82",
"url": "https://git.kernel.org/stable/c/3b12d3967e96f1b7b977d9fc352ae29a1b299a82"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/88c804847dd87dc613b771b392ccecdb94725032",
"url": "https://git.kernel.org/stable/c/88c804847dd87dc613b771b392ccecdb94725032"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/899650bbf985b7bfd2a7b808357df9b16e6d6959",
"url": "https://git.kernel.org/stable/c/899650bbf985b7bfd2a7b808357df9b16e6d6959"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/9ed55f3dbef4f4adfe65eb03b0c35c53229a8490",
"url": "https://git.kernel.org/stable/c/9ed55f3dbef4f4adfe65eb03b0c35c53229a8490"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d9f96bc2d822501f84d1caa6275a2c6b316ca2c4",
"url": "https://git.kernel.org/stable/c/d9f96bc2d822501f84d1caa6275a2c6b316ca2c4"
}
],
"release_date": "2026-10-06T09:18:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2023-53800",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nubi: Fix use-after-free when volume resizing failed\n\nThere is an use-after-free problem reported by KASAN:\n ==================================================================\n BUG: KASAN: use-after-free in ubi_eba_copy_table+0x11f/0x1c0 [ubi]\n Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735\n\n CPU: 2 PID: 4735 Comm: ubirsvol\n Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\n BIOS 1.14.0-1.fc33 04/01/2014\n Call Trace:\n \n dump_stack_lvl+0x34/0x44\n print_report+0x171/0x472\n kasan_report+0xad/0x130\n ubi_eba_copy_table+0x11f/0x1c0 [ubi]\n ubi_resize_volume+0x4f9/0xbc0 [ubi]\n ubi_cdev_ioctl+0x701/0x1850 [ubi]\n __x64_sys_ioctl+0x11d/0x170\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n \n\nWhen ubi_change_vtbl_record() returns an error in ubi_resize_volume(),\n\"new_eba_tbl\" will be freed on error handing path, but it is holded\nby \"vol->eba_tbl\" in ubi_eba_replace_table(). It means that the liftcycle\nof \"vol->eba_tbl\" and \"vol\" are different, so when resizing volume in\nnext time, it causing an use-after-free fault.\n\nFix it by not freeing \"new_eba_tbl\" after it replaced in\nubi_eba_replace_table(), while will be freed in next volume resizing.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2023-53800"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/35f8d4064e54c18424db2997059d4c0b1d13d093",
"url": "https://git.kernel.org/stable/c/35f8d4064e54c18424db2997059d4c0b1d13d093"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3d6378f7056ac7350338f941001162a8f660853c",
"url": "https://git.kernel.org/stable/c/3d6378f7056ac7350338f941001162a8f660853c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/53818746e549e61841428892a8d94344494be797",
"url": "https://git.kernel.org/stable/c/53818746e549e61841428892a8d94344494be797"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/9af31d6ec1a4be4caab2550096c6bd2ba8fba472",
"url": "https://git.kernel.org/stable/c/9af31d6ec1a4be4caab2550096c6bd2ba8fba472"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/9c8be1f165baee53b5a36ea0b3c9281d403a1d0b",
"url": "https://git.kernel.org/stable/c/9c8be1f165baee53b5a36ea0b3c9281d403a1d0b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b0c951742348d216f094d16ed4f70ae73db881c0",
"url": "https://git.kernel.org/stable/c/b0c951742348d216f094d16ed4f70ae73db881c0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bf795ebbb9995e2fe7945de71177f01c2f1215dc",
"url": "https://git.kernel.org/stable/c/bf795ebbb9995e2fe7945de71177f01c2f1215dc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bf9875aa7f7d624a8c084425b14bf7e5907ebc30",
"url": "https://git.kernel.org/stable/c/bf9875aa7f7d624a8c084425b14bf7e5907ebc30"
}
],
"release_date": "2025-12-09T01:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98425",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don't warn when an IBSS has no channel to scan\n\nieee80211_request_ibss_scan() warns when regulatory leaves no\nallowed channel, but that can happen as the regdomain can change\nwhile IBSS is operating, and it can continue to operate briefly\nduring the 60s grace period until it's shut down.\n\nJust remove the warning in this case.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98425"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/23d51c0bc18f21d957756ba4650520bb3bc726b2",
"url": "https://git.kernel.org/stable/c/23d51c0bc18f21d957756ba4650520bb3bc726b2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5f139e17f5bdba6b68177dd8afe13fa4549dfc5f",
"url": "https://git.kernel.org/stable/c/5f139e17f5bdba6b68177dd8afe13fa4549dfc5f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a7491b7efbd9136b120a12ed72af9c12121dd134",
"url": "https://git.kernel.org/stable/c/a7491b7efbd9136b120a12ed72af9c12121dd134"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bb91c15953705445778c170a2523f12351c4d928",
"url": "https://git.kernel.org/stable/c/bb91c15953705445778c170a2523f12351c4d928"
}
],
"release_date": "2026-10-14T14:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98491",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up committing both but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants to commit and runs the helpers wiring up\n the extension pointer into the expectation list.\n 2. Then it looses the confirmation keeping the entry unconfirmed.\n 3. Second clone now wants to commit labels and adds the new extension\n for that breaking the pointer in the expectation list causing\n UAF on the destruction path later.\n\nWhile this is possible to trigger, there should be no practical\nnetwork pipeline where committing both clones without modifications\ninto the same zone is needed. So, let's just reset the entry in case\nfor some reason we got an skb with a shared one during commit. This\ndoesn't affect any known use cases, but avoids any potential problems\nwith sharing and modification of the unconfirmed ct entry.\n\nThe fixes tag points to the introduction of helpers, since that's the\nmain UAF trigger for the sharing.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98491"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/26b2bd70d22457556e2fa01cbf1192cb1a94d619",
"url": "https://git.kernel.org/stable/c/26b2bd70d22457556e2fa01cbf1192cb1a94d619"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/37e3c878b183a115f9a114067f9ef3b408ad27fb",
"url": "https://git.kernel.org/stable/c/37e3c878b183a115f9a114067f9ef3b408ad27fb"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/457e0df1b5711fbeb7ba1b6bfd826f5ef30e7e55",
"url": "https://git.kernel.org/stable/c/457e0df1b5711fbeb7ba1b6bfd826f5ef30e7e55"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/55e5256adf3940e71802e2f749cacf81518726b0",
"url": "https://git.kernel.org/stable/c/55e5256adf3940e71802e2f749cacf81518726b0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/707c2dc77891a874f4e8c52c285a511079164ec8",
"url": "https://git.kernel.org/stable/c/707c2dc77891a874f4e8c52c285a511079164ec8"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/de41ee24f77b0fc45397db3e277cae2adbd43dfe",
"url": "https://git.kernel.org/stable/c/de41ee24f77b0fc45397db3e277cae2adbd43dfe"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e0fa5ea434b7e8467ef3adc64e3858b1ca2a642d",
"url": "https://git.kernel.org/stable/c/e0fa5ea434b7e8467ef3adc64e3858b1ca2a642d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e2829ae5459ddb5fce526b2e84697edf6c0c3cef",
"url": "https://git.kernel.org/stable/c/e2829ae5459ddb5fce526b2e84697edf6c0c3cef"
}
],
"release_date": "2026-10-18T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2023-53799",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: api - Use work queue in crypto_destroy_instance\n\nThe function crypto_drop_spawn expects to be called in process\ncontext. However, when an instance is unregistered while it still\nhas active users, the last user may cause the instance to be freed\nin atomic context.\n\nFix this by delaying the freeing to a work queue.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2023-53799"
}
],
"release_date": "2025-12-09T00:00:55Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98548",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: discard the rest of the packet on a stale-cookie error\n\nWhen an association is in COOKIE-ECHOED state and the peer sends a\nbundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary\naddresses, processing the ERROR chunk takes the non-fatal stale-cookie\nretry path sctp_sf_do_5_2_6_stale(), which queues\nSCTP_CMD_DEL_NON_PRIMARY while keeping the association alive.\nsctp_cmd_del_non_primary() removes every non-primary transport -\nincluding the very transport this packet arrived on, which is still\nreferenced by the receive lookup and shared by all chunks of the\npacket via chunk->transport.\n\nsctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from\nthe removed transport, but right afterwards the bundled DATA chunk\nmakes sctp_assoc_bh_rcv() re-register\nasoc->peer.last_data_from = chunk->transport unconditionally, undoing\nthe redirection with the just-removed transport.\n\nOnce the packet is done, the receive reference is dropped and the\ntransport is RCU-freed, while the surviving association keeps the\ndangling last_data_from. A later FWD-TSN (or the delayed SACK timer)\nmakes sctp_gen_sack() dereference it (->param_flags and friends), and\nsctp_make_sack()/sctp_outq_select_transport() may write to the freed\nobject and link it into the live transport list. This is a\nuse-after-free triggerable by any malicious SCTP peer (or a local\nunprivileged user acting as one) with no capabilities required:\n\n BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660\n Read of size 4 at addr ffff88800e1e356c by task poc/115\n Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <-\n sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv\n Allocated: sctp_transport_new <- sctp_assoc_add_peer <-\n sctp_process_init (INIT-ACK processing)\n Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core\n (call_rcu queued by sctp_transport_put at end of sctp_rcv)\n The buggy address is located 364 bytes inside of freed 1024-byte\n region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k\n\nNote that commit 03a9d10ecf71 (\"sctp: drop a chunk if its transport\nwas removed\") only covers the window between the receive lookup and\nthe chunk processing (e.g. an ASCONF DEL-IP racing the socket backlog);\nhere the transport is removed *while* the packet is being processed,\nby an earlier chunk of the same packet, so the drop in sctp_inq_push()\ndoes not reach this path. Verified with the bundled [ERROR(Stale\nCookie)][DATA] + FWD-TSN reproducer: the KASAN report above still\nfires with that commit applied, and is gone with this patch on top.\n\nFix it by discarding the rest of the packet on this path, as suggested\nby Xin. After the stale-cookie ERROR has sent the association back to\nCOOKIE-WAIT and removed the non-primary transports, the remaining\nchunks of the packet can only run against the restarted handshake\nwhile referencing the removed arrival transport through\nchunk->transport: besides the last_data_from registration above,\nsctp_cmd_setup_t2() and the sctp_make_*() reply builders would also\ncopy that pointer into association-lifetime state that\nsctp_assoc_rm_peer() has already sanitized. Let the peer retransmit\nthem, in line with what sctp_inq_push() does for chunks whose\ntransport was removed before processing.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98548"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1cd246b214dc9acf4e2f11d58c035e1e672fe7d2",
"url": "https://git.kernel.org/stable/c/1cd246b214dc9acf4e2f11d58c035e1e672fe7d2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4498467a8af06cfa3d71cb04bd7c4170dec8f449",
"url": "https://git.kernel.org/stable/c/4498467a8af06cfa3d71cb04bd7c4170dec8f449"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6df536c5acbc0abd6f119d02e24f4a2ed97707f4",
"url": "https://git.kernel.org/stable/c/6df536c5acbc0abd6f119d02e24f4a2ed97707f4"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/854c053c71459f8db7ef07db9cfa4eec5f5206f2",
"url": "https://git.kernel.org/stable/c/854c053c71459f8db7ef07db9cfa4eec5f5206f2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/965e21ea16acb394d5e5801998ca9b0adc669665",
"url": "https://git.kernel.org/stable/c/965e21ea16acb394d5e5801998ca9b0adc669665"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a",
"url": "https://git.kernel.org/stable/c/c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d68c9287b3ca0d6faadc61fbcb18d1a6b5493321",
"url": "https://git.kernel.org/stable/c/d68c9287b3ca0d6faadc61fbcb18d1a6b5493321"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ec23855274a73906b02f0d124fefd9cb3c008b1d",
"url": "https://git.kernel.org/stable/c/ec23855274a73906b02f0d124fefd9cb3c008b1d"
}
],
"release_date": "2026-10-18T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-46119",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix slab-out-of-bounds access in auth message processing\n\nIf a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY\ncontains a positive value in its result field, it is treated as an\nerror code by ceph_handle_auth_reply() and returned to\nhandle_auth_reply(). Thereafter, an attempt is made to send the\npreallocated message of type CEPH_MSG_AUTH, where the returned value is\ninterpreted as the size of the front segment to send. If the result\nvalue in the message is greater than the size of the memory buffer\nallocated for the front segment, an out-of-bounds access occurs, and\nthe content of the memory region beyond this buffer is sent out.\n\nThis patch fixes the issue by treating only negative values in the\nresult field as errors. Positive values are therefore treated as success\nin the same way as a zero value. Additionally, a BUG_ON is added to\n__send_prepared_auth_request() comparing the len parameter to\nfront_alloc_len to prevent sending the message if it exceeds the bounds\nof the allocation and to make it easier to catch any logic flaws leading\nto this.",
"title": "Vulnerability description"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-46119"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1c439de70b1c3eb3c6bffa8245c16b9fc318f114",
"url": "https://git.kernel.org/stable/c/1c439de70b1c3eb3c6bffa8245c16b9fc318f114"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2ae0afd98432536562fa8261538ae795446f0589",
"url": "https://git.kernel.org/stable/c/2ae0afd98432536562fa8261538ae795446f0589"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/38fdf04c602d52c42c67fc1617211492753b7e8b",
"url": "https://git.kernel.org/stable/c/38fdf04c602d52c42c67fc1617211492753b7e8b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/408e85ee708b6aa03eeb0220ffa0915f4d407181",
"url": "https://git.kernel.org/stable/c/408e85ee708b6aa03eeb0220ffa0915f4d407181"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8517b6c8d2c759918ba0058cb6c7e14d59643202",
"url": "https://git.kernel.org/stable/c/8517b6c8d2c759918ba0058cb6c7e14d59643202"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b7df9fbd4869fdfe09a3f501ffd228486521e062",
"url": "https://git.kernel.org/stable/c/b7df9fbd4869fdfe09a3f501ffd228486521e062"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c2374b92c729d0388a538b3cde7b3e3b5e55ef39",
"url": "https://git.kernel.org/stable/c/c2374b92c729d0388a538b3cde7b3e3b5e55ef39"
}
],
"release_date": "2026-05-28T10:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
]
},
{
"cve": "CVE-2026-63804",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fix use-after-free in gfs2_qd_dealloc\n\ngfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(),\naccesses the superblock object sdp through qd->qd_sbd after freeing qd.\nIt does so to decrement sd_quota_count and wake up sd_kill_wait.\n\nHowever, by the time the RCU callback runs, gfs2_put_super() may have\nalready freed sdp via free_sbd(). This can happen when\ngfs2_quota_cleanup() is called during unmount: it disposes of quota\nobjects via call_rcu() and then waits on sd_kill_wait with a 60-second\ntimeout. If the timeout expires, or if gfs2_gl_hash_clear() triggers\nadditional qd_put() calls that schedule more RCU callbacks after the\nwait completes, gfs2_put_super() will proceed to free the superblock\nwhile RCU callbacks referencing it are still pending.\n\nAdd an rcu_barrier() before free_sbd() in gfs2_put_super() to ensure\nall pending RCU callbacks (including gfs2_qd_dealloc) have completed\nbefore the superblock is freed.",
"title": "Vulnerability description"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-63804"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4fe388218826df8607ae41a6305df67db08a9093",
"url": "https://git.kernel.org/stable/c/4fe388218826df8607ae41a6305df67db08a9093"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8745d9f7e1682c39f0a1578895ac74205e2a6757",
"url": "https://git.kernel.org/stable/c/8745d9f7e1682c39f0a1578895ac74205e2a6757"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/9d0d5ba20cad661f7f287d4c66d2c19022ce2fd0",
"url": "https://git.kernel.org/stable/c/9d0d5ba20cad661f7f287d4c66d2c19022ce2fd0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b85ef03f726b15047a6fa6d11b639bdf6c0ee4f0",
"url": "https://git.kernel.org/stable/c/b85ef03f726b15047a6fa6d11b639bdf6c0ee4f0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f9c9ec2c319f843b70ecdf939d48b52d189bc081",
"url": "https://git.kernel.org/stable/c/f9c9ec2c319f843b70ecdf939d48b52d189bc081"
}
],
"release_date": "2026-07-19T12:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
]
},
{
"cve": "CVE-2026-74267",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen\n\nWhenever codel drops packets during peek, it calls\nqdisc_tree_reduce_backlog. An issue arises because it calls\nqdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops\nto zero, but peek returns an skb, the parent's qlen_notify callback will\nbe executed even though codel still has 1 packet on the queue and, thus,\nwill mistakenly deactivate the parent's class causing issues like a wild\nmemory access when qfq has codel as a child:\n\n[ 36.339843][ T370] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI\n[ 36.340408][ T370] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127]\n[ 36.340737][ T370] CPU: 2 UID: 0 PID: 370 Comm: tc Not tainted 7.1.0-rc5-00287-g66e13b626592 #87 PREEMPT(full)\n[ 36.341113][ T370] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 36.341357][ T370] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq\n[ 36.342221][ T370] RSP: 0018:ffff8881100ef370 EFLAGS: 00010216\n[ 36.342422][ T370] RAX: 0000000000000000 RBX: ffff8881058a9568 RCX: dffffc0000000000\n[ 36.342664][ T370] RDX: 1ffff11021064dc3 RSI: ffff888108326e00 RDI: dffffc0000000000\n[ 36.342905][ T370] RBP: ffff8881058a8280 R08: dead000000000122 R09: 1bd5a00000000024\n[ 36.343140][ T370] R10: fffffbfff2940329 R11: fffffbfff2940329 R12: 0000000000000000\n[ 36.343383][ T370] R13: dead000000000100 R14: ffff8881058a9580 R15: ffff8881058a9578\n[ 36.343631][ T370] FS: 00007fc04b0ca780(0000) GS:ffff888184fef000(0000) knlGS:0000000000000000\n[ 36.343911][ T370] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 36.344116][ T370] CR2: 0000557c02c02000 CR3: 000000010e0ba000 CR4: 0000000000750ef0\n[ 36.344359][ T370] PKRU: 55555554\n[ 36.344481][ T370] Call Trace:\n...\n[ 36.345054][ T370] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq\n[ 36.345222][ T370] qdisc_reset (net/sched/sch_generic.c:1057)\n[ 36.345503][ T370] __qdisc_destroy (net/sched/sch_generic.c:1096)\n[ 36.345677][ T370] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159)\n[ 36.346335][ T370] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556)\n\nFix this by only calling qdisc_tree_reduce_backlog in peek after the\nqlen is restored.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-74267"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/52f1da34c9f4d5bdc1e8b44242da5c7ba8db85f3",
"url": "https://git.kernel.org/stable/c/52f1da34c9f4d5bdc1e8b44242da5c7ba8db85f3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/755108bb7a5083e911294c416cfea605dc75632f",
"url": "https://git.kernel.org/stable/c/755108bb7a5083e911294c416cfea605dc75632f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7a05af7f58566682b73578b72ca8e53a268c43bd",
"url": "https://git.kernel.org/stable/c/7a05af7f58566682b73578b72ca8e53a268c43bd"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/91e0a793a72374c20ab31a40ccec21373e82e973",
"url": "https://git.kernel.org/stable/c/91e0a793a72374c20ab31a40ccec21373e82e973"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bb9cfd874ee884117b33e92a002b9a45b48202f4",
"url": "https://git.kernel.org/stable/c/bb9cfd874ee884117b33e92a002b9a45b48202f4"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e4615aa6bb7802944ae790cb4b3ef8c1b7491af3",
"url": "https://git.kernel.org/stable/c/e4615aa6bb7802944ae790cb4b3ef8c1b7491af3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e8c6dbadf139cb14ea6ed14add6ed6e88504dedd",
"url": "https://git.kernel.org/stable/c/e8c6dbadf139cb14ea6ed14add6ed6e88504dedd"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/eba49fd85995a3851c597fa2d214f8d21736e1d8",
"url": "https://git.kernel.org/stable/c/eba49fd85995a3851c597fa2d214f8d21736e1d8"
}
],
"release_date": "2026-08-15T06:22:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2022-49157",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix premature hw access after PCI error\n\nAfter a recoverable PCI error has been detected and recovered, qla driver\nneeds to check to see if the error condition still persist and/or wait\nfor the OS to give the resume signal.\n\nSep 8 22:26:03 localhost kernel: WARNING: CPU: 9 PID: 124606 at qla_tmpl.c:440\nqla27xx_fwdt_entry_t266+0x55/0x60 [qla2xxx]\nSep 8 22:26:03 localhost kernel: RIP: 0010:qla27xx_fwdt_entry_t266+0x55/0x60\n[qla2xxx]\nSep 8 22:26:03 localhost kernel: Call Trace:\nSep 8 22:26:03 localhost kernel: ? qla27xx_walk_template+0xb1/0x1b0 [qla2xxx]\nSep 8 22:26:03 localhost kernel: ? qla27xx_execute_fwdt_template+0x12a/0x160\n[qla2xxx]\nSep 8 22:26:03 localhost kernel: ? qla27xx_fwdump+0xa0/0x1c0 [qla2xxx]\nSep 8 22:26:03 localhost kernel: ? qla2xxx_pci_mmio_enabled+0xfb/0x120\n[qla2xxx]\nSep 8 22:26:03 localhost kernel: ? report_mmio_enabled+0x44/0x80\nSep 8 22:26:03 localhost kernel: ? report_slot_reset+0x80/0x80\nSep 8 22:26:03 localhost kernel: ? pci_walk_bus+0x70/0x90\nSep 8 22:26:03 localhost kernel: ? aer_dev_correctable_show+0xc0/0xc0\nSep 8 22:26:03 localhost kernel: ? pcie_do_recovery+0x1bb/0x240\nSep 8 22:26:03 localhost kernel: ? aer_recover_work_func+0xaa/0xd0\nSep 8 22:26:03 localhost kernel: ? process_one_work+0x1a7/0x360\n..\nSep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-8041:22: detected PCI\ndisconnect.\nSep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22:\nqla27xx_fwdt_entry_t262: dump ram MB failed. Area 5h start 198013h end 198013h\nSep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-107ff:22: Unable to\ncapture FW dump\nSep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-1015:22: cmd=0x0,\nwaited 5221 msecs\nSep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-680d:22: mmio\nenabled returning.\nSep 8 22:26:03 localhost kernel: qla2xxx [0000:42:00.2]-d04c:22: MBX\nCommand timeout for cmd 0, iocontrol=ffffffff jiffies=10140f2e5\nmb[0-3]=[0xffff 0xffff 0xffff 0xffff]",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2022-49157"
}
],
"release_date": "2025-02-26T01:55:20Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98460",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sock: reject out-of-range OCF values\n\nThe raw HCI socket security filter has 128 OCF bits per supported OGF,\nbut masks the 10-bit OCF with 127 before looking up the command. An\nunprivileged socket can therefore submit a reserved OCF that aliases an\nallowlisted command modulo 128.\n\nA conforming controller should reject reserved opcodes. Nevertheless,\nthe security decision must apply to the opcode that will actually be\nsent, especially since controller-specific behavior is outside the host\nstack's control.\n\nReject OCF values that cannot be represented by the security filter\ninstead of aliasing them onto an unrelated command.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98460"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/173457fa3e99ef4188dd0fe63e4dee98d0e441a9",
"url": "https://git.kernel.org/stable/c/173457fa3e99ef4188dd0fe63e4dee98d0e441a9"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/320dedad15e8bbaecc8d2d7fd4189defb84caa85",
"url": "https://git.kernel.org/stable/c/320dedad15e8bbaecc8d2d7fd4189defb84caa85"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/47d67ec424e63e61e9eb58633d43a9d58a1852b6",
"url": "https://git.kernel.org/stable/c/47d67ec424e63e61e9eb58633d43a9d58a1852b6"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/598686f5d65b9af2223ed9d22fadba16e09f6ca8",
"url": "https://git.kernel.org/stable/c/598686f5d65b9af2223ed9d22fadba16e09f6ca8"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/68f0bcc4e16e31ff8dbe6ca93116eb70d7b6ac44",
"url": "https://git.kernel.org/stable/c/68f0bcc4e16e31ff8dbe6ca93116eb70d7b6ac44"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/70b0a27bdde0cb524349c8261202c7c9393cf5e9",
"url": "https://git.kernel.org/stable/c/70b0a27bdde0cb524349c8261202c7c9393cf5e9"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c1fd465ea1c5aef459f9bc3ac602b5353e0f536f",
"url": "https://git.kernel.org/stable/c/c1fd465ea1c5aef459f9bc3ac602b5353e0f536f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e93fad891c72deb84cae49430163b384ebcc92b1",
"url": "https://git.kernel.org/stable/c/e93fad891c72deb84cae49430163b384ebcc92b1"
}
],
"release_date": "2026-10-18T16:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-89552",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nparams: fix charp corruption on allocation failure\n\nparam_set_charp() stores charp parameters in allocated memory after slab is\navailable, and releases the previous value when the parameter is updated.\n\nThe previous value is released before the replacement allocation succeeds.\nIf kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter\nleft as NULL.\n\nFailing zswap's compressor update before zswap is initialized can later\ntrigger:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n RIP: 0010:strcmp+0x10/0x30\n Call Trace:\n zswap_setup+0x3b1/0x490\n zswap_enabled_param_set+0x5b/0xa0\n param_attr_store+0x93/0xe0\n module_attr_store+0x1c/0x30\n kernfs_fop_write_iter+0x116/0x1f0\n\nAllocate and copy the replacement first, then replace the parameter value\nonly after allocation succeeds.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-89552"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0d8e2404925a0607ffec79a53170715a46936896",
"url": "https://git.kernel.org/stable/c/0d8e2404925a0607ffec79a53170715a46936896"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/31b41ea8383d51992d6b0dfe3a99da1dec8ce1c1",
"url": "https://git.kernel.org/stable/c/31b41ea8383d51992d6b0dfe3a99da1dec8ce1c1"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3dfaae04243cde460d82dfc2a7dd0bb6664d20ae",
"url": "https://git.kernel.org/stable/c/3dfaae04243cde460d82dfc2a7dd0bb6664d20ae"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/614f873268c5b172804c9af6639bd17b7e1e2359",
"url": "https://git.kernel.org/stable/c/614f873268c5b172804c9af6639bd17b7e1e2359"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/704ecd010d4a9b33160e40b74eb402f6b86a18e0",
"url": "https://git.kernel.org/stable/c/704ecd010d4a9b33160e40b74eb402f6b86a18e0"
}
],
"release_date": "2026-09-11T20:19:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-63888",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()\n\nTwo latent bugs in the Text-phase handler, both present since the\noriginal LIO integration in commit e48354ce078c (\"iscsi-target: Add\niSCSI fabric support for target v4.1\"):\n\n1) DataDigest CRC buffer overread (4 bytes past text_in).\n\n text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then\n incremented by ISCSI_CRC_LEN to make room for the received DataDigest\n in the iovec, but the same (now-bumped) rx_size is passed as the\n buffer length to iscsit_crc_buf():\n\n if (conn->conn_ops->DataDigest) {\n ...\n rx_size += ISCSI_CRC_LEN;\n }\n ...\n if (conn->conn_ops->DataDigest) {\n data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);\n\n iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so\n when DataDigest is negotiated it reads 4 bytes past the end of the\n text_in allocation. KASAN reproduces this directly on the unpatched\n mainline tree as slab-out-of-bounds in crc32c() called from the Text\n PDU path. The OOB bytes feed crc32c() and are then compared against\n the initiator-supplied checksum, so the value does not flow back to\n the attacker, but the kernel does read past the buffer on every Text\n PDU with DataDigest=CRC32C.\n\n Fix by passing the actual padded payload length\n (ALIGN(payload_length, 4)) that was used for the kzalloc().\n\n2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest\n drop.\n\n On DataDigest mismatch with ErrorRecoveryLevel > 0 the handler\n silently drops the PDU and lets the initiator plug the CmdSN gap:\n\n kfree(text_in);\n return 0;\n\n cmd->text_in_ptr still points at the freed buffer. The next Text\n Request on the same ITT re-enters iscsit_setup_text_cmd(), which\n unconditionally does\n\n kfree(cmd->text_in_ptr);\n cmd->text_in_ptr = NULL;\n\n freeing the same pointer a second time. Session teardown via\n iscsit_release_cmd() has the same shape and hits the same double-free\n if the connection is dropped before a second Text Request arrives.\n\n On an unmodified mainline tree the bug-1 CRC overread fires first on\n the initial valid Text Request and perturbs the subsequent state, so\n #4 was isolated by building a kernel with only the bug-1 hunk of this\n patch applied plus temporary printk() observability around the three\n relevant kfree() sites. The observability prints are not part of\n this patch. On that build, a three-PDU Text Request sequence after\n login produces two back-to-back splats:\n\n BUG: KASAN: double-free in iscsit_setup_text_cmd+0x??\n BUG: KASAN: double-free in iscsit_release_cmd+0x??\n\n showing the same pointer freed in the ERL>0 drop path and again in\n iscsit_setup_text_cmd() (next Text Request on the same ITT) and once\n more in iscsit_release_cmd() (session teardown). On distro kernels\n with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free\n becomes a remote kernel BUG(); on non-hardened kernels it corrupts\n the slab freelist.\n\n Fix by clearing cmd->text_in_ptr after the kfree() in the ERL>0 drop\n path. With both hunks applied #4 is directly observable on the stock\n tree without observability printks; fixing bug-1 alone would mask #4\n less, not more, so the hunks are submitted together.\n\nBoth fixes are one-liners. The Text PDU state machine is unchanged and\nthe wire protocol is unaffected.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-63888"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5118ea225fe63b44207ba88047e4866e1ea43812",
"url": "https://git.kernel.org/stable/c/5118ea225fe63b44207ba88047e4866e1ea43812"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6e22a1cdcc8277af4acc43710577157b77a02c5d",
"url": "https://git.kernel.org/stable/c/6e22a1cdcc8277af4acc43710577157b77a02c5d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/778c2ab142c625a8a8afa570e0f9b7873f445d99",
"url": "https://git.kernel.org/stable/c/778c2ab142c625a8a8afa570e0f9b7873f445d99"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3",
"url": "https://git.kernel.org/stable/c/89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/badf178b76b0690851df00f4ca9cf2eb8eb0f963",
"url": "https://git.kernel.org/stable/c/badf178b76b0690851df00f4ca9cf2eb8eb0f963"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d3e9b79aa794f7a23e82de4d710e7d2df610e349",
"url": "https://git.kernel.org/stable/c/d3e9b79aa794f7a23e82de4d710e7d2df610e349"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ec9f19d52074a191ed1756ed4a7d39fff1a2085c",
"url": "https://git.kernel.org/stable/c/ec9f19d52074a191ed1756ed4a7d39fff1a2085c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f7948af0dd03de84079dcd4dc215a69fd6fbb95d",
"url": "https://git.kernel.org/stable/c/f7948af0dd03de84079dcd4dc215a69fd6fbb95d"
}
],
"release_date": "2026-07-19T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2023-53728",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-timers: Ensure timer ID search-loop limit is valid\n\nposix_timer_add() tries to allocate a posix timer ID by starting from the\ncached ID which was stored by the last successful allocation.\n\nThis is done in a loop searching the ID space for a free slot one by\none. The loop has to terminate when the search wrapped around to the\nstarting point.\n\nBut that's racy vs. establishing the starting point. That is read out\nlockless, which leads to the following problem:\n\nCPU0\t \t \t \t CPU1\nposix_timer_add()\n start = sig->posix_timer_id;\n lock(hash_lock);\n ...\t\t\t\t posix_timer_add()\n if (++sig->posix_timer_id < 0)\n \t\t\t start = sig->posix_timer_id;\n sig->posix_timer_id = 0;\n\nSo CPU1 can observe a negative start value, i.e. -1, and the loop break\nnever happens because the condition can never be true:\n\n if (sig->posix_timer_id == start)\n break;\n\nWhile this is unlikely to ever turn into an endless loop as the ID space is\nhuge (INT_MAX), the racy read of the start value caught the attention of\nKCSAN and Dmitry unearthed that incorrectness.\n\nRewrite it so that all id operations are under the hash lock.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2023-53728"
}
],
"release_date": "2025-10-22T13:23:57Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-80913",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: require every boolean value to be defined\n\np_bools.nprim comes from the policy image independently of how many\nbooleans follow it, and cond_index_bool() fills bool_val_to_struct[] at\nvalue - 1, so a count larger than the values present leaves NULL entries.\nEvery user of that array then walks it by index and dereferences each\nentry: cond_evaluate_expr() on the access-vector path,\nsecurity_get_bools() and security_get_bool_value() behind selinuxfs, and\nsecurity_set_bools(). A sparse class value is absorbed by\npolicydb_class_isvalid() and its siblings; booleans have no such\npredicate, and no consumer that could use one.\n\nReject a boolean value that no boolean defines, once, where the array is\nbuilt. Conforming policies define every boolean they declare and are\nunaffected.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-80913"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40",
"url": "https://git.kernel.org/stable/c/3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8",
"url": "https://git.kernel.org/stable/c/3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/42a7107f99d86a7524c37f108047dfa3db096ab5",
"url": "https://git.kernel.org/stable/c/42a7107f99d86a7524c37f108047dfa3db096ab5"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4d0ece18e648bd4362704fd087249ac697f2b7fb",
"url": "https://git.kernel.org/stable/c/4d0ece18e648bd4362704fd087249ac697f2b7fb"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4dfb997c60f7951011d3dcbee926e3a7f80d8a76",
"url": "https://git.kernel.org/stable/c/4dfb997c60f7951011d3dcbee926e3a7f80d8a76"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/740012aebdb8311332bf66e2aabf453ba73c2c45",
"url": "https://git.kernel.org/stable/c/740012aebdb8311332bf66e2aabf453ba73c2c45"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a93d37a09b863810653f93d371fb197457d59deb",
"url": "https://git.kernel.org/stable/c/a93d37a09b863810653f93d371fb197457d59deb"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec",
"url": "https://git.kernel.org/stable/c/ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec"
}
],
"release_date": "2026-09-04T18:18:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-89708",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown\n\nAfter a DESTROY_SESSION the per-session teardown path can free a\nsession while rpciod still holds an inflight callback rpc_task that\ndereferences clp->cl_cb_session. nfsd4_probe_callback_sync() flushes\ncl_callback_wq, but once nfsd4_run_cb_work() has called\nrpc_call_async() the rpc_task lives on rpciod; flushing the workqueue\ndoes not wait for it. rpc_shutdown_client() does drain rpciod tasks,\nbut uses a 1-second wait_event_timeout — tasks stuck in rpc_delay()\n(e.g. 2-second NFS4ERR_DELAY retries) can outlive the drain.\n\n destroy path rpciod\n ------------ ------\n unhash_session(ses)\n nfsd4_probe_callback_sync(clp)\n flush_workqueue(cl_callback_wq)\n /* returns; rpc_task still live */\n nfsd4_put_session_locked(ses)\n free_session(ses) -> kfree(ses)\n nfsd4_cb_sequence_done()\n reads cb_clp->cl_cb_session\n /* freed slab */\n\nA second window exists in nfsd4_process_cb_update(). When\n__nfsd4_find_backchannel() returns NULL because unhash_session() has\nalready removed the destroyed session from cl_sessions,\nsetup_callback_client() takes the v4.1 early return so\nclp->cl_cb_session = ses never fires and the field retains a pointer\nto the about-to-be-freed session.\n\nFix both by converting cl_cb_session to an RCU-protected pointer:\n\n - Move the cl_cb_session = ses assignment in setup_callback_client()\n to after rpc_create() succeeds, so it is only published when a\n working backchannel exists. Clear cl_cb_session on the error\n return in nfsd4_process_cb_update(). Both stores use\n rcu_assign_pointer().\n\n - Annotate cl_cb_session with __rcu. All rpciod-side readers use\n rcu_read_lock()/rcu_dereference() and check for NULL, bailing to\n the appropriate error or requeue path:\n encode_cb_sequence4args(), decode_cb_sequence4resok(),\n nfsd41_cb_get_slot(), nfsd41_cb_release_slot(),\n nfsd4_cb_prepare(), and nfsd4_cb_sequence_done().\n\n - Switch __free_session() from kfree() to kfree_rcu() so the\n session slab is not reclaimed until after an RCU grace period,\n guaranteeing that rpciod readers inside rcu_read_lock() never\n dereference freed memory.\n\n - Pass the session pointer to the nfsd_cb_seq_status and\n nfsd_cb_free_slot tracepoints instead of having them re-read\n cl_cb_session.\n\n - nfsd4_cb_prepare() calls rpc_exit() when the session is NULL,\n routing through the done/release path to requeue the callback.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-89708"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2",
"url": "https://git.kernel.org/stable/c/01c5d5f58a5db9b0ee5afba2e49d3157788687b2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25",
"url": "https://git.kernel.org/stable/c/13bdd486c3aad4fc19e6d8b9c3556a4b4c190b25"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2775ec1d617e665eab71ce0f13ab1f7959713a2b",
"url": "https://git.kernel.org/stable/c/2775ec1d617e665eab71ce0f13ab1f7959713a2b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f164eb52b6f3cbf40f07fe379f9f421f88e02f76",
"url": "https://git.kernel.org/stable/c/f164eb52b6f3cbf40f07fe379f9f421f88e02f76"
}
],
"release_date": "2026-09-11T20:19:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-90180",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: mtip32xx: synchronize ioctls with device removal\n\nThe ioctl handlers only test REMOVE_PENDING before entering\nmtip_hw_ioctl(). Removal can set that bit immediately afterwards and free\ndd->port in mtip_hw_exit() while an ioctl still dereferences it. An already\nopen block device can reach the handlers while del_gendisk() is in\nprogress.\n\nSerialize both native and compat ioctls with removal. Set REMOVE_PENDING\nbefore taking the mutex so new callers fail after an in-flight ioctl has\ndrained, and hold the mutex until the port has been torn down.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-90180"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4609e0e0be709e974bec9b52c5022136d25e97d3",
"url": "https://git.kernel.org/stable/c/4609e0e0be709e974bec9b52c5022136d25e97d3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/521afbd936ac256b7531470b0b9aa96abf9cd853",
"url": "https://git.kernel.org/stable/c/521afbd936ac256b7531470b0b9aa96abf9cd853"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/68940f841d013192086a0f6d7cfbac2cd079e228",
"url": "https://git.kernel.org/stable/c/68940f841d013192086a0f6d7cfbac2cd079e228"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8283049aa5fcb4e84b2b2928b2888903bb8ee12e",
"url": "https://git.kernel.org/stable/c/8283049aa5fcb4e84b2b2928b2888903bb8ee12e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8a7799597bd683b6bc251fe2edfa9fd1db568a3a",
"url": "https://git.kernel.org/stable/c/8a7799597bd683b6bc251fe2edfa9fd1db568a3a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b389dc35a55713ac24a145741e76196fea1663bc",
"url": "https://git.kernel.org/stable/c/b389dc35a55713ac24a145741e76196fea1663bc"
}
],
"release_date": "2026-09-17T17:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-89528",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject Read lists that exceed the page budget\n\nIndividual Read segment lengths are validated at decode time, but\nnothing prevents a requester from sending multiple segments whose\ncumulative length exceeds the rq_pages array budget. When one\nsegment fills the page array exactly, the runtime guard in\nsvc_rdma_build_read_segment() is bypassed because len reaches zero.\nA subsequent segment then accesses the NULL sentinel slot at\nrq_pages[rq_maxpages], resulting in a NULL pointer dereference during\nDMA mapping.\n\nAccumulate pages across all Read segments and reject the message at\ndecode time when the total would overflow the page budget.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-89528"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0ca487abb3bdf581851664b5db21f364caf57682",
"url": "https://git.kernel.org/stable/c/0ca487abb3bdf581851664b5db21f364caf57682"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1a3af2262cb384112ef38632de4690682be528b4",
"url": "https://git.kernel.org/stable/c/1a3af2262cb384112ef38632de4690682be528b4"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/465f511f59a0fa7a80d5d1073c4b24f28ea38f58",
"url": "https://git.kernel.org/stable/c/465f511f59a0fa7a80d5d1073c4b24f28ea38f58"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/beb4e9801f6362436102acc4cc5304b7324f9365",
"url": "https://git.kernel.org/stable/c/beb4e9801f6362436102acc4cc5304b7324f9365"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e70fdb121171c3eb0ac34eb545721828cd737717",
"url": "https://git.kernel.org/stable/c/e70fdb121171c3eb0ac34eb545721828cd737717"
}
],
"release_date": "2026-09-11T20:19:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-64363",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appleir: fix UAF on pending key_up_timer in remove()\n\nappleir_remove() runs hid_hw_stop() before timer_delete_sync().\nhid_hw_stop() synchronously unregisters the HID input device via\nhid_disconnect() -> hidinput_disconnect() -> input_unregister_device(),\nwhich drops the last reference and frees the underlying input_dev when\nno userspace handle holds it open.\n\nkey_up_tick() reads appleir->input_dev and calls input_report_key() /\ninput_sync() on it. The timer is armed from appleir_raw_event() with\na HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If a\nkey was pressed shortly before the device is disconnected, the timer\ncan fire after hid_hw_stop() has freed input_dev but before the\nteardown drains it.\n\nA simple reorder is not sufficient. Putting the timer drain first\nstill leaves a window where a USB URB completion (raw_event) running\nduring hid_hw_stop() can call mod_timer() and re-arm the timer, which\nthen fires after hidinput_disconnect() has freed input_dev. The same\nURB-completion window also lets raw_event() reach key_up(), key_down()\nand battery_flat() directly, all of which dereference\nappleir->input_dev.\n\nIntroduce a 'removing' flag on struct appleir, gated by the existing\nspinlock. appleir_remove() sets the flag under the lock and then\nshuts down the timer with timer_shutdown_sync(), which both drains any\nin-flight callback and permanently disables further mod_timer() calls.\nappleir_raw_event() and key_up_tick() bail out early if the flag is\nset, so no path can arm or run the timer, or dereference\nappleir->input_dev, after remove() has started tearing down.\n\nThe keyrepeat and flatbattery branches of appleir_raw_event()\npreviously called into the input layer without holding the spinlock;\ntake it now so the flag check is well-defined. This incidentally\ncloses a pre-existing read-side race on appleir->current_key in the\nkeyrepeat branch.\n\nThis bug is structurally a sibling of commit 4db2af929279 (\"HID:\nappletb-kbd: fix UAF in inactivity-timer cleanup path\") and has been\npresent since the driver was introduced.",
"title": "Vulnerability description"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-64363"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/05e3decc55d1deca9410e0eb36466651fcbe57a5",
"url": "https://git.kernel.org/stable/c/05e3decc55d1deca9410e0eb36466651fcbe57a5"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3755f6e25776b8b12ddf062f9b573f05090e4034",
"url": "https://git.kernel.org/stable/c/3755f6e25776b8b12ddf062f9b573f05090e4034"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/37a52c61d4f78153c38ae1f7491dfcc8ac828dcf",
"url": "https://git.kernel.org/stable/c/37a52c61d4f78153c38ae1f7491dfcc8ac828dcf"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3d30a0bb0e79621ae921b487835c56198adfafa3",
"url": "https://git.kernel.org/stable/c/3d30a0bb0e79621ae921b487835c56198adfafa3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6b0838e86da88b1d3bff86f19761ff25af73eaca",
"url": "https://git.kernel.org/stable/c/6b0838e86da88b1d3bff86f19761ff25af73eaca"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/75fe87e19d8aff81eb2c64d15d244ab8da4de945",
"url": "https://git.kernel.org/stable/c/75fe87e19d8aff81eb2c64d15d244ab8da4de945"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/89ef67359672bf4cd6921524e39f61648fe38c0f",
"url": "https://git.kernel.org/stable/c/89ef67359672bf4cd6921524e39f61648fe38c0f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b363d964ca829c1761c9f04188dfa28f90b0f2d4",
"url": "https://git.kernel.org/stable/c/b363d964ca829c1761c9f04188dfa28f90b0f2d4"
}
],
"release_date": "2026-07-25T10:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
]
},
{
"cve": "CVE-2026-98794",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: filter some flags received in the backup server\n\nWhile the IPVS SYNC protocol is not secure by design\nwe can still protect the backup server from messages that\ncan wreak havoc.\n\nThis commit addresses problems from received connection flags\nor their combinations. We now drop messages as follows:\n\n1. the NO_CPORT+TEMPLATE combination allows lookups for normal\nconnections to hit template which can break in many ways.\nWhile the master does not sync connections with NO_CPORT flag,\ni.e. before they are established, we still accept NO_CPORT\nwithout TEMPLATE.\n\n2. ONE_PACKET: it is not sent by master, so we do not\nexpect it in backup. Before now it was ignored by\nIP_VS_CONN_F_BACKUP_MASK for protocol v1 while protocol\nv0 created connections that are not hashed and dropped\nimmediately. Better to apply the IP_VS_CONN_F_BACKUP_MASK\nalso to the flags from v0 messages for consistency with v1.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98794"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/45a93111835ccfea7d969ec73588e33745fd9834",
"url": "https://git.kernel.org/stable/c/45a93111835ccfea7d969ec73588e33745fd9834"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/55d033324f67a15ff56be6d38d6e87f644e0ed62",
"url": "https://git.kernel.org/stable/c/55d033324f67a15ff56be6d38d6e87f644e0ed62"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d7d33c9efa9d1a2f244a1a64ec9b540b0f8975a0",
"url": "https://git.kernel.org/stable/c/d7d33c9efa9d1a2f244a1a64ec9b540b0f8975a0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f4cd1db7d421e82945713a36084bb0c35b75b27e",
"url": "https://git.kernel.org/stable/c/f4cd1db7d421e82945713a36084bb0c35b75b27e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f96e91748f6304668fe647e686d199d7207d36f1",
"url": "https://git.kernel.org/stable/c/f96e91748f6304668fe647e686d199d7207d36f1"
}
],
"release_date": "2026-10-18T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-63826",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: fix use-after-free in store_modes()\n\nstore_modes() replaces a framebuffer's modelist with modes from userspace.\nOn success it frees the old modelist with fb_destroy_modelist(). Two\nfields still point into that freed list.\n\nOne pointer is fb_display[i].mode, the mode a console is using.\nfbcon_new_modelist() moves these pointers to the new list. It only does so\nfor consoles still mapped to the framebuffer. An unmapped console is\nskipped and keeps its stale pointer. Unbinding fbcon, for example, sets\ncon2fb_map[i] to -1 but leaves fb_display[i].mode set. An\nFBIOPUT_VSCREENINFO ioctl with FB_ACTIVATE_INV_MODE later reaches\nfbcon_mode_deleted(). That function reads the stale fb_display[i].mode\nthrough fb_mode_is_equal(). The read is a use-after-free.\n\nThe other pointer is fb_info->mode, the current mode. It is set through\nthe mode sysfs attribute. store_modes() does not update fb_info->mode, so\nit is left pointing into the freed list. show_mode(), the attribute's read\nhandler, dereferences the stale fb_info->mode through mode_string(). The\nread is a use-after-free.\n\nClear both pointers before freeing the list. Commit a1f305893074 (\"fbcon:\nSet fb_display[i]->mode to NULL when the mode is released\") added the\nhelper fbcon_delete_modelist(). It clears every fb_display[i].mode that\npoints into a given list. So far it is called only from the unregister\npath. Call it from store_modes() too, and set fb_info->mode to NULL.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-63826"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0d35f9f194a858567a21017d69318a51e3a822b9",
"url": "https://git.kernel.org/stable/c/0d35f9f194a858567a21017d69318a51e3a822b9"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2c1c805c65fb7dc7524e20376d6987721e73a0b1",
"url": "https://git.kernel.org/stable/c/2c1c805c65fb7dc7524e20376d6987721e73a0b1"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5267eab88fa4c684459504b8be577ad64953b9a6",
"url": "https://git.kernel.org/stable/c/5267eab88fa4c684459504b8be577ad64953b9a6"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/70f1e000b88cfa8ca3fd7f4d082647fc089a7769",
"url": "https://git.kernel.org/stable/c/70f1e000b88cfa8ca3fd7f4d082647fc089a7769"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c6765f39ed27014ff877b00a2efa494233404e17",
"url": "https://git.kernel.org/stable/c/c6765f39ed27014ff877b00a2efa494233404e17"
}
],
"release_date": "2026-07-19T12:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2024-39480",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nkdb: Fix buffer overflow during tab-complete\n\nCurrently, when the user attempts symbol completion with the Tab key, kdb\nwill use strncpy() to insert the completed symbol into the command buffer.\nUnfortunately it passes the size of the source buffer rather than the\ndestination to strncpy() with predictably horrible results. Most obviously\nif the command buffer is already full but cp, the cursor position, is in\nthe middle of the buffer, then we will write past the end of the supplied\nbuffer.\n\nFix this by replacing the dubious strncpy() calls with memmove()/memcpy()\ncalls plus explicit boundary checks to make sure we have enough space\nbefore we start moving characters around.",
"title": "Vulnerability description"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2024-39480"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/107e825cc448b7834b31e8b1b3cf0f57426d46d5",
"url": "https://git.kernel.org/stable/c/107e825cc448b7834b31e8b1b3cf0f57426d46d5"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/33d9c814652b971461d1e30bead6792851c209e7",
"url": "https://git.kernel.org/stable/c/33d9c814652b971461d1e30bead6792851c209e7"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/cfdc2fa4db57503bc6d3817240547c8ddc55fa96",
"url": "https://git.kernel.org/stable/c/cfdc2fa4db57503bc6d3817240547c8ddc55fa96"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ddd2972d8e2dee3b33e8121669d55def59f0be8a",
"url": "https://git.kernel.org/stable/c/ddd2972d8e2dee3b33e8121669d55def59f0be8a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e9730744bf3af04cda23799029342aa3cddbc454",
"url": "https://git.kernel.org/stable/c/e9730744bf3af04cda23799029342aa3cddbc454"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f636a40834d22e5e3fc748f060211879c056cd33",
"url": "https://git.kernel.org/stable/c/f636a40834d22e5e3fc748f060211879c056cd33"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f694da720dcf795dc3eb97bf76d220213f76aaa7",
"url": "https://git.kernel.org/stable/c/f694da720dcf795dc3eb97bf76d220213f76aaa7"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/fb824a99e148ff272a53d71d84122728b5f00992",
"url": "https://git.kernel.org/stable/c/fb824a99e148ff272a53d71d84122728b5f00992"
}
],
"release_date": "2024-07-05T06:55:09Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
]
},
{
"cve": "CVE-2026-98457",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: validate frame length before control and FCS access\n\nl2cap_data_rcv() unpacks either a two-byte or four-byte control field\nwithout first ensuring that it is present. A short ERTM or streaming-mode\nframe can therefore cause an out-of-bounds read.\n\nThere is a second short-frame case when CRC16 is enabled. After the\ncontrol field is pulled, l2cap_check_fcs() subtracts two from skb->len\nwithout checking it. If fewer than two bytes remain, the subtraction\nwraps; skb_trim() leaves the buffer unchanged and the subsequent FCS\nload reads past the logical end of the frame.\n\nValidate that the frame contains both its control field and, when\nenabled, its FCS before either field is accessed.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98457"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1fdbb2a712a9a162ee817c959740face80b3d929",
"url": "https://git.kernel.org/stable/c/1fdbb2a712a9a162ee817c959740face80b3d929"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3acf6a0038ec0d4e8f4dcbfc2a557dff5f61cb70",
"url": "https://git.kernel.org/stable/c/3acf6a0038ec0d4e8f4dcbfc2a557dff5f61cb70"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4373ba79a267947e771c438507f7b103e30bdb21",
"url": "https://git.kernel.org/stable/c/4373ba79a267947e771c438507f7b103e30bdb21"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6c78a213d9070b610c7f418af2c25b66180b7e37",
"url": "https://git.kernel.org/stable/c/6c78a213d9070b610c7f418af2c25b66180b7e37"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8c7556c7cd17e073bbefdc4a9a4694a207544c37",
"url": "https://git.kernel.org/stable/c/8c7556c7cd17e073bbefdc4a9a4694a207544c37"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/965bd88ed4b4763cb765dd65885adcfa588c6b14",
"url": "https://git.kernel.org/stable/c/965bd88ed4b4763cb765dd65885adcfa588c6b14"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c6a288e6001bcce16553c3853e0f5a45eaaf85c7",
"url": "https://git.kernel.org/stable/c/c6a288e6001bcce16553c3853e0f5a45eaaf85c7"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f557274af7b94b6134692e6f26b880f1e34c15bf",
"url": "https://git.kernel.org/stable/c/f557274af7b94b6134692e6f26b880f1e34c15bf"
}
],
"release_date": "2026-10-18T16:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2025-39738",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not allow relocation of partially dropped subvolumes\n\n[BUG]\nThere is an internal report that balance triggered transaction abort,\nwith the following call trace:\n\n item 85 key (594509824 169 0) itemoff 12599 itemsize 33\n extent refs 1 gen 197740 flags 2\n ref#0: tree block backref root 7\n item 86 key (594558976 169 0) itemoff 12566 itemsize 33\n extent refs 1 gen 197522 flags 2\n ref#0: tree block backref root 7\n ...\n BTRFS error (device loop0): extent item not found for insert, bytenr 594526208 num_bytes 16384 parent 449921024 root_objectid 934 owner 1 offset 0\n BTRFS error (device loop0): failed to run delayed ref for logical 594526208 num_bytes 16384 type 182 action 1 ref_mod 1: -117\n ------------[ cut here ]------------\n BTRFS: Transaction aborted (error -117)\n WARNING: CPU: 1 PID: 6963 at ../fs/btrfs/extent-tree.c:2168 btrfs_run_delayed_refs+0xfa/0x110 [btrfs]\n\nAnd btrfs check doesn't report anything wrong related to the extent\ntree.\n\n[CAUSE]\nThe cause is a little complex, firstly the extent tree indeed doesn't\nhave the backref for 594526208.\n\nThe extent tree only have the following two backrefs around that bytenr\non-disk:\n\n item 65 key (594509824 METADATA_ITEM 0) itemoff 13880 itemsize 33\n refs 1 gen 197740 flags TREE_BLOCK\n tree block skinny level 0\n (176 0x7) tree block backref root CSUM_TREE\n item 66 key (594558976 METADATA_ITEM 0) itemoff 13847 itemsize 33\n refs 1 gen 197522 flags TREE_BLOCK\n tree block skinny level 0\n (176 0x7) tree block backref root CSUM_TREE\n\nBut the such missing backref item is not an corruption on disk, as the\noffending delayed ref belongs to subvolume 934, and that subvolume is\nbeing dropped:\n\n item 0 key (934 ROOT_ITEM 198229) itemoff 15844 itemsize 439\n generation 198229 root_dirid 256 bytenr 10741039104 byte_limit 0 bytes_used 345571328\n last_snapshot 198229 flags 0x1000000000001(RDONLY) refs 0\n drop_progress key (206324 EXTENT_DATA 2711650304) drop_level 2\n level 2 generation_v2 198229\n\nAnd that offending tree block 594526208 is inside the dropped range of\nthat subvolume. That explains why there is no backref item for that\nbytenr and why btrfs check is not reporting anything wrong.\n\nBut this also shows another problem, as btrfs will do all the orphan\nsubvolume cleanup at a read-write mount.\n\nSo half-dropped subvolume should not exist after an RW mount, and\nbalance itself is also exclusive to subvolume cleanup, meaning we\nshouldn't hit a subvolume half-dropped during relocation.\n\nThe root cause is, there is no orphan item for this subvolume.\nIn fact there are 5 subvolumes from around 2021 that have the same\nproblem.\n\nIt looks like the original report has some older kernels running, and\ncaused those zombie subvolumes.\n\nThankfully upstream commit 8d488a8c7ba2 (\"btrfs: fix subvolume/snapshot\ndeletion not triggered on mount\") has long fixed the bug.\n\n[ENHANCEMENT]\nFor repairing such old fs, btrfs-progs will be enhanced.\n\nConsidering how delayed the problem will show up (at run delayed ref\ntime) and at that time we have to abort transaction already, it is too\nlate.\n\nInstead here we reject any half-dropped subvolume for reloc tree at the\nearliest time, preventing confusion and extra time wasted on debugging\nsimilar bugs.",
"title": "Vulnerability description"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2025-39738"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/125e94a4b76b7b75d194f85bedd628097d2121f0",
"url": "https://git.kernel.org/stable/c/125e94a4b76b7b75d194f85bedd628097d2121f0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/39a93e1c9dbf7e11632efeb20fcf0fc1dcf64d51",
"url": "https://git.kernel.org/stable/c/39a93e1c9dbf7e11632efeb20fcf0fc1dcf64d51"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4289b494ac553e74e86fed1c66b2bf9530bc1082",
"url": "https://git.kernel.org/stable/c/4289b494ac553e74e86fed1c66b2bf9530bc1082"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4e403bd8e127d40dc7c05f06ee969c1ba1537ec5",
"url": "https://git.kernel.org/stable/c/4e403bd8e127d40dc7c05f06ee969c1ba1537ec5"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f83d4c81bda3b7d1813268ab77408f7a0ce691ff",
"url": "https://git.kernel.org/stable/c/f83d4c81bda3b7d1813268ab77408f7a0ce691ff"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/fa086b1398cf7e5f7dee7241bd5f2855cb5df8dc",
"url": "https://git.kernel.org/stable/c/fa086b1398cf7e5f7dee7241bd5f2855cb5df8dc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/fcb1f77b8ed8795608ca7a1f6505e2b07236c1f3",
"url": "https://git.kernel.org/stable/c/fcb1f77b8ed8795608ca7a1f6505e2b07236c1f3"
},
{
"category": "external",
"summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
},
{
"category": "external",
"summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
}
],
"release_date": "2025-09-11T17:15:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
]
},
{
"cve": "CVE-2026-98734",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Serialize SCO and ISO scheduling with teardown\n\nhci_low_sent() selects a connection under RCU but drops the read lock\nbefore calculating its quota and returning it to the scheduler. The\nconnection is then used without lifetime protection by hci_sched_iso()\nand hci_sched_sco().\n\nAfter the TX worker drops the RCU read lock, hci_abort_conn_sync() on\nhdev->req_workqueue can remove the connection from the hash, complete\nsynchronize_rcu(), purge its queues and release it. The TX worker on\nhdev->workqueue can then access the freed connection in hci_quote_sent()\nor while dequeuing packets and updating conn->sent.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in hci_low_sent+0x730/0x840\n Workqueue: hci0 hci_tx_work\n Call Trace:\n hci_low_sent+0x730/0x840\n hci_sched_iso+0x25e/0x4d0\n hci_tx_work+0x239/0xcb0\n\n Allocated by task 93:\n __hci_conn_add+0x16f/0x1b40\n hci_bind_bis+0x782/0x17b0\n hci_connect_bis+0xa0/0x510\n iso_sock_connect+0x589/0x1050\n\n Freed by task 88:\n kfree+0x131/0x3c0\n device_release+0xc8/0x240\n kobject_put+0x14d/0x280\n hci_conn_del+0x55a/0xe80\n hci_disconnect_sync+0x156/0x180\n hci_abort_conn_sync+0x3e7/0x940\n hci_cmd_sync_work+0x13c/0x290\n\nHold hci_dev_lock() across connection selection and transmission in both\nSCO and ISO scheduling, serializing them with connection teardown. This\nalso prevents queuing completion timestamps after the connection queues\nhave been purged. Extending RCU across transmission would be unsafe\nbecause the transmit path can sleep. Keep the ISO timeout check outside\nthe mutex since hci_link_tx_to() takes it itself.\n\nThe preceding channel fix already holds this mutex in the ACL and LE\nschedulers, which call the SCO scheduler between packets. Move the SCO\nbody to __hci_sched_sco(), assert that its caller holds the mutex, and\nuse it directly from these locked paths. Keep a locking hci_sched_sco()\nwrapper for the direct calls from hci_tx_work(). This avoids recursively\nacquiring the device mutex while preserving the scheduling order.\n\nRemove the obsolete claim that connection removal disables TX.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98734"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/101825c09ad6b7daa6cf4c9e6b1720b13de15596",
"url": "https://git.kernel.org/stable/c/101825c09ad6b7daa6cf4c9e6b1720b13de15596"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1681f97afdf92e8557f2f3118ddc898471b5d299",
"url": "https://git.kernel.org/stable/c/1681f97afdf92e8557f2f3118ddc898471b5d299"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21",
"url": "https://git.kernel.org/stable/c/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ecdb1c66d8e14e63731c52d6fbcfa604064913c4",
"url": "https://git.kernel.org/stable/c/ecdb1c66d8e14e63731c52d6fbcfa604064913c4"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f997e03e2ef58aa7114828c9d924e515a9a1db9c",
"url": "https://git.kernel.org/stable/c/f997e03e2ef58aa7114828c9d924e515a9a1db9c"
}
],
"release_date": "2026-10-18T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98393",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv4: Fix UDP length overflow with PMTU discover and big MTU\n\nThis commit bounds cork->base.fragsize to IP_MAX_MTU to avoid a\npossible overflow of UDP length that triggers a WARN in\nudp_set_len_short when setsockopt IP_MTU_DISCOVER is set to\nIP_PMTUDISC_PROBE, and a large packet is sent over a netdev with an\nunusually large MTU.\n\nSteps to reproduce:\n\n1. Set device MTU bigger than IP_MAX_MTU + 20. cork->base.fragsize will\n be set to that MTU in ip_setup_cork.\n2. Set IP_MTU_DISCOVER to IP_PMTUDISC_PROBE. It lets maxnonfragsize be\n set to device MTU (cork->fragsize) in __ip_append_data, rather than\n to IP_MAX_MTU.\n3. Send 65528 bytes of payload (+8 bytes of UDP header, +20 bytes of\n IPv4 header). Device MTU allows it (it's only one byte bigger than\n IP_MAX_MTU + IPv4 header, and the device MTU is bigger than that).\n4. The UDP length in the built packet is 65536, which overflows the\n 16-bit length field and triggers the WARN in udp_set_len_short.\n\nNote: IP_PMTUDISC_DO with IPv4 is safe, because ip_dst_mtu_maybe_forward\nalways clamps at IP_MAX_MTU, unlike ip6_dst_mtu_maybe_forward.\n\nThe Fixes tag points at the first commit where I could reproduce the\noverflow with IPv4 and IP_PMTUDISC_PROBE.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98393"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/81f540827d243b8dad76c1f44e70ea31719f393c",
"url": "https://git.kernel.org/stable/c/81f540827d243b8dad76c1f44e70ea31719f393c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/83fedc4741210f75be8ca5b487985a242bf6f18d",
"url": "https://git.kernel.org/stable/c/83fedc4741210f75be8ca5b487985a242bf6f18d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b83641e0ab8b20eefcc4cdc5a059f897375291a2",
"url": "https://git.kernel.org/stable/c/b83641e0ab8b20eefcc4cdc5a059f897375291a2"
}
],
"release_date": "2026-10-14T14:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2023-53715",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex\n\nApparently the hex passphrase mechanism does not work on newer\nchips/firmware (e.g. BCM4387). It seems there was a simple way of\npassing it in binary all along, so use that and avoid the hexification.\n\nOpenBSD has been doing it like this from the beginning, so this should\nwork on all chips.\n\nAlso clear the structure before setting the PMK. This was leaking\nuninitialized stack contents to the device.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2023-53715"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1687845eb8f37360a9ee849a3587ab659b090773",
"url": "https://git.kernel.org/stable/c/1687845eb8f37360a9ee849a3587ab659b090773"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2bc34facb90ceeff6f8c17d2006575a6d07c3825",
"url": "https://git.kernel.org/stable/c/2bc34facb90ceeff6f8c17d2006575a6d07c3825"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2fa3a5226b05e0a797c68b9609dcebe0cd236b27",
"url": "https://git.kernel.org/stable/c/2fa3a5226b05e0a797c68b9609dcebe0cd236b27"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4e8dc0e5c7636efaadbd7e488acd34b4291c0431",
"url": "https://git.kernel.org/stable/c/4e8dc0e5c7636efaadbd7e488acd34b4291c0431"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/56c7e9c39bd54fd753c0c4b1ed10278cbd3a5f02",
"url": "https://git.kernel.org/stable/c/56c7e9c39bd54fd753c0c4b1ed10278cbd3a5f02"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/89b89e52153fda2733562776c7c9d9d3ebf8dd6d",
"url": "https://git.kernel.org/stable/c/89b89e52153fda2733562776c7c9d9d3ebf8dd6d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e242c66f7ecfe8f5b6eb308f4ea464fd8589c866",
"url": "https://git.kernel.org/stable/c/e242c66f7ecfe8f5b6eb308f4ea464fd8589c866"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f8a6c53ff1d91acd5a20eb627edbffd816eb9a4e",
"url": "https://git.kernel.org/stable/c/f8a6c53ff1d91acd5a20eb627edbffd816eb9a4e"
}
],
"release_date": "2025-10-22T14:15:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-89537",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2\n\ngss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags\nbyte at ptr[2], and padding at ptr[3..7], then passes\nptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg().\nNone of these accesses check read_token->len first.\n\nThe minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus\nctx->krb5e->cksum_len (12-24, depending on the enctype). All callers\naccept shorter tokens from the wire:\n\n - gss_unwrap_resp_integ() enforces only an upper bound\n (offset + len <= rcv_buf->len) before allocating\n mic.data = kmalloc(len) and passing it to gss_verify_mic().\n A malicious NFS server can therefore supply a short checksum\n opaque, producing a small slab allocation that the Kerberos MIC\n verifier reads past.\n\n - gss_validate() enforces only len <= RPC_MAX_AUTH_SIZE (400)\n before passing the wire-supplied length to\n gss_validate_seqno_mic(), which constructs a mic xdr_netobj\n and calls gss_verify_mic().\n\n - svcauth_gss_verify_header() enforces only\n checksum.len >= XDR_UNIT (4 bytes) before dispatching to\n gss_verify_mic().\n\n - svcauth_gss_unwrap_integ() checks only that the checksum fits\n in gsd->gsd_scratch.\n\nAdd a length guard at the top of gss_krb5_verify_mic_v2(), before any\nptr[] access or scatterlist construction. Well-formed MIC tokens from\ngss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN +\ncksum_len bytes, so valid traffic is unaffected.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-89537"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7a946b2e7207f968902f2147ab9b30726f82f7ab",
"url": "https://git.kernel.org/stable/c/7a946b2e7207f968902f2147ab9b30726f82f7ab"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/996dd15f60121bdd7896b4554458f8806d608063",
"url": "https://git.kernel.org/stable/c/996dd15f60121bdd7896b4554458f8806d608063"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/997577c52487181226775db3755079a3ba1d52b9",
"url": "https://git.kernel.org/stable/c/997577c52487181226775db3755079a3ba1d52b9"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b2e9e10f5a536befcdce64d3e6946dff42fb823e",
"url": "https://git.kernel.org/stable/c/b2e9e10f5a536befcdce64d3e6946dff42fb823e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b94f6719dcd9f7a609bc5f459f85795900e77d25",
"url": "https://git.kernel.org/stable/c/b94f6719dcd9f7a609bc5f459f85795900e77d25"
}
],
"release_date": "2026-09-11T20:19:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-90207",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: midi: Serialize input teardown with event_input\n\nsnd_midi_input_event() must not be running while a rawmidi substream is\nclosing, since this can lead to the trigger state becoming out-of-step\nthrough this sequence in snd_rawmidi_input_trigger():\n\n\tsnd_rawmidi_input_trigger(up=0)\n\t\t\t\t\tsnd_midi_input_event()\n\t\t\t\t\t -> snd_rawmidi_kernel_read()\n\t\t\t\t\t -> snd_rawmidi_input_trigger(up=1)\n\t -> cancel_work_sync()\n\nwhich ends with the underlying device being active unexpectedly.\n\nWhen this is called from close_substream(), further input can re-trigger\nthe input event leaving it running after rawmidi_release_priv() has set\nrfile->rmidi to NULL which leads to:\n\n\tUnable to handle kernel NULL pointer dereference at virtual address 00000000000000b0\n\tCall trace:\n\t snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P)\n\t snd_rawmidi_input_event_work+0x1c/0x2c\n\t process_one_work+0x150/0x3a4\n\t worker_thread+0x190/0x318\n\nApply a similar approach to commit ef7607ab1c8ad (\"ALSA: seq: midi:\nSerialize output teardown with event_input\") which fixed the same issue\nin the output direction, but updated to use RCU following Takashi Iwai's\nproposed follow-on patch [1].\n\nWith this change in place, midisynth_unsubscribe() clears the input file\nso snd_midi_input_event() will not re-trigger the stream and will be\nquiesced by the cancel_work_sync() in snd_rawmidi_input_trigger().\n\n[1] https://lore.kernel.org/linux-sound/20260813144224.753399-1-tiwai@suse.de/",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-90207"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/210c193a9ef1312fab153948c6928e4cfaa1f03b",
"url": "https://git.kernel.org/stable/c/210c193a9ef1312fab153948c6928e4cfaa1f03b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12",
"url": "https://git.kernel.org/stable/c/282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/403f7f3ad3808a0096d84cf228fab68dc253fd9d",
"url": "https://git.kernel.org/stable/c/403f7f3ad3808a0096d84cf228fab68dc253fd9d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6290afaae54c7a9fa3bca3b4d5433e6d83e8669d",
"url": "https://git.kernel.org/stable/c/6290afaae54c7a9fa3bca3b4d5433e6d83e8669d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/89d986897aff7275b42e075e556731b8353366af",
"url": "https://git.kernel.org/stable/c/89d986897aff7275b42e075e556731b8353366af"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/de76a2b47582cd6dba2e15f024681bf377ecc94a",
"url": "https://git.kernel.org/stable/c/de76a2b47582cd6dba2e15f024681bf377ecc94a"
}
],
"release_date": "2026-09-17T17:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-89654",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix UAF in check_new_map() on session freed during unlock\n\ncheck_new_map() iterates mdsc->sessions[] and for each active session\ndrops mdsc->mutex to perform per-session operations. The forced-close\npath (rank removed from map) correctly takes a reference on s via\nceph_get_mds_session() before releasing mdsc->mutex, but three other\npaths do not:\n\n Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex)\n Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s)\n Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex)\n\nWithout the extra reference, another thread can acquire mdsc->mutex\nduring the unlock window, call __unregister_session() which drops the\nlast reference on s, and free it. The original thread then accesses\nfreed memory via s->s_mutex.\n\nFix by adding ceph_get_mds_session(s) before each mutex_unlock and\nceph_put_mds_session(s) after the corresponding mutex_lock, matching\nthe pattern already used in the forced-close path.\n\nRace timeline (Path A):\n\n Thread A (check_new_map) Thread B (another map update\n holds mdsc->mutex or session teardown)\n -------------------------- --------------------------\n s = mdsc->sessions[i]\n (refcount == 1, held only by\n sessions[] array)\n\n mutex_unlock(&mdsc->mutex)\n ---> acquires mdsc->mutex\n __unregister_session(mdsc, s)\n sessions[i] = NULL\n ceph_put_mds_session(s)\n refcount: 1 -> 0\n kfree(s) <--- freed!\n\n mutex_lock(&s->s_mutex)\n UAF on freed s->s_mutex",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-89654"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/21d5be092d947f8d83f76f7ebf3989e7e9230a98",
"url": "https://git.kernel.org/stable/c/21d5be092d947f8d83f76f7ebf3989e7e9230a98"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/352a278d5a1965aae3f817ce5d24a67ee42d45d1",
"url": "https://git.kernel.org/stable/c/352a278d5a1965aae3f817ce5d24a67ee42d45d1"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/820871e9dbeecd2533c4c5f5d91878ceaf02324c",
"url": "https://git.kernel.org/stable/c/820871e9dbeecd2533c4c5f5d91878ceaf02324c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/9646dfee880730aae4b379a4b8ee6c88ac735acd",
"url": "https://git.kernel.org/stable/c/9646dfee880730aae4b379a4b8ee6c88ac735acd"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ee611a7509554c4ca1f54f6aefe592fb1df7ea70",
"url": "https://git.kernel.org/stable/c/ee611a7509554c4ca1f54f6aefe592fb1df7ea70"
}
],
"release_date": "2026-09-11T20:19:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-80742",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: Don't send zero-byte data in tpacket_snd().\n\nsyzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd():\n\nskb_assert_len\nWARNING: at include/linux/skbuff.h:2753 skb_assert_len\nWARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781\n\nCall Trace:\n \n dev_queue_xmit include/linux/netdevice.h:3448 [inline]\n packet_xmit+0x243/0x310 net/packet/af_packet.c:276\n tpacket_snd net/packet/af_packet.c:2907 [inline]\n packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134\n\nWhen sending 0-byte packets via TPACKET ring buffer on devices with no\nhard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb()\npopulates an skb with skb->len == 0 and returns 0. tpacket_snd() then\nforwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to\nhit skb_assert_len(skb).\n\nSimilar checks exist in packet_snd() via commit dc633700f00f\n(\"net/af_packet: check len when min_header_len equals to 0\") and in\npacket_sendmsg_spkt() via commit 6a341729fb31 (\"af_packet: Don't send\nzero-byte data in packet_sendmsg_spkt().\").\n\nReturn -EINVAL in tpacket_fill_skb() when skb->len is zero to reject\nzero-length packets in tpacket_snd().",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-80742"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1fc70b3d513bafb16b17540178870ef46e81c0bb",
"url": "https://git.kernel.org/stable/c/1fc70b3d513bafb16b17540178870ef46e81c0bb"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3fa110f9e2ea96f567f2194c673c4bc327640111",
"url": "https://git.kernel.org/stable/c/3fa110f9e2ea96f567f2194c673c4bc327640111"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6bcd76c134c55c697148acb5c0194e9666abdf84",
"url": "https://git.kernel.org/stable/c/6bcd76c134c55c697148acb5c0194e9666abdf84"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7521e691c7c4f2231634c95053281ac888d1f452",
"url": "https://git.kernel.org/stable/c/7521e691c7c4f2231634c95053281ac888d1f452"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/80a702964467b998d254f16cc61c2c9a20540c9d",
"url": "https://git.kernel.org/stable/c/80a702964467b998d254f16cc61c2c9a20540c9d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/98c5914d6b7bd4b4675535908e57dea31f1efd6a",
"url": "https://git.kernel.org/stable/c/98c5914d6b7bd4b4675535908e57dea31f1efd6a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/dde212f8622f5cb36223fff1ebd6e6f2a3dc61fe",
"url": "https://git.kernel.org/stable/c/dde212f8622f5cb36223fff1ebd6e6f2a3dc61fe"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f09ac5682f1bb67981fcb6ead4d3cfe439225876",
"url": "https://git.kernel.org/stable/c/f09ac5682f1bb67981fcb6ead4d3cfe439225876"
}
],
"release_date": "2026-09-03T13:06:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-64424",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetpoll: fix a use-after-free on shutdown path\n\nThere is a use-after-free error on netpoll, which is clearly detected by\nKASAN.\n\n BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x3b/0x80\n Read of size 1 at addr ... by task kworker/9:1\n Workqueue: events queue_process\n Call Trace:\n skb_dequeue+0x1e/0xb0\n queue_process+0x2c/0x600\n process_scheduled_works+0x4b6/0x850\n worker_thread+0x414/0x5a0\n Allocated by task 242:\n __netpoll_setup+0x201/0x4a0\n netpoll_setup+0x249/0x550\n enabled_store+0x32f/0x380\n Freed by task 0:\n kfree+0x1b7/0x540\n rcu_core+0x3f8/0x7a0\n\nThe problem happens when there is a pending TX worker running in\nparallel with the cleanup path.\n\nThis is what happens on netpoll shutdown path:\n\n1) __netpoll_cleanup() is called\n2) set dev->npinfo to NULL\n3) call_rcu() with rcu_cleanup_netpoll_info()\n 3.1) rcu_cleanup_netpoll_info() tries to cancel all workers with\n cancel_delayed_work(), but doesn't wait for the worker to finish\n4) and kfree(npinfo);\n\nBecause 3.1) doesn't really cancel the work, as the comment says \"we\ncan't call cancel_delayed_work_sync here, as we are in softirq\", the TX\nworker can run after 4).\n\nTl;DR: queue_process() is not an RCU reader, it reaches npinfo through\nthe work item via container_of().\n\nUse disable_delayed_work_sync() to ensure the worker is completely\nstopped and prevent any future re-arming attempts. Once npinfo is set\nto NULL, senders will bail out and not queue new work. The disable flag\nensures any in-flight re-arming attempts also fail silently.\n\nIn the future, we can do the cleanup inline here without needing the\nnpinfo->rcu rcu_head, but that is net-next material.",
"title": "Vulnerability description"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-64424"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/45f1458a85017a023f138b22ac5c76abd477db42",
"url": "https://git.kernel.org/stable/c/45f1458a85017a023f138b22ac5c76abd477db42"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5ed09a108d93a3b002cc79823d9455b50c4a8be7",
"url": "https://git.kernel.org/stable/c/5ed09a108d93a3b002cc79823d9455b50c4a8be7"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/95ecc5b58042f6b6743b589e6588f1cd7ba336aa",
"url": "https://git.kernel.org/stable/c/95ecc5b58042f6b6743b589e6588f1cd7ba336aa"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a33f37f8d079da7236ed7b7e2aed2a34ab81e7cf",
"url": "https://git.kernel.org/stable/c/a33f37f8d079da7236ed7b7e2aed2a34ab81e7cf"
}
],
"release_date": "2026-07-25T10:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
]
},
{
"cve": "CVE-2026-72389",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: stp: Fix a potential use-after-free when deleting a bridge\n\nThe three STP timers are not supposed to be armed while the bridge is\nadministratively down. They are synchronously deactivated when the\nbridge is put administratively down and the various call sites check for\n'IFF_UP' before arming them.\n\nThis check is missing from br_topology_change_detection() and it is\npossible to engineer a situation in which the topology change timer is\narmed while the bridge is administratively down, resulting in a\nuse-after-free [1] when the bridge is deleted.\n\nFix by adding the missing check and for good measures synchronously\nshutdown the three timers when the bridge is deleted.\n\n[1]\nODEBUG: free active (active state 0) object: ffff88811662b9b0 object type: timer_list hint: br_topology_change_timer_expired (net/bridge/br_stp_timer.c:120)\nWARNING: lib/debugobjects.c:629 at debug_print_object+0x1bc/0x450, CPU#9: ip/359",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-72389"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/297a747f59bff6573196d7236178144d66524e68",
"url": "https://git.kernel.org/stable/c/297a747f59bff6573196d7236178144d66524e68"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2a00517db8de4be7df3d483b215c5544fb30a191",
"url": "https://git.kernel.org/stable/c/2a00517db8de4be7df3d483b215c5544fb30a191"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/39283907a25e5caf0f2bd2947f6e56644b01e2b7",
"url": "https://git.kernel.org/stable/c/39283907a25e5caf0f2bd2947f6e56644b01e2b7"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/40cbfa3a28e0919469d1b086629bb3ce38a83593",
"url": "https://git.kernel.org/stable/c/40cbfa3a28e0919469d1b086629bb3ce38a83593"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4c40eec06eeac37c58e47a6058eb32901218d5d4",
"url": "https://git.kernel.org/stable/c/4c40eec06eeac37c58e47a6058eb32901218d5d4"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b4b3458ef88df4798632619f018791d4344bcd92",
"url": "https://git.kernel.org/stable/c/b4b3458ef88df4798632619f018791d4344bcd92"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c86579b0a2d201792bcb59316629f4ba4758cfc8",
"url": "https://git.kernel.org/stable/c/c86579b0a2d201792bcb59316629f4ba4758cfc8"
}
],
"release_date": "2026-08-15T06:22:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-97563",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject out-of-bounds DataOffset in CIFSSMBRead()\n\nThe SMB1 synchronous read helper CIFSSMBRead() validates the server's\nDataLength against CIFSMaxBufSize and the caller's count, but never\nvalidates DataOffset. The copy source is formed as\n\n\t&pSMBr->hdr.Protocol + le16_to_cpu(pSMBr->DataOffset)\n\nand memcpy()'d for DataLength bytes with no check that the\n[DataOffset, DataOffset + DataLength) range lies within the response\nactually received from the server.\n\nA malicious or compromised SMB1 server can return a response carrying\nan in-range DataLength and a large DataOffset, driving the source\npointer past the end of the response buffer. The memcpy() then copies\nadjacent kernel heap into the caller's read buffer (information\ndisclosure), or reads unmapped memory and oopses (denial of service).\nSMB1 is not negotiated by default; reaching this code requires an\nexplicit vers=1.0 mount.\n\nBoth DataOffset and the received response length recorded in\nrsp_iov.iov_len are relative to the start of the SMB header, so reject\nthe response unless DataOffset + DataLength fits within that length,\nusing overflow-safe arithmetic, before forming the source pointer.\nThe response length has been validated by the previous patch, so the\nDataOffset and DataLength fields can be read safely here.\n\nWhile here, make data_length unsigned. It holds a length derived from\nunsigned on-the-wire fields and is only ever compared against unsigned\nquantities; print it with %u accordingly, and add __func__ to the\ncifs_dbg() calls in this function.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-97563"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5be5bdda5863eacc964b609ba927764f253431b3",
"url": "https://git.kernel.org/stable/c/5be5bdda5863eacc964b609ba927764f253431b3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/667feba13e78d16393aacb15869f70970f422227",
"url": "https://git.kernel.org/stable/c/667feba13e78d16393aacb15869f70970f422227"
}
],
"release_date": "2026-09-25T11:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-97509",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Keep XDomain reference during the lifetime of a service\n\nThis is needed because we release the service ID in tb_service_release()\nand the ID array is owned by the parent XDomain.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-97509"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f",
"url": "https://git.kernel.org/stable/c/57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8ab12d015884b8aa85ea7ed58c5a0bae4264fe60",
"url": "https://git.kernel.org/stable/c/8ab12d015884b8aa85ea7ed58c5a0bae4264fe60"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8b4060998637f06975fceee9b73845d8672d411e",
"url": "https://git.kernel.org/stable/c/8b4060998637f06975fceee9b73845d8672d411e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a4567e5380e4e46d0ea9a28d2d675e5c6f013d54",
"url": "https://git.kernel.org/stable/c/a4567e5380e4e46d0ea9a28d2d675e5c6f013d54"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/cca72fe513f3d6b1279fe83483f8a8990adbe0c6",
"url": "https://git.kernel.org/stable/c/cca72fe513f3d6b1279fe83483f8a8990adbe0c6"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/daeaa6c7211d03ed061b0dd22a875fad9372b090",
"url": "https://git.kernel.org/stable/c/daeaa6c7211d03ed061b0dd22a875fad9372b090"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7",
"url": "https://git.kernel.org/stable/c/ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7"
}
],
"release_date": "2026-09-24T17:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-80841",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: defer vmalloc TX_RING free until skbs finish\n\nAF_PACKET TX_RING skbs keep a raw pointer to their ring frame. The skb\npage references preserve page-backed ring blocks after pg_vec is freed,\nbut they do not preserve a vmalloc mapping.\n\ntpacket_destruct_skb() currently drops the pending reference before\nwriting the timestamp and TP_STATUS_AVAILABLE to the frame. Move the\ndecrement after those stores. The smp_wmb() in __packet_set_status()\norders the frame stores before the decrement.\n\nAlso recheck pending TX frames under pg_vec_lock before non-closing\nring replacement, so a racing send cannot add a pending skb between\nthe initial check and the ring swap.\n\nRing allocation can produce a mixture of page-backed and vmalloc-backed\nblocks. Allocate deferred-work storage during TX ring setup when the\nfirst vmalloc-backed block is encountered, and keep its pointer in the\npg_vec allocation header. If allocation fails, return -ENOMEM from ring\nsetup. On socket close, a non-NULL pointer identifies a vmalloc-backed\nvector without a scan. If TX skbs remain, defer the whole vector to\nsystem_long_wq.\n\nAfter pg_vec is detached, a late destructor can skip the pending\ndecrement. Use socket write-memory accounting as the deferred lifetime\ngate instead: an skb remains charged through its final sock_wfree(),\nafter all ring-frame accesses. The delayed work retains a socket\nreference and reschedules itself until no TX skbs remain.\n\nMove pending_refcnt release to packet_sock_destruct() so late skb\ndestructors and deferred cleanup can safely use it after\npacket_release(). Page-backed teardown remains synchronous, and no lock\nis added to the TX completion hot path.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-80841"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0189dce07db2dc059ae0570e06758ec4233c6e11",
"url": "https://git.kernel.org/stable/c/0189dce07db2dc059ae0570e06758ec4233c6e11"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4ce6e2d2e38055b2012bd5fdb0c8a8183c8a1b0c",
"url": "https://git.kernel.org/stable/c/4ce6e2d2e38055b2012bd5fdb0c8a8183c8a1b0c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/550d00aa58193fb649a09a9c9e338c685adad784",
"url": "https://git.kernel.org/stable/c/550d00aa58193fb649a09a9c9e338c685adad784"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/992cc9f94ca924089a506ba9b327caa9af797529",
"url": "https://git.kernel.org/stable/c/992cc9f94ca924089a506ba9b327caa9af797529"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/debf9f50140b3df3949ebcb97d4450f8993fe32d",
"url": "https://git.kernel.org/stable/c/debf9f50140b3df3949ebcb97d4450f8993fe32d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ed25ed29034ddc3dbe451ccbaa58ab9932f99d8b",
"url": "https://git.kernel.org/stable/c/ed25ed29034ddc3dbe451ccbaa58ab9932f99d8b"
}
],
"release_date": "2026-09-04T16:18:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98602",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough\n\nFix multiple out-of-bounds reads in Bluetooth BNEP frame processing:\n\n1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c),\n use pskb_may_pull() to verify the BNEP header, control type byte,\n filter count, and extension headers exist before reading them, and\n return 0 after handling BNEP_CONTROL instead of falling through to\n Ethernet frame submission when no extension headers follow.\n2. In bnep_net_xmit() (net/bluetooth/bnep/netdev.c), verify skb->len >=\n ETH_HLEN with pskb_may_pull() before reading the 14-byte Ethernet\n header to prevent an out-of-bounds heap read and infoleak on short\n AF_PACKET TX frames.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98602"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/035f9b1809861967e58ce652680d70ea1502058f",
"url": "https://git.kernel.org/stable/c/035f9b1809861967e58ce652680d70ea1502058f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1e7aebc188f889b56c3aaeb6133ef6d77022c887",
"url": "https://git.kernel.org/stable/c/1e7aebc188f889b56c3aaeb6133ef6d77022c887"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3e605ff5932afe0970c2beca66f2f1ba2babe4dd",
"url": "https://git.kernel.org/stable/c/3e605ff5932afe0970c2beca66f2f1ba2babe4dd"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/667aa703e11cdc237d169393bc6a5ea9acbb33c2",
"url": "https://git.kernel.org/stable/c/667aa703e11cdc237d169393bc6a5ea9acbb33c2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7af80ad2cebfe2f1879d6a39a1aaa061d9c4e1ca",
"url": "https://git.kernel.org/stable/c/7af80ad2cebfe2f1879d6a39a1aaa061d9c4e1ca"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8f31031326994d1abfcc6ebb6927ef96e51fb9ff",
"url": "https://git.kernel.org/stable/c/8f31031326994d1abfcc6ebb6927ef96e51fb9ff"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ad0d2d4ada51321db787262ef343193c712b76b5",
"url": "https://git.kernel.org/stable/c/ad0d2d4ada51321db787262ef343193c712b76b5"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f0ca020cbb9bb7f3f4ea8ba1dfcf30a282aec91e",
"url": "https://git.kernel.org/stable/c/f0ca020cbb9bb7f3f4ea8ba1dfcf30a282aec91e"
}
],
"release_date": "2026-10-18T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-63887",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf\n\niscsi_encode_text_output() concatenates \"key=value\\0\" records into\nlogin->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer\nallocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call\nsites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check\nthe remaining buffer capacity:\n\n\t*length += sprintf(output_buf, \"%s=%s\", er->key, er->value);\n\t*length += 1;\n\toutput_buf = textbuf + *length;\n\nThe 8192-byte ceiling at iscsi_target_check_login_request() bounds the\n*input* Login PDU payload, but a single PDU can carry up to 2048 minimal\nfour-byte \"a=b\\0\" pairs, each unknown key expanding to a 16-byte\n\"a=NotUnderstood\\0\" output record via iscsi_add_notunderstood_response().\n2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB\nheap overrun in the kmalloc-8k slab.\n\nThe fix introduces a static iscsi_encode_text_record() helper that uses\nsnprintf() with a per-call bounds check against the remaining buffer,\nand threads a u32 textbuf_size parameter through\niscsi_encode_text_output(). Both call sites in\niscsi_target_handle_csg_zero() (PHASE_SECURITY) and\niscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass\nMAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls\niscsi_release_extra_responses() to drop queued records, and returns -1;\nboth caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR /\nISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning,\nso the initiator sees an explicit failed-login response rather than a\nsilent connection drop. (Prior to this patch only the PHASE_OPERATIONAL\ncaller did that; the PHASE_SECURITY caller is converted to the same\nshape.)",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-63887"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db",
"url": "https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3",
"url": "https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b",
"url": "https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a",
"url": "https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627",
"url": "https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c",
"url": "https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39",
"url": "https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/efe633e600a0ac68357206fede21b1ac8178f3b8",
"url": "https://git.kernel.org/stable/c/efe633e600a0ac68357206fede21b1ac8178f3b8"
}
],
"release_date": "2026-07-19T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-68216",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pwc: Return queued buffers on start_streaming() failure\n\nThe vb2 framework hands buffers to the driver via buf_queue() before\ncalling start_streaming(). If start_streaming() returns an error\nwithout first returning those buffers via vb2_buffer_done(),\nvb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued\nbuffers leak.\n\npwc's start_streaming() had two early returns that hit this trap:\n-ENODEV when the USB device was already disconnected, and -ERESTARTSYS\nwhen mutex_lock_interruptible() was interrupted by a signal. Call the\nexisting pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED\nbefore returning (matching the state already used by the\npwc_isoc_init() error path in the same function).\n\nThis mirrors the uvcvideo fix in commit 4cf3b6fd54eb (\"media: uvcvideo:\nReturn queued buffers on start_streaming() failure\").",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-68216"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0362ae30b61b3053ee3095c1b8f179197ec4f539",
"url": "https://git.kernel.org/stable/c/0362ae30b61b3053ee3095c1b8f179197ec4f539"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5d7cc2634c3843a1414a0f6407aa17f1f91dee60",
"url": "https://git.kernel.org/stable/c/5d7cc2634c3843a1414a0f6407aa17f1f91dee60"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/975b2ee20e569d47821e4f6c9761b4664d48a6a4",
"url": "https://git.kernel.org/stable/c/975b2ee20e569d47821e4f6c9761b4664d48a6a4"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a4f8f629983f643333e49df90557805469bcbb25",
"url": "https://git.kernel.org/stable/c/a4f8f629983f643333e49df90557805469bcbb25"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/cb16b79a2be2cec9c3ebe4147490817c4d8b1de3",
"url": "https://git.kernel.org/stable/c/cb16b79a2be2cec9c3ebe4147490817c4d8b1de3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3",
"url": "https://git.kernel.org/stable/c/d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f2f9fcacd81953dde6cb86312ab13ca13e689664",
"url": "https://git.kernel.org/stable/c/f2f9fcacd81953dde6cb86312ab13ca13e689664"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/fa78e590852751d3ad32f33f6b4e210fe6ccbe9b",
"url": "https://git.kernel.org/stable/c/fa78e590852751d3ad32f33f6b4e210fe6ccbe9b"
}
],
"release_date": "2026-08-10T13:20:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-72436",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types\n\nSashiko pointed out that there are a few lockless RCU readers\nusing test_bit() which is a relaxed atomic operation and\nprovides no memory barrier guarantees. Use test_bit_acquire()\ninstead where the operation may run parallel with add/del/gc,\ni.e. is not one from the next cases\n\n- protected by region lock\n- in a set destroy phase\n- in a new/temporary set creation phase",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-72436"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3219d74e4536658c937fd878a327257b86ce80dd",
"url": "https://git.kernel.org/stable/c/3219d74e4536658c937fd878a327257b86ce80dd"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6329d3a9afe715fddda0460cfa46b496d61c2fe0",
"url": "https://git.kernel.org/stable/c/6329d3a9afe715fddda0460cfa46b496d61c2fe0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7445fe965b7d8756070a40e80f8b73348ccda1d7",
"url": "https://git.kernel.org/stable/c/7445fe965b7d8756070a40e80f8b73348ccda1d7"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c107233d2ff4fd7cef5d02f9124b99194957a710",
"url": "https://git.kernel.org/stable/c/c107233d2ff4fd7cef5d02f9124b99194957a710"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c4d257734e91bfcdc71d41843392dd6400b5bb1b",
"url": "https://git.kernel.org/stable/c/c4d257734e91bfcdc71d41843392dd6400b5bb1b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e4b4984e28c16406ecb318444dea4a8bf47def3e",
"url": "https://git.kernel.org/stable/c/e4b4984e28c16406ecb318444dea4a8bf47def3e"
}
],
"release_date": "2026-08-15T06:22:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2023-53839",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndccp: fix data-race around dp->dccps_mss_cache\n\ndccp_sendmsg() reads dp->dccps_mss_cache before locking the socket.\nSame thing in do_dccp_getsockopt().\n\nAdd READ_ONCE()/WRITE_ONCE() annotations,\nand change dccp_sendmsg() to check again dccps_mss_cache\nafter socket is locked.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2023-53839"
}
],
"release_date": "2025-12-09T01:29:55Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-80994",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix flow mask use-after-free on flow deletion\n\nThe commit in the Fixes tag below made so flow->mask free is scheduled\nvia RCU right after it is removed from the flow table. The pointer\nstays in the flow structure and it can be accessible while in the same\nRCU critical section. This is done to avoid requiring ovs_mutex for\nthe ovs_flow_free().\n\nHowever, while removing the flow during processing of CMD_DEL, we do\nnot take RCU read lock before the removal, and ovs_flow_cmd_fill_info()\nuses the flow->mask pointer afterwards. The RCU read lock is taken,\nbut it's already late at that point. The comment on that line\nacknowledges that the lock is cosmetic and doesn't serve a real purpose.\n\nThis leads to use-after-free if the RCU grace period passes between\nremoval and the filling. It is a short race window, but it is there\nand can lead to a real crash in case memory allocation for the info\ntakes a bit longer:\n\n BUG: KASAN: slab-use-after-free in __ovs_nla_put_key\n net/openvswitch/flow_netlink.c:1996\n BUG: KASAN: slab-use-after-free in ovs_nla_put_key+0x2463/0x2e30\n net/openvswitch/flow_netlink.c:2250\n Read of size 4 at addr ffff88801ee89970 by task ovs_flow_del_ec/9487\n\n Call Trace:\n \n __ovs_nla_put_key net/openvswitch/flow_netlink.c:1996\n ovs_nla_put_key+0x2463/0x2e30 net/openvswitch/flow_netlink.c:2250\n ovs_flow_cmd_fill_info+0x420/0x9c0 net/openvswitch/datapath.c:930\n ovs_flow_cmd_del+0x53a/0x970 net/openvswitch/datapath.c:1467\n ...\n netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556\n \n\n Allocated by task 9487:\n mask_alloc net/openvswitch/flow_table.c:967\n flow_mask_insert net/openvswitch/flow_table.c:1012\n ovs_flow_tbl_insert+0xea2/0x1a90 net/openvswitch/flow_table.c:1084\n ovs_flow_cmd_new+0x7e3/0xd90 net/openvswitch/datapath.c:1086\n ...\n netlink_rcv_skb+0x156/0x420 net/netlink/af_netlink.c:2556\n\n Freed by task 9485:\n rcu_free_sheaf+0x1e/0x100 mm/slub.c:5978\n rcu_do_batch kernel/rcu/tree.c:2645\n rcu_core+0x59c/0x10c0 kernel/rcu/tree.c:2897\n handle_softirqs+0x1e4/0x9a0 kernel/softirq.c:622\n ...\n instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062\n\novs_flow_tbl_remove() must be called after the ovs_flow_cmd_fill_info()\nto avoid this race. This also helps with cleaning up the forced cast\nand the cosmetic RCU read lock. Before the commit in the Fixes tag the\norder did not matter as long as the flow object itself was not freed.\n\nA wider RCU critical section could be another option, but we have a\nGFP_KERNEL allocation in the way.\n\nReported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-80994"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0ba5cbc2f049af94ec94ff6f64958545efc5eaa2",
"url": "https://git.kernel.org/stable/c/0ba5cbc2f049af94ec94ff6f64958545efc5eaa2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/18ce1a8b7499c016d4a893d9b1db80608f73745d",
"url": "https://git.kernel.org/stable/c/18ce1a8b7499c016d4a893d9b1db80608f73745d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4e30317ff67a2eb12b4d890d39f72fd7e7117d48",
"url": "https://git.kernel.org/stable/c/4e30317ff67a2eb12b4d890d39f72fd7e7117d48"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/64051fe200c7c759af71634bd2123552eaabb69a",
"url": "https://git.kernel.org/stable/c/64051fe200c7c759af71634bd2123552eaabb69a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7f072b84afd05a77963eb1872f7174e280661dce",
"url": "https://git.kernel.org/stable/c/7f072b84afd05a77963eb1872f7174e280661dce"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ac73e3af571da06c1d1cfe3f0f00dc978b851700",
"url": "https://git.kernel.org/stable/c/ac73e3af571da06c1d1cfe3f0f00dc978b851700"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c15ef9a5bf594f93a31de2ec2ec394e2a903519a",
"url": "https://git.kernel.org/stable/c/c15ef9a5bf594f93a31de2ec2ec394e2a903519a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ea5f7b45b582665541ddfb77dce98611354af4ab",
"url": "https://git.kernel.org/stable/c/ea5f7b45b582665541ddfb77dce98611354af4ab"
}
],
"release_date": "2026-09-11T20:19:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-72398",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: add INIT verification after cookie unpacking\n\nIn SCTP handshake, the INIT chunk is initially processed by the server\nand embedded into the cookie carried in INIT-ACK. The client then\nreturns this cookie via COOKIE-ECHO, where the server unpacks it and\nreconstructs the original INIT chunk.\n\nWhen cookie authentication is enabled, the cookie contents are protected\nagainst tampering, so reusing the unpacked INIT without re-verification\nis safe.\n\nHowever, when cookie authentication is disabled, the reconstructed INIT\ncan no longer be trusted. In this case, the INIT must be explicitly\nvalidated after unpacking to avoid processing potentially tampered data.\n\nAdd sctp_verify_init() checks after cookie unpacking in COOKIE-ECHO\nprocessing paths (sctp_sf_do_5_1D_ce() and sctp_sf_do_5_2_4_dupcook())\nwhen cookie_auth_enable is disabled. On failure, the new association is\nfreed and the packet is discarded.\n\nAlso tighten cookie validation in sctp_unpack_cookie() by verifying the\nembedded chunk type is SCTP_CID_INIT before treating it as an INIT\nchunk.\n\nFinally, update sctp_verify_init() to validate parameter bounds using\nthe actual embedded INIT length instead of chunk->chunk_end, since the\nINIT stored in COOKIE-ECHO may not span the entire chunk buffer.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-72398"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/062bcbf8d1f1051fdeb20b94920031b0e2cb95a2",
"url": "https://git.kernel.org/stable/c/062bcbf8d1f1051fdeb20b94920031b0e2cb95a2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/414c5447fe6a200613dd46d7fdc8454622076cb1",
"url": "https://git.kernel.org/stable/c/414c5447fe6a200613dd46d7fdc8454622076cb1"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/683a012b984fef4bc155e278742fbe01561e102a",
"url": "https://git.kernel.org/stable/c/683a012b984fef4bc155e278742fbe01561e102a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/81892d83cc897331510f35b30d17f8b0dc285966",
"url": "https://git.kernel.org/stable/c/81892d83cc897331510f35b30d17f8b0dc285966"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bca3100f550281c2f2418652338bced3b35af0e6",
"url": "https://git.kernel.org/stable/c/bca3100f550281c2f2418652338bced3b35af0e6"
}
],
"release_date": "2026-08-15T06:22:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-89530",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject inline replies that overflow the pull-up buffer\n\nAn RPC-over-RDMA client can request a reply, such as an NFS READ\npayload, without providing a Write list or a Reply chunk to carry\nit. When such a reply needs more scatter/gather entries than the\ndevice's Send Queue supports, svc_rdma_pull_up_needed() selects\npull-up and svc_rdma_pull_up_reply_msg() linearizes the whole\nreply into sctxt->sc_xprt_buf. That buffer is only sc_max_req_size\nbytes, while the reply on this path is bounded only by the client's\nrequest, so svc_rdma_xb_linearize() copies past the end of the\nbuffer and corrupts adjacent slab memory. The oversized length is\nthen stored in sc_sges[0].length and posted, so the device also\nreads beyond the mapped region.\n\nThe SGE-exhaustion branch is the only pull-up path that can exceed\nthe buffer: the threshold branch pulls up only replies smaller\nthan RPCRDMA_PULLUP_THRESH, and replies that fit the device's SGE\nbudget are sent directly without linearization. Make\nsvc_rdma_pull_up_needed() report -E2BIG when the reply it would\npull up cannot fit sc_max_req_size, and fail the request with\nERR_CHUNK as RFC 8166 Section 4.5.3 directs rather than dropping\nthe connection.\n\nThe helper no longer answers a simple yes/no question: it now\nreports pull-up, no pull-up, or -E2BIG for a reply too large to\nlinearize. Rename svc_rdma_pull_up_needed() to\nsvc_rdma_check_pull_up() so its name no longer implies a boolean\npredicate.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-89530"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860",
"url": "https://git.kernel.org/stable/c/0fbe20dfe74b783d255bf389a6ea77aa25dc7860"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5",
"url": "https://git.kernel.org/stable/c/1949dd1576f7a8aa161b1330c6125df9d53046d5"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8068358f445a11296328ffa7c524701596814a17",
"url": "https://git.kernel.org/stable/c/8068358f445a11296328ffa7c524701596814a17"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf",
"url": "https://git.kernel.org/stable/c/8ec60eb51fae37cd3d334ff26e4a7d6fb21ff7cf"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2",
"url": "https://git.kernel.org/stable/c/fcd91b9957462d398792201c239dffaeff1cc8b2"
}
],
"release_date": "2026-09-11T20:19:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98735",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Serialize ACL scheduling with channel deletion\n\nhci_chan_sent() selects a channel under RCU but drops the read lock before\naccessing chan->conn and returning the channel. The ACL and LE schedulers\nthen use its packet queue and update its transmit counters without any\nprotection against channel deletion.\n\nAfter TX selects a channel and releases RCU, a disconnect command timeout\non the separate request workqueue can run hci_conn_failed() and\nl2cap_conn_del(). hci_chan_del() can then unlink the channel, complete\nsynchronize_rcu(), purge its queue and free it before TX resumes. This\ncauses use-after-free both in hci_chan_sent() and in its callers.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in hci_chan_sent+0x892/0x9b0\n Workqueue: hci0 hci_tx_work\n Call Trace:\n hci_chan_sent+0x892/0x9b0\n hci_tx_work+0x5e6/0xb70\n Allocated by task 91:\n hci_chan_create+0xe3/0x350\n l2cap_conn_add.part.0+0x12/0xa30\n l2cap_chan_connect+0x110d/0x1b60\n l2cap_sock_connect+0x310/0x530\n Freed by task 99:\n hci_chan_del+0x11f/0x170\n l2cap_conn_del+0x4f1/0x800\n l2cap_connect_cfm+0x88c/0xd30\n hci_conn_failed+0x150/0x250\n hci_abort_conn_sync+0x3e3/0x800\n hci_cmd_sync_run+0x7e/0xc0\n hci_abort_conn+0x105/0x1f0\n disconnect_sync+0x157/0x290\n hci_cmd_sync_work+0x13c/0x290\n\nHold the existing device mutex across channel selection and transmission\nin both schedulers to serialize them with channel teardown. Keep timeout\nhandling outside the critical sections because hci_link_tx_to() acquires\nthe same mutex. This also permits the transmit path to sleep, unlike\nextending the RCU read-side critical section across packet submission.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98735"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4fda8f0abeea9929036446d89a476fb8298abcb0",
"url": "https://git.kernel.org/stable/c/4fda8f0abeea9929036446d89a476fb8298abcb0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/51f95ea451f25d7e3f048c0f438f04fa74688aae",
"url": "https://git.kernel.org/stable/c/51f95ea451f25d7e3f048c0f438f04fa74688aae"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/780affacd92977fd9b819bdc4f26a6832cb27fda",
"url": "https://git.kernel.org/stable/c/780affacd92977fd9b819bdc4f26a6832cb27fda"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/86e9708f9d19a7f1bd5dc9c1652d07707f79f5bd",
"url": "https://git.kernel.org/stable/c/86e9708f9d19a7f1bd5dc9c1652d07707f79f5bd"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/f4845ab191a4f686a5da481fbba90ed73bb693b0",
"url": "https://git.kernel.org/stable/c/f4845ab191a4f686a5da481fbba90ed73bb693b0"
}
],
"release_date": "2026-10-18T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2025-68283",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: replace BUG_ON with bounds check for map->max_osd\n\nOSD indexes come from untrusted network packets. Boundary checks are\nadded to validate these against map->max_osd.\n\n[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic\n edits ]",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2025-68283"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/57f5fbae9f1024aba17ff75e00433324115c548a",
"url": "https://git.kernel.org/stable/c/57f5fbae9f1024aba17ff75e00433324115c548a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b4368b7f97014e1015445d61abd0b27c4c6e8424",
"url": "https://git.kernel.org/stable/c/b4368b7f97014e1015445d61abd0b27c4c6e8424"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/becc488a4d864db338ebd4e313aa3c77da24b604",
"url": "https://git.kernel.org/stable/c/becc488a4d864db338ebd4e313aa3c77da24b604"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e67e3be690f5f7e3b031cf29e8d91e6d02a8e30d",
"url": "https://git.kernel.org/stable/c/e67e3be690f5f7e3b031cf29e8d91e6d02a8e30d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ec3797f043756a94ea2d0f106022e14ac4946c02",
"url": "https://git.kernel.org/stable/c/ec3797f043756a94ea2d0f106022e14ac4946c02"
}
],
"release_date": "2025-12-16T16:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-64114",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: raw: reject IP_HDRINCL packets with ihl < 5\n\nraw_send_hdrinc() validates that the caller-supplied IPv4 header\nfits within the message length:\n\n iphlen = iph->ihl * 4;\n err = -EINVAL;\n if (iphlen > length)\n goto error_free;\n\n if (iphlen >= sizeof(*iph)) {\n /* fix up saddr, tot_len, id, csum, transport_header */\n }\n\nIt does not, however, reject ihl < 5. For such a packet the\n\"if (iphlen >= sizeof(*iph))\" branch is skipped, leaving the\ncrafted iphdr untouched, but the packet is still handed to\n__ip_local_out() and onward. Downstream consumers that read\niph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in\nparticular subtracts sizeof(struct iphdr) from top_iph->ihl * 4\nand passes the (signed-int-negative, then cast to size_t)\nresult to memcpy(), producing an OOB access of length close to\nSIZE_MAX and a host kernel panic.\n\nAn IPv4 header with ihl < 5 is malformed by definition (RFC 791:\n\"Internet Header Length is the length of the internet header in\n32 bit words ... Note that the minimum value for a correct header\nis 5.\"). The kernel should not be willing to inject such a\npacket into its own output path.\n\nReject \"iphlen < sizeof(*iph)\" alongside the existing\n\"iphlen > length\" check. This matches the principle that locally\nconstructed packets that re-enter the IP stack must pass the same\nbasic sanity tests that a foreign packet would be subjected to.\n\nOnce this lands, the \"if (iphlen >= sizeof(*iph))\" wrapper around\nthe fixup branch becomes redundant; left in place to keep the\npatch minimal and backport-friendly. A follow-up can unwrap it.\n\nNote that commit 86f4c90a1c5c (\"ipv4, ipv6: ensure raw socket\nmessage is big enough to hold an IP header\") ensures the message\nbuffer is large enough to hold an iphdr, but does not constrain\nthe self-reported iph->ihl.\n\nReachability: the malformed packet source is any caller with\nCAP_NET_RAW, including an unprivileged process in a user+net\nnamespace on a kernel with CONFIG_USER_NS=y. The reproduced AH\ncrash also requires a matching xfrm AH policy on the outgoing\nroute; a container granted CAP_NET_ADMIN can install that state\nand policy in its netns. Loopback bypasses xfrm_output, so the\ntrigger uses a real netdev.\n\nReproduced on UML + KASAN: kernel-mode fault at addr 0x0 with\nmemcpy_orig at the crash site. Same shape reproduces inside a\nrootless Docker container with --cap-add NET_ADMIN on a stock\ndistro kernel.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-64114"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1065b9efa4126df559b03a849c139ecfae92cd25",
"url": "https://git.kernel.org/stable/c/1065b9efa4126df559b03a849c139ecfae92cd25"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/145e9afa5b905229b4788bb72c3255f5a5f77508",
"url": "https://git.kernel.org/stable/c/145e9afa5b905229b4788bb72c3255f5a5f77508"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3c5411fa4944ed99af3d9d1de750ea8169b6dac9",
"url": "https://git.kernel.org/stable/c/3c5411fa4944ed99af3d9d1de750ea8169b6dac9"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5a564f737ec54d63e8ee221d3ff396d07586d464",
"url": "https://git.kernel.org/stable/c/5a564f737ec54d63e8ee221d3ff396d07586d464"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7725cd3b471740fd23d25ed1da722c671fb2a5d3",
"url": "https://git.kernel.org/stable/c/7725cd3b471740fd23d25ed1da722c671fb2a5d3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/915fab69823a14c170dbaa3b41978768e0fe62fc",
"url": "https://git.kernel.org/stable/c/915fab69823a14c170dbaa3b41978768e0fe62fc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bbe0be67de296176e7243c76e3d9f02f6ae9ff0b",
"url": "https://git.kernel.org/stable/c/bbe0be67de296176e7243c76e3d9f02f6ae9ff0b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bc20dbd48c26e743f7e0845020c11ed2ce8b15ee",
"url": "https://git.kernel.org/stable/c/bc20dbd48c26e743f7e0845020c11ed2ce8b15ee"
}
],
"release_date": "2026-07-19T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-74510",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix UAF in pair command cancellation\n\nThe pairing completion and authentication failure callbacks look up the\npending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending. The\nlookup returned a command that was still linked on the shared pending list,\nwithout keeping mgmt_pending_lock held for the later dereference and\nremoval.\n\nA concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the\nsame pending command before the callback uses it. The reverse race is also\npossible when cancel_pair_device() gets a command from pending_find() and a\ncallback removes it before the cancel path dereferences it. This can lead\nto a use-after-free and a second list_del().\n\nMake the pairing lookup helpers transfer ownership of the pending command\nby removing it from hdev->mgmt_pending while holding mgmt_pending_lock.\nThe callbacks and cancel path then complete the command and free it\ndirectly, so racing paths cannot find or free the same command again. Take\na temporary hci_conn reference in cancel_pair_device() because the command\ncompletion drops the reference stored in the pending command.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-74510"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/50af4280a587c9971b5388cbc438f1324e626b7b",
"url": "https://git.kernel.org/stable/c/50af4280a587c9971b5388cbc438f1324e626b7b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/51be7280980fddc90ebe874a69c2fe8ab02bb46a",
"url": "https://git.kernel.org/stable/c/51be7280980fddc90ebe874a69c2fe8ab02bb46a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7c2a152a897cd1c184b2051484d4f74d803e7f4a",
"url": "https://git.kernel.org/stable/c/7c2a152a897cd1c184b2051484d4f74d803e7f4a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/86ed4dd6548ccf277bc691bc912ca06e76b9d80c",
"url": "https://git.kernel.org/stable/c/86ed4dd6548ccf277bc691bc912ca06e76b9d80c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/c569def320aa8b1fde89227e2ea96606790fd86d",
"url": "https://git.kernel.org/stable/c/c569def320aa8b1fde89227e2ea96606790fd86d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd",
"url": "https://git.kernel.org/stable/c/d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd"
}
],
"release_date": "2026-08-15T13:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-46191",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Avoid OOB font access if console rotation fails\n\nClear the font buffer if the reallocation during console rotation fails\nin fbcon_rotate_font(). The putcs implementations for the rotated buffer\nwill return early in this case. See [1] for an example.\n\nCurrently, fbcon_rotate_font() keeps the old buffer, which is too small\nfor the rotated font. Printing to the rotated console with a high-enough\ncharacter code will overflow the font buffer.\n\nv2:\n- fix typos in commit message",
"title": "Vulnerability description"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-46191"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/46cf3646dea54baeaa2eafe3fb1ba769947f31b0",
"url": "https://git.kernel.org/stable/c/46cf3646dea54baeaa2eafe3fb1ba769947f31b0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/524a6079395916fb3d790ef2bb46a1d2939b27dd",
"url": "https://git.kernel.org/stable/c/524a6079395916fb3d790ef2bb46a1d2939b27dd"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/594973a2e54924d8ba31c9faac669fc1ba6fcb80",
"url": "https://git.kernel.org/stable/c/594973a2e54924d8ba31c9faac669fc1ba6fcb80"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7105d9f1387d63b15c9a860674fc92c959181f2f",
"url": "https://git.kernel.org/stable/c/7105d9f1387d63b15c9a860674fc92c959181f2f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ab6c34b9829d5de03f1d08a47a2253729a6e7e27",
"url": "https://git.kernel.org/stable/c/ab6c34b9829d5de03f1d08a47a2253729a6e7e27"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b44cc78ff46b96e72d333a3be6aaaa0a14797263",
"url": "https://git.kernel.org/stable/c/b44cc78ff46b96e72d333a3be6aaaa0a14797263"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b51c343a81e6e806525a4435e22532c107dd7e9d",
"url": "https://git.kernel.org/stable/c/b51c343a81e6e806525a4435e22532c107dd7e9d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e4ef723d8975a2694cc90733a6b888a5e2841842",
"url": "https://git.kernel.org/stable/c/e4ef723d8975a2694cc90733a6b888a5e2841842"
},
{
"category": "external",
"summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"release_date": "2026-05-28T10:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
]
},
{
"cve": "CVE-2026-97612",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: clear inner_protocol when the last label is popped\n\nskb_mpls_push() records the pre-encapsulation network header once, gated\non !skb->inner_protocol. skb_mpls_pop() never clears that record, so it\noutlives the encapsulation it describes.\n\nOpen vSwitch can then re-push MPLS onto a packet whose\ninner_network_header still points at the older, deeper offset: push a\nlabel, pop every label, recirculate (ovs_flow_key_update() re-derives\nkey->eth.type and resets network_header, but leaves inner_*), then push\nagain. ovs_fragment() trusts the record:\n\n\tskb->network_header = skb->inner_network_header;\n\nso skb_network_offset() goes negative. The bound check is signed:\n\n\tif (skb_network_offset(skb) > MAX_L2_LEN)\n\na negative offset passes it, and prepare_frag() widens the value:\n\n\tunsigned int hlen = skb_network_offset(skb);\n\tmemcpy(&data->l2_data, skb->data, hlen);\n\nwhich is a ~4GiB memcpy out of a 30-byte per-CPU buffer.\n\nReproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):\n\n BUG: unable to handle page fault for address: ffffe8ffffc16000\n #PF: supervisor write access in kernel mode\n Oops: 0002 [#1] SMP KASAN NOPTI\n RIP: 0010:memcpy+0x8/0x20\n RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000\n prepare_frag+0x3df/0x4e0\n ovs_fragment+0x589/0x7e0\n do_output+0x4ce/0x5e0\n do_execute_actions+0x55d2/0x7b30\n ovs_execute_actions+0xea/0x450\n\nSame root-cause shape as commit 975b5b067f52 (\"ipv6: sr: restore network\nheader before routing and forwarding\"): a stale network header offset\nreaching a consumer that widens it. Here it originates in the MPLS\npush/pop path.\n\nClear inner_protocol once the packet is no longer MPLS, so a later push\nre-records the current header. net/sched/act_mpls.c is the only other\nskb_mpls_pop() caller and gets the same fix; sch_frag.c saves and\nrestores inner_protocol around fragmentation in the same way OVS does.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-97612"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0",
"url": "https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0b3425fd0ecd515997956f7bb8a8a576b444ed64",
"url": "https://git.kernel.org/stable/c/0b3425fd0ecd515997956f7bb8a8a576b444ed64"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34",
"url": "https://git.kernel.org/stable/c/38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/55ed97db27bffe29c21fdefd5d25601322c36ff8",
"url": "https://git.kernel.org/stable/c/55ed97db27bffe29c21fdefd5d25601322c36ff8"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae",
"url": "https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/833ec2788322306407503b4cfc7745cd1f9d785f",
"url": "https://git.kernel.org/stable/c/833ec2788322306407503b4cfc7745cd1f9d785f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327",
"url": "https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e",
"url": "https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e"
}
],
"release_date": "2026-09-25T11:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98427",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: codel: bound the dropping loop per dequeue call\n\nThe CoDel control law schedules the next drop one interval/sqrt(count)\nafter the previous drop, using the configured interval\n(codel_params.interval). For very small intervals the scheduled step\nrounds down to zero, so the dropping loop in codel_dequeue() never\nadvances and drains the entire backlog under the qdisc lock in one\ncall - an unprivileged user can trigger a soft lockup this way.\n\nFix in the shared codel code used by both codel and fq_codel:\n\n1. Make the control-law step at least 1 tick so the dropping loop\n always moves forward.\n\n2. Cap the dropping loop at CODEL_MAX_DROPS_PER_DEQUEUE (256) drops\n per codel_dequeue() call, resyncing drop_next to now when the cap\n is hit: the catch-up owed to the loop grows with the idle gap and\n the backlog, which no interval threshold can bound. This is a\n deliberate behaviour change after long idle gaps.\n\nThe cap applies to fq_codel (4b549a2ef4be) and the mac80211 TXQ path\n(fixed interval, cap only).\n\nThe target sojourn delay (codel_params.target) is not validated: it\ndoes not feed the control law, so a sub-tick value is aggressive\nrather than deadlock-prone.\n\nConditions to recreate the bug:\n - tc qdisc add dev lo root handle 1: tbf rate 1kbit burst 2kb limit 1000000\n - tc qdisc add dev lo parent 1:1 handle 10: codel interval 2us target 1ms noecn limit 1000000 (same for fq_codel)\n - unpatched kernel: tc accepts it; a UDP flood under the 1kbit tbf\n soft-lockups (watchdog: BUG: soft lockup) while one\n codel_dequeue() call drops the backlog under the qdisc lock\n - patched kernel: same setup, at most 256 drops per dequeue call,\n no soft lockup\n\nTesting: claim reproducer and interval 2us/3us variants run clean;\ntdc qdisc category passes (see the selftests patch).",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98427"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7f4a5ec6258fd7c92633ec4b0493fc51166d9398",
"url": "https://git.kernel.org/stable/c/7f4a5ec6258fd7c92633ec4b0493fc51166d9398"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bacd72289d34d8c05b7de5a12448b87b6dd93878",
"url": "https://git.kernel.org/stable/c/bacd72289d34d8c05b7de5a12448b87b6dd93878"
}
],
"release_date": "2026-10-14T14:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-68477",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix more places with wrong ipv6 transport offsets\n\nSashiko reports for more incorrect IPv6 transport offsets.\n\nThe app code for TCP was assuming IPv4 network header\neven after the ipvsh argument was provided. This can\ncause problems with apps over IPv6. As for the only\nofficial app in the kernel tree (FTP) this problem is\nharmless because we use Netfilter to mangle the FTP\nports and we do not adjust the TCP seq numbers.\n\nAlso, provide correct offset of the ICMPV6 header in\nip_vs_out_icmp_v6() for correct checksum checks when\nthe IPv6 packet has extension headers.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-68477"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3a9dc9b55b53d94613a587604b77d3b20024090c",
"url": "https://git.kernel.org/stable/c/3a9dc9b55b53d94613a587604b77d3b20024090c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/613ce63711b8d431bba90781f133c39a21684f87",
"url": "https://git.kernel.org/stable/c/613ce63711b8d431bba90781f133c39a21684f87"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/7350eb7ead172ae8024897d4b0f2e15c5318279c",
"url": "https://git.kernel.org/stable/c/7350eb7ead172ae8024897d4b0f2e15c5318279c"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/905d7a363ade96a19f214815361e11981142c547",
"url": "https://git.kernel.org/stable/c/905d7a363ade96a19f214815361e11981142c547"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/95d4511d81b2b37e5d2bdde5d912e48243eae517",
"url": "https://git.kernel.org/stable/c/95d4511d81b2b37e5d2bdde5d912e48243eae517"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a3f0d5b605cd5da5c95279969fb8cea4e55cee5b",
"url": "https://git.kernel.org/stable/c/a3f0d5b605cd5da5c95279969fb8cea4e55cee5b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/b3fe4cbd583895987935a9bdad01c8f9d3a02310",
"url": "https://git.kernel.org/stable/c/b3fe4cbd583895987935a9bdad01c8f9d3a02310"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d4ec18f48ce78a3bf7c999ac908691007375fe99",
"url": "https://git.kernel.org/stable/c/d4ec18f48ce78a3bf7c999ac908691007375fe99"
}
],
"release_date": "2026-08-15T06:20:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-89709",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlockd, nfsd: RCU-protect nlmsvc_ops dispatch\n\nnlmsvc_ops is published by nfsd_lockd_init() and cleared by\nnfsd_lockd_shutdown() with plain stores, while lockd dereferences\nit unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer\ntargets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's\n.text, so a stale load after rmmod nfsd results in either a NULL\nderef or a module-text use-after-free.\n\nDeclare nlmsvc_ops as __rcu, publish via rcu_assign_pointer(), clear\nvia RCU_INIT_POINTER() + synchronize_rcu(). Add a struct module\n*owner field to nlmsvc_binding and pin the module across indirect\ncalls with try_module_get/module_put. When the binding is torn down,\nfall back to fput() to avoid leaking struct file references.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-89709"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3c461a1820088fb5889d73a6522369bde45527a9",
"url": "https://git.kernel.org/stable/c/3c461a1820088fb5889d73a6522369bde45527a9"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/43943532c105ea8fe26039a1347cfda4ac0fcadc",
"url": "https://git.kernel.org/stable/c/43943532c105ea8fe26039a1347cfda4ac0fcadc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/641e5e20852359b8c31149be4598884e30652f60",
"url": "https://git.kernel.org/stable/c/641e5e20852359b8c31149be4598884e30652f60"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6e7495972039f212e336e552b58cac9dd54611c3",
"url": "https://git.kernel.org/stable/c/6e7495972039f212e336e552b58cac9dd54611c3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/836ce2b99bcce6d68c58edd04efbc5cd1fd581af",
"url": "https://git.kernel.org/stable/c/836ce2b99bcce6d68c58edd04efbc5cd1fd581af"
}
],
"release_date": "2026-09-11T20:19:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98428",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb: 6fire: Avoid embedded URBs\n\nThe USB 6fire driver uses URBs embedded in different structs for PCM,\nMIDI and communication, and this is basically a buggy implementation\nnowadays; since a URB is managed with a refcount, this may lead to a\nUAF when the URB is released asynchronously.\n\nFor addressing the problem, this patch converts those embedded URBs to\nones that are properly allocated via usb_alloc_urb(). The\npcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence\nit's found in urb.iso_frame_desc[] instead.\n\nThe conversions are rather straightforward; each embedded struct urb\nis changed to a pointer, and its callers are updated accordingly.\nThe resource for those structs are released in the common destructor\nfunctions (usb6fire_comm_free(), etc), which are called at both the\ninit error path and the disconnect.\n\nNo functional changes, only compile-tested.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98428"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a",
"url": "https://git.kernel.org/stable/c/3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/52a43c2d57e774489ac3fbbac06ff02f19bd9a52",
"url": "https://git.kernel.org/stable/c/52a43c2d57e774489ac3fbbac06ff02f19bd9a52"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8b8559aeaba2e51cfee1779b2383b085991f7d81",
"url": "https://git.kernel.org/stable/c/8b8559aeaba2e51cfee1779b2383b085991f7d81"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/999f433c09e4668412bd68ca207ae2b4af863862",
"url": "https://git.kernel.org/stable/c/999f433c09e4668412bd68ca207ae2b4af863862"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/9fe49dbc023e82dfaee7b245997d820d01742a9a",
"url": "https://git.kernel.org/stable/c/9fe49dbc023e82dfaee7b245997d820d01742a9a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d181434549b3da668110a25d743848cce9897f4e",
"url": "https://git.kernel.org/stable/c/d181434549b3da668110a25d743848cce9897f4e"
}
],
"release_date": "2026-10-14T14:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98386",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot\n\nFor QLAFX00 the request ring is ioremapped device I/O memory\n(ha->iobase + req_que_off), not DMA-coherent RAM, which is why the rest\nof the FX00 path accesses it through memcpy_toio() and the wrt_reg_*\nhelpers. __qla2x00_alloc_iocbs() however zeroed the producer slot with a\nplain memset(). On architectures such as ARM64 a regular memset() may\nemit unaligned or block-zeroing instructions (e.g. DC ZVA) that are\ninvalid on Device memory, leading to a synchronous external abort.\n\nUse memset_io() to clear the slot for QLAFX00, matching the I/O\naccessors used elsewhere on this ring. Other adapters keep the plain\nmemset() on their DMA-coherent rings. The zero-fill is retained for FX00\nbecause its IOCB builders (e.g. qlafx00_fxdisc_iocb()) copy only part of\nthe entry and rely on the unused tail being pre-zeroed.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98386"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2df8c8630904794100189fa3d70598642e1877ce",
"url": "https://git.kernel.org/stable/c/2df8c8630904794100189fa3d70598642e1877ce"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/53eb96c244d150dfb8cc4b5b0492ab53755f3701",
"url": "https://git.kernel.org/stable/c/53eb96c244d150dfb8cc4b5b0492ab53755f3701"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/626e44f3d8a924a97a3848a9fd45833947e081e9",
"url": "https://git.kernel.org/stable/c/626e44f3d8a924a97a3848a9fd45833947e081e9"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6ee6dfd922fafd508f6bde16de30dd2db796b7a7",
"url": "https://git.kernel.org/stable/c/6ee6dfd922fafd508f6bde16de30dd2db796b7a7"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e41d28d9a242c4005b7d01a7ee7769405a6a2c2e",
"url": "https://git.kernel.org/stable/c/e41d28d9a242c4005b7d01a7ee7769405a6a2c2e"
}
],
"release_date": "2026-10-14T14:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-53004",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks\n\nsctp_getsockopt_peer_auth_chunks() checks that the caller's optval\nbuffer is large enough for the peer AUTH chunk list with\n\n if (len < num_chunks)\n return -EINVAL;\n\nbut then writes num_chunks bytes to p->gauth_chunks, which lives\nat offset offsetof(struct sctp_authchunks, gauth_chunks) == 8\ninside optval. The check is missing the sizeof(struct\nsctp_authchunks) = 8-byte header. When the caller supplies\nlen == num_chunks (for any num_chunks > 0) the test passes but\ncopy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes\npast the declared buffer.\n\nThe sibling function sctp_getsockopt_local_auth_chunks() at the\nnext line already has the correct check:\n\n if (len < sizeof(struct sctp_authchunks) + num_chunks)\n return -EINVAL;\n\nAlign the peer variant with its sibling.\n\nReproducer confirms on v7.0-13-generic: an unprivileged userspace\ncaller that opens a loopback SCTP association with AUTH enabled,\nqueries num_chunks with a short optval, then issues the real\ngetsockopt with len == num_chunks and sentinel bytes painted past\nthe buffer observes those sentinel bytes overwritten with the\npeer's AUTH chunk type. The bytes written are under the peer's\ncontrol but land in the caller's own userspace; this is not a\nkernel memory corruption, but it is a kernel-side contract\nviolation that can silently corrupt adjacent userspace data.",
"title": "Vulnerability description"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-53004"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0cf004ffb61cd32d140531c3a84afe975f9fc7ea",
"url": "https://git.kernel.org/stable/c/0cf004ffb61cd32d140531c3a84afe975f9fc7ea"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/2b5a2c957c7769d40110f725cf23987fcef50d75",
"url": "https://git.kernel.org/stable/c/2b5a2c957c7769d40110f725cf23987fcef50d75"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6849b995cda88a677bf08a05765d1db7905974fc",
"url": "https://git.kernel.org/stable/c/6849b995cda88a677bf08a05765d1db7905974fc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6bcf8fe4ef7967b22b814cbae9a57bbd3c853410",
"url": "https://git.kernel.org/stable/c/6bcf8fe4ef7967b22b814cbae9a57bbd3c853410"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/70a089cc9590aa347a61e84434116ab74619e3c3",
"url": "https://git.kernel.org/stable/c/70a089cc9590aa347a61e84434116ab74619e3c3"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/a132e199de69e2a45628aa8534df1bf5d44e1b6e",
"url": "https://git.kernel.org/stable/c/a132e199de69e2a45628aa8534df1bf5d44e1b6e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d45c7e99caf915b0f6c716bd8ffe9d45b9685761",
"url": "https://git.kernel.org/stable/c/d45c7e99caf915b0f6c716bd8ffe9d45b9685761"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/d67fbc6dea5dbf7f46c618ebf65910a276078e20",
"url": "https://git.kernel.org/stable/c/d67fbc6dea5dbf7f46c618ebf65910a276078e20"
}
],
"release_date": "2026-06-24T17:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
]
},
{
"cve": "CVE-2026-98490",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: conntrack: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n -> nf_ct_helper()\n -> helper->help()\n -> nf_ct_expect_related_report()\n -> nf_ct_expect_insert()\n -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that's not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure. And\nthere are no atomicity guarantees provided by the API anyway.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98490"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/18866dc1f525f9ee4de7709529d1ae1af8d8e8be",
"url": "https://git.kernel.org/stable/c/18866dc1f525f9ee4de7709529d1ae1af8d8e8be"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/1a4151e6be57b098b7a5ebfbde58585e83200cdc",
"url": "https://git.kernel.org/stable/c/1a4151e6be57b098b7a5ebfbde58585e83200cdc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5f23080a625dd7855ab91485c8d691a54a1979f0",
"url": "https://git.kernel.org/stable/c/5f23080a625dd7855ab91485c8d691a54a1979f0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/afcf362625190c5260530b1d6c7daa98831f6b83",
"url": "https://git.kernel.org/stable/c/afcf362625190c5260530b1d6c7daa98831f6b83"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e02a83bb0b7a203f6a22f55ad5f426765560f811",
"url": "https://git.kernel.org/stable/c/e02a83bb0b7a203f6a22f55ad5f426765560f811"
}
],
"release_date": "2026-10-18T16:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98017",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: defer qdisc freeing after failed creation\n\nAn RTM_NEWQDISC request can make clsact bind a populated shared ingress\nblock during ->init(), publishing an embedded mini_Qdisc to lockless\nreaders. If the same request has an invalid TCA_RATE, estimator setup\nfails after ->init(); the unwind removes the pointer but synchronously\nfrees its containing qdisc while tc_run() may still hold it.\n\nRetire failed qdiscs through the same RCU helper as normal destruction.\nInline the synchronous free into the callback now that no direct callers\nremain.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98017"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e",
"url": "https://git.kernel.org/stable/c/156a3bab69744e9225bb9eff8c5cc53da18d5a2e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e",
"url": "https://git.kernel.org/stable/c/20bf6fa34b345333971bd4464a322cce87b83f4e"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101",
"url": "https://git.kernel.org/stable/c/5bfe927c5b4b290fad529186218c728589b4b101"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d",
"url": "https://git.kernel.org/stable/c/6a1b49bb9fdf9e8e7aa38e8cd635c0cc4074447d"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/96a27a3e64e7c87abade03fb2ad04ed66992a89a",
"url": "https://git.kernel.org/stable/c/96a27a3e64e7c87abade03fb2ad04ed66992a89a"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea",
"url": "https://git.kernel.org/stable/c/e6662f2100f8d33b0f4d0047c219efd6bba186ea"
}
],
"release_date": "2026-09-25T11:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-98479",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Check the data direction of a Data-In PDU\n\nThe Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task\nand copies the PDU's data segment into that command's scatterlist without\nasking whether the command was reading. iscsi_tcp_r2t_rsp() in the same\nfile does ask, and rejects an R2T for a command that is not DMA_TO_DEVICE.\n\nA target that answers a WRITE command's ITT with a Data-In therefore has\nthe initiator write target-supplied bytes into the pages that write was\nabout to send. Those are the caller's own pinned pages for an O_DIRECT\nwrite, and page cache pages for a buffered one.\n\nObserved against a test target that emits one 512-byte Data-In naming a 128\nKB write's ITT, after the R2T for that write. With O_DIRECT the caller's\nbuffer ends up holding 512 bytes of the target's data while pwrite()\nreturns 131072. Buffered is quieter: pwrite() and fsync() both succeed,\nnothing is logged, and reading those blocks back returns the target's bytes\nout of the page cache without a command going on the wire.\n\nCheck the direction before using the scatterlist, the way the R2T path\nalready does.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-98479"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/24ffc919467d20951f0f132d1c75294e2e91e09b",
"url": "https://git.kernel.org/stable/c/24ffc919467d20951f0f132d1c75294e2e91e09b"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/79991b770fc3685b1d5cf805b659a879edd19931",
"url": "https://git.kernel.org/stable/c/79991b770fc3685b1d5cf805b659a879edd19931"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/8db1232945bc663fb94f300090a1fc108de99296",
"url": "https://git.kernel.org/stable/c/8db1232945bc663fb94f300090a1fc108de99296"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/94e5bdd08e51c450d954bc592f591c233ca5c9df",
"url": "https://git.kernel.org/stable/c/94e5bdd08e51c450d954bc592f591c233ca5c9df"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/bce07e2f37b5e4a427d36fd6b1c14067b27591db",
"url": "https://git.kernel.org/stable/c/bce07e2f37b5e4a427d36fd6b1c14067b27591db"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/de96dc11aee0d058927bff94a168e3c5c46483e2",
"url": "https://git.kernel.org/stable/c/de96dc11aee0d058927bff94a168e3c5c46483e2"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/e3b25bf2cf2496e85bc05b33360faf9fdf880e03",
"url": "https://git.kernel.org/stable/c/e3b25bf2cf2496e85bc05b33360faf9fdf880e03"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/ee56b5e18f566c0b5a183379dcd63d402cebf2f8",
"url": "https://git.kernel.org/stable/c/ee56b5e18f566c0b5a183379dcd63d402cebf2f8"
}
],
"release_date": "2026-10-18T16:16:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-89557",
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: do overflow check for sb->bblog_shift in super_1_load()\n\nIn super_1_load(), sb->bblog_shift is an __u8 type value loaded from on-\ndisk superblock. It is used for badblocks API badblocks_set() by the\nfollowing sequence,\n\n 1930 rdev->badblocks.shift = sb->bblog_shift;\n 1931 for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) {\n 1932 u64 bb = le64_to_cpu(*bbp);\n 1933 int count = bb & (0x3ff);\n 1934 u64 sector = bb >> 10;\n 1935 sector <<= sb->bblog_shift;\n 1936 count <<= sb->bblog_shift;\n 1937 if (bb + 1 == 0)\n 1938 break;\n 1939 if (!badblocks_set(&rdev->badblocks, sector, count, 1))\n 1940 return -EINVAL;\n 1941 }\n\nbb->bblog_shit is in range of 0-255, variable sector is 64bit width, for\nan invalid bb->bblog_shit, it is possible to make sector be overflowed\nby the following calculation,\n 1935 sector <<= sb->bblog_shift;\nThen in turn when call badblocks_set() at line 1939 with the invalid\nrdev->badblocks.shift set at line 1930, may result an overflow inside\n_badblocks_clear() in block/badblocks.c.\n\nAlthough there are many places to call badblocks APIs, the non-zero\nshift value is only used in super_1_load(), other places always use 0 as\nthe shift value. Therefore it is unnecessary to do a general shift value\noverflow check inside badblock API, and just check here as the caller.\n\nThis may avoid unnecessary check, make the badblocks API code more simple\nand elegant.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-89557"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/0a03f9541c06fda64301dcf94f376f07ce2cc396",
"url": "https://git.kernel.org/stable/c/0a03f9541c06fda64301dcf94f376f07ce2cc396"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/323f3a056dbccb39a642ebde642044a680f3a6d6",
"url": "https://git.kernel.org/stable/c/323f3a056dbccb39a642ebde642044a680f3a6d6"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/35d522bd32462afcf1981dab6da8a9256c26c1e0",
"url": "https://git.kernel.org/stable/c/35d522bd32462afcf1981dab6da8a9256c26c1e0"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/3b097416b4cff77285c1f472fc2c4058d8a7554f",
"url": "https://git.kernel.org/stable/c/3b097416b4cff77285c1f472fc2c4058d8a7554f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/573fb68105fdc6a127ba6069e58a0d2aff3c9f93",
"url": "https://git.kernel.org/stable/c/573fb68105fdc6a127ba6069e58a0d2aff3c9f93"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/75d15738fd33a782606d0dc80cfeff47edf2ddd8",
"url": "https://git.kernel.org/stable/c/75d15738fd33a782606d0dc80cfeff47edf2ddd8"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/94c820d99a4305d4ded41a97ed37ec7d26c56e7f",
"url": "https://git.kernel.org/stable/c/94c820d99a4305d4ded41a97ed37ec7d26c56e7f"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/df7d4d011d5ace20699ea948712f09f9ac08924f",
"url": "https://git.kernel.org/stable/c/df7d4d011d5ace20699ea948712f09f9ac08924f"
}
],
"release_date": "2026-09-11T20:19:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
},
{
"cve": "CVE-2026-64015",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsecurity/keys: fix missed RCU read section on lookup\n\nNicholas Carlini reports that the keyring code calls assoc_array_find()\nin find_key_to_update() without holding the RCU read lock, while the\nassoc_array_gc() code really is designed around removing the node from\nthe tree and then freeing it after an RCU grace-period.\n\nThe regular key handling doesn't see this because holding the keyring\nsemaphore hides any lifetime issues, but the persistent key handling\nuses a different model.\n\nInstead of extending the keyring locking, just do the simple RCU locking\nthat the assoc_array was designed for.",
"title": "Vulnerability description"
}
],
"product_status": {
"fixed": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://cve.tuxcare.com/els/cve/CVE-2026-64015"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/43a1e3744548e6fd85873e6fb43e293eb4010694",
"url": "https://git.kernel.org/stable/c/43a1e3744548e6fd85873e6fb43e293eb4010694"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/4c5d407ba3ff7f30561ff73ba1b07ed70c864edc",
"url": "https://git.kernel.org/stable/c/4c5d407ba3ff7f30561ff73ba1b07ed70c864edc"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/50bb3435a5e627bfbdc52eb4536f49f88b3486b8",
"url": "https://git.kernel.org/stable/c/50bb3435a5e627bfbdc52eb4536f49f88b3486b8"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/5659e6923cb72f8e18e8b539109ab512455fe195",
"url": "https://git.kernel.org/stable/c/5659e6923cb72f8e18e8b539109ab512455fe195"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/66288dcadf80974436250e9f70ed848836b835b5",
"url": "https://git.kernel.org/stable/c/66288dcadf80974436250e9f70ed848836b835b5"
},
{
"category": "external",
"summary": "https://git.kernel.org/stable/c/cefa4265b11176c897a7d9e8e54d89e3701c5584",
"url": "https://git.kernel.org/stable/c/cefa4265b11176c897a7d9e8e54d89e3701c5584"
}
],
"release_date": "2026-07-19T16:17:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-30T09:46:03.697987Z",
"details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561",
"product_ids": [
"Oracle-Linux-7:bpftool-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-debug-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-doc-0:3.10.0-1160.167.2.el7.tuxcare.els2.noarch",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.i686",
"Oracle-Linux-7:kernel-headers-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:kernel-tools-libs-devel-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64",
"Oracle-Linux-7:python-perf-0:3.10.0-1160.167.2.el7.tuxcare.els2.x86_64"
],
"url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793353561"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
]
}
]
}