{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}\n- wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE {CVE-2026-98827}\n- ext4: clear error before retrying inode xattr space fallback {CVE-2025-22121}\n- ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() {CVE-2025-22121}\n- ext4: introduce ITAIL helper {CVE-2025-22121}\n- ocfs2: validate orphan slot during inode read {CVE-2026-90205}\n- ocfs2: validate DIO orphan slot during inode read {CVE-2026-90204}\n- HID: logitech-hidpp: Fix FF device cleanup on init failure {CVE-2026-90330}\n- HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure {CVE-2026-43049}\n- bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}\n- bpf: Simplify sanitize_err() signature {CVE-2026-74720}\n- libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656}\n- libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955}\n- net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}\n- net: add skb_header_pointer_careful() helper {CVE-2026-23204}\n- ipvs: bound LBLCR and LBLC cache growth {CVE-2026-98857}\n- ipvs: fix missing counter decrement in lblc {CVE-2026-98857}\n- tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}\n- tty: skip cdev_del() when no cdev is registered {CVE-2026-90335}\n- HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}\n- hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826}\n- drm/nouveau: fix double-free in nvif_vmm_dtor {CVE-2026-98515}\n- HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}\n- net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377}\n- RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582}\n- IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}\n- ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}\n- net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}\n- devlink: Fix use-after-free after a failed reload {CVE-2022-3625}\n- Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}\n- tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}\n- team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}\n- tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}\n- KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}\n- wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop {CVE-2026-80947}\n- ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}\n- net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}\n- power: supply: sbs-battery: Fix use-after-free in power_supply_changed() {CVE-2026-45916}\n- sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}\n- tipc: restrict socket queue dumps in enqueue tracepoints {CVE-2026-72299}\n- tipc: hold a reference to nodes found by link name {CVE-2026-99053}\n- bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS {CVE-2024-26589}\n- md/raid5: fix atomicity violation in raid5_cache_count {CVE-2024-23307}\n- bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}\n- HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729}\n- net/9p: fix race condition on rdma->state in trans_rdma.c {CVE-2026-72491}\n- SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}\n- net/sched: act_api: use RCU with deferred freeing for action lifecycle {CVE-2026-53264}\n- mac802154: llsec: add skb_cow_data() before in-place crypto {CVE-2026-63831}\n- Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739}\n- ALSA: line6: reject oversized playback packets {CVE-2026-98836}\n- net: lock the socket in sock_gettstamp() {CVE-2026-98276}\n- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}\n- wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}\n- net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}\n- ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}\n- ipvs: filter some flags received in the backup server {CVE-2026-98794}\n- ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock {CVE-2026-89655}\n- scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856}\n- nvme-tcp: check the data direction of a C2HData PDU {CVE-2026-89973}\n- ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}\n- scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847}\n- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}\n- RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}\n- ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}\n- ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet {CVE-2026-89607}\n- xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}\n- ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}\n- mpls: reload header after pskb_may_pull() {CVE-2026-89555}\n- vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}\n- wifi: mwifiex: validate scan response extents {CVE-2026-98185}\n- smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}\n- KVM: x86: Use active memslots for the per-vCPU MMIO cache {CVE-2026-99082}\n- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}\n- smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}\n- drbd: reject data replies with an out-of-range payload size {CVE-2026-72014}\n- sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}\n- xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}\n- sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}\n- netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007}\n- staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479}\n- iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}\n- scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083}\n- sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}\n- ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}\n- net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}\n- Bluetooth: MGMT: validate advertising TLV before type checks {CVE-2026-53255}\n- ip6mr: do not clone dst in ip6mr_cache_report() {CVE-2026-90111}\n- ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}\n- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}\n- net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}\n- openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487}\n- svcrdma: Reject connection when transport allocation fails {CVE-2026-89531}\n- ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}\n- libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}\n- configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}\n- net: sungem: fix probe error cleanup {CVE-2026-72406}\n- scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}\n- rhashtable: clear stale iter->p on table restart {CVE-2026-64563}\n- sctp: drop a chunk if its transport was removed {CVE-2026-89478}\n- tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}\n- tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}\n- libceph: replace BUG_ON with bounds check for map->max_osd {CVE-2025-68283}\n- Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}\n- HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}\n- scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}\n- bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}\n- net: gue: reject invalid REMCSUM offsets {CVE-2026-98621}\n- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}\n- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}\n- scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task {CVE-2022-48792}\n- drop_monitor: fix out-of-bounds write in reset_per_cpu_data() {CVE-2026-98419}\n- ipvs: reject invalid states in connection template sync records {CVE-2026-97596}\n- bpf: Fix UAF in sock clone early bailouts {CVE-2026-68399}\n- net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size {CVE-2026-98027}\n- ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}\n- dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}\n- xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}\n- USB: serial: fix port tear down use-after-free {CVE-2026-98772}\n- nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}\n- wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}\n- wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() {CVE-2026-68373}\n- wifi: cfg80211: bound element ID read when checking non-inheritance {CVE-2026-68402}\n- fou: Fix use-after-free in fou_create() {CVE-2026-74496}\n- scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}\n- NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}\n- wifi: libipw: reject too-short association responses {CVE-2026-98348}\n- ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006}\n- smb: client: fix OOB in receive_encrypted_standard() {CVE-2024-0565}\n- nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU {CVE-2026-89969}\n- media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}\n- sctp: clear control chunk transport if it is being removed {CVE-2026-74688}\n- nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965}\n- sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}\n- tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}\n- Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}\n- ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}\n- ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}\n- libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}\n- scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}\n- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}\n- libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}\n- char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}\n- tipc: fix UAF in tipc_l2_send_msg() {CVE-2026-74255}\n- libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}\n- libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}\n- libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956}\n- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}\n- nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}\n- ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}\n- nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}\n- fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129}\n- sctp: check RCV_SHUTDOWN after the sendmsg connect wait {CVE-2026-98846}\n- net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015}\n- Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}\n- uio: Fix stale info pointer in failed registration path {CVE-2026-93054}\n- nvme: add missing SRCU grace period in error path {CVE-2026-89972}\n- media: em28xx: defer audio-only extension registration {CVE-2026-89892}\n- vxlan: use one headroom snapshot for neighbour replies {CVE-2026-98568}\n- phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}\n- net: phonet: free phonet_device after RCU grace period {CVE-2026-53157}\n- netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}\n- KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails {CVE-2026-98863}\n- libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}\n- wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}\n- thunderbolt: Reject oversized XDomain properties responses {CVE-2026-98687}\n- ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}\n- RDMA/srpt: Do not register event handler until srpt device is fully setup {CVE-2024-26872}\n- libceph: remove debugfs files before client teardown {CVE-2026-68153}\n- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}\n- crypto: xts - Handle EBUSY correctly {CVE-2023-53494}\n- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}\n- sound: ua101: fix division by zero at probe {CVE-2026-46184}\n- Squashfs: check block offset is not negative {CVE-2026-90203}\n- HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}\n- power: supply: lp8727: fix use-after-free in lp8727_release_irq() {CVE-2026-89469}\n- media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}\n- Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}\n- wifi: b43: enforce bounds check on firmware key index in b43_rx() {CVE-2026-46122}\n- ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}\n- btrfs: abort transaction on failure to update inode for hole punching and reflinking {CVE-2026-98269}\n- vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}\n- net: slip: serialize receive against buffer reallocation {CVE-2026-68143}\n- RDMA/srpt: fix integer overflow in immediate data length check {CVE-2026-74394}\n- IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217}\n- ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002}\n- RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104}\n- usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}\n- drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}\n- sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}\n- gue: validate REMCSUM private option length {CVE-2026-72351}\n- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}\n- wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}\n- md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}\n- forcedeth: fix UAF of txrx_stats in nv_remove {CVE-2026-74548}\n- wifi: libipw: fix key index receive bound checks {CVE-2026-93803}\n- thunderbolt: Clamp XDomain response data copy to allocation size {CVE-2026-53148}\n- wifi: b43legacy: enforce bounds check on firmware key index in RX path {CVE-2026-46163}\n- batman-adv: tt: prevent TVLV OOB check overflow {CVE-2026-72226}\n- ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() {CVE-2026-63924}\n- udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}\n- firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}\n- ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}\n- batman-adv: access unicast_ttvn skb->data only after skb realloc {CVE-2026-72234}\n- Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}\n- ceph: fix a buffer leak in __ceph_setxattr() {CVE-2026-52962}\n- thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}\n- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189}\n- batman-adv: gw: acquire ethernet header only after skb realloc {CVE-2026-80601}\n- dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}\n- ipv4: free inet_opt and ireq_opt after an RCU grace period {CVE-2026-98432}", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux7els/advisories/2026/clsa-2026_1793377667.json" } ], "tracking": { "current_release_date": "2026-10-30T16:39:22Z", "generator": { "date": "2026-10-30T16:39:22Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1793377667", "initial_release_date": "2026-10-30T16:39:22Z", "revision_history": [ { "date": "2026-10-30T16:39:22Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "kernel-uek: Fix of 206 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Linux 7", "product": { "name": "Oracle Linux 7", "product_id": "Oracle-Linux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Oracle Linux" } ], "category": "vendor", "name": "Oracle Corporation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product": { "name": "perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_id": "perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/perf@5.4.17-2136.361.1.el7uek.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product": { "name": "kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_id": "kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-uek@5.4.17-2136.361.1.el7uek.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product": { "name": "kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_id": "kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-uek-container-debug@5.4.17-2136.361.1.el7uek.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product": { "name": "kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_id": "kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-uek-headers@5.4.17-2136.361.1.el7uek.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product": { "name": "python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_id": "python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/python-perf@5.4.17-2136.361.1.el7uek.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product": { "name": "kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_id": "kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-uek-debug@5.4.17-2136.361.1.el7uek.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product": { "name": "kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_id": "kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-uek-tools@5.4.17-2136.361.1.el7uek.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product": { "name": "kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_id": "kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-uek-debug-devel@5.4.17-2136.361.1.el7uek.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product": { "name": "bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_id": "bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/bpftool@5.4.17-2136.361.1.el7uek.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product": { "name": "kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_id": "kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-uek-devel@5.4.17-2136.361.1.el7uek.tuxcare.els4?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product": { "name": "kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_id": "kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-uek-container@5.4.17-2136.361.1.el7uek.tuxcare.els4?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "product": { "name": "kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "product_id": "kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-uek-headers@5.4.17-2136.361.1.el7uek.tuxcare.els4?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" }, "product_reference": "perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" }, "product_reference": "kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" }, "product_reference": "kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" }, "product_reference": "kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686" }, "product_reference": "kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" }, "product_reference": "python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" }, "product_reference": "kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" }, "product_reference": "kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" }, "product_reference": "kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" }, "product_reference": "bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" }, "product_reference": "kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "relates_to_product_reference": "Oracle-Linux-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64 as a component of Oracle Linux 7", "product_id": "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" }, "product_reference": "kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "relates_to_product_reference": "Oracle-Linux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-97940", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix fib6 walker UAF on seq stop\n\nipv6_route_iter_active() treats a walker in FWS_U at the table root as\nalready unlinked. fib6_del_route() can move a still-linked walker into\nthat same state when the current leaf is the last route at the root,\nso ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq\nprivate object can then be freed while it remains on\nnet->ipv6.fib6_walkers. A later route deletion walks the dangling list\nand uses the freed walker.\n\nUse the list head as membership state and reinitialize it when\nunlinking. Keep the existing w->node check so a never-started iterator\nwith a zeroed private object is not treated as linked.\n\nThe same stop helper is used by /proc/net/ipv6_route and by the BPF\nipv6_route iterator. The BPF show path only widens the race.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97940" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/05b687ee04f816658f4a9cf586f4d2f129157943", "url": "https://git.kernel.org/stable/c/05b687ee04f816658f4a9cf586f4d2f129157943" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0eede1689610e9eeaf729ba86fd1321799eb91a0", "url": "https://git.kernel.org/stable/c/0eede1689610e9eeaf729ba86fd1321799eb91a0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14fdaba201fdff92a3e45994e02bccda409cb19d", "url": "https://git.kernel.org/stable/c/14fdaba201fdff92a3e45994e02bccda409cb19d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/19b4ed644d68098cc62ab612727f40d30f43476c", "url": "https://git.kernel.org/stable/c/19b4ed644d68098cc62ab612727f40d30f43476c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02", "url": "https://git.kernel.org/stable/c/4553cfafa8d05c4ce20b1d18f79d9bb3b303fc02" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/63407cddabc5992b5ac03af165559f4a1968a032", "url": "https://git.kernel.org/stable/c/63407cddabc5992b5ac03af165559f4a1968a032" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9a3f73d62c86271614eda4c43315230896a37018", "url": "https://git.kernel.org/stable/c/9a3f73d62c86271614eda4c43315230896a37018" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b89b691dd00bf39b9ba39ab9446f8c62f419fa7b", "url": "https://git.kernel.org/stable/c/b89b691dd00bf39b9ba39ab9446f8c62f419fa7b" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98846", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: check RCV_SHUTDOWN after the sendmsg connect wait\n\nsctp_wait_for_connect() drops the socket lock while it sleeps. An\nout-of-the-blue ABORT can then be processed from the socket backlog and\nunlink the association. If a concurrent shutdown(fd, SHUT_RD) sets\nRCV_SHUTDOWN, the waiter breaks with err == 0 before checking\nasoc->base.dead. Its final sctp_association_put() can then free the\nassociation, leaving sctp_sendmsg_to_asoc() to continue with a dangling\npointer.\n\nCheck RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc()\nbefore using the association again. The check only accesses the socket,\nso it needs no additional association reference. Return the existing\n-ESRCH so that sctp_sendmsg() skips freeing a new association that may\nalready have been destroyed.\n\nKeep sctp_wait_for_connect() unchanged to preserve its behavior for the\nconnect() caller.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98846" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1bef1944ef15a40797305bf916827b04df6307ca", "url": "https://git.kernel.org/stable/c/1bef1944ef15a40797305bf916827b04df6307ca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/222c41e0f50f1d5028be9baf0e1dcfc0bfa7f669", "url": "https://git.kernel.org/stable/c/222c41e0f50f1d5028be9baf0e1dcfc0bfa7f669" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4f1da630d13de0370e2f6361f961f1c8b384af1c", "url": "https://git.kernel.org/stable/c/4f1da630d13de0370e2f6361f961f1c8b384af1c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e701345d886e831fb593a0870d69c8c5de6fc938", "url": "https://git.kernel.org/stable/c/e701345d886e831fb593a0870d69c8c5de6fc938" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e8f972b1759d26bbefe4c524caae1ed7c8a593bd", "url": "https://git.kernel.org/stable/c/e8f972b1759d26bbefe4c524caae1ed7c8a593bd" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-72299", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: restrict socket queue dumps in enqueue tracepoints\n\ntipc_sk_enqueue() runs with sk->sk_lock.slock held while the socket is\nowned by user context. The spinlock protects the backlog queue in this\npath, but it does not serialize against the socket owner consuming or\npurging sk_receive_queue.\n\nKASAN reported:\n\n CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n Call Trace:\n \n dump_stack_lvl+0x76/0xa0 lib/dump_stack.c:123\n print_report+0xce/0x5b0 mm/kasan/report.c:482\n kasan_report+0xc6/0x100 mm/kasan/report.c:597\n __asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380\n tipc_skb_dump+0x1327/0x16f0 net/tipc/trace.c:73\n tipc_list_dump+0x208/0x2e0 net/tipc/trace.c:187\n tipc_sk_dump+0xaf6/0xd60 net/tipc/socket.c:3996\n trace_event_raw_event_tipc_sk_class+0x312/0x5a0 net/tipc/trace.h:188\n tipc_sk_rcv+0xb1d/0x1d50 net/tipc/socket.c:2497\n tipc_node_xmit+0x1c3/0x1440 net/tipc/node.c:1689\n __tipc_sendmsg+0x97a/0x1440 net/tipc/socket.c:1512\n tipc_sendmsg+0x52/0x80 net/tipc/socket.c:1400\n sock_sendmsg+0x2f6/0x3e0 net/socket.c:825\n splice_to_socket+0x7f9/0x1010 fs/splice.c:884\n do_splice+0xe21/0x2330 fs/splice.c:936\n __do_splice+0x153/0x260 fs/splice.c:1431\n __x64_sys_splice+0x150/0x230 fs/splice.c:1616\n x64_sys_call+0xeb5/0x2790 arch/x86/entry/syscall_64.c:41\n do_syscall_64+0xf3/0x620 arch/x86/entry/syscall_64.c:63\n entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:130\n RIP: 0033:0x71624e8aafe2\n Code: 08 0f 85 71 3a ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66\n RSP: 002b:0000716157ffed68 EFLAGS: 00000246 ORIG_RAX: 0000000000000113\n RAX: ffffffffffffffda RBX: 0000716157fff6c0 RCX: 000071624e8aafe2\n RDX: 000000000000005f RSI: 0000000000000000 RDI: 0000000000000066\n RBP: 0000716157ffed90 R08: 0000000000008000 R09: 0000000000000001\n R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffff00\n R13: 0000000000000021 R14: 0000000000000000 R15: 00007fff89799c40\n \n\nThe TIPC_DUMP_ALL tracepoints in tipc_sk_enqueue() also dump\nsk_receive_queue and can therefore dereference skbs that the socket\nowner has already dequeued or freed. Restrict these dumps to\nTIPC_DUMP_SK_BKLGQ, which matches the queue protected by the held\nspinlock.\n\nKeep the change limited to the enqueue path, where the unsafe queue dump\nis reachable while the socket is owned by user context.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72299" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/12876864f9de5fa6f611a30c6c17e405a773bf0a", "url": "https://git.kernel.org/stable/c/12876864f9de5fa6f611a30c6c17e405a773bf0a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/258fb15b30db4f3941ab335d5e02f744baf1da54", "url": "https://git.kernel.org/stable/c/258fb15b30db4f3941ab335d5e02f744baf1da54" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/273ff83c49b82e4267373adbe629e6ee8aeaa16c", "url": "https://git.kernel.org/stable/c/273ff83c49b82e4267373adbe629e6ee8aeaa16c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/61a55fa24a5d737436018764a647fe5b6cb36371", "url": "https://git.kernel.org/stable/c/61a55fa24a5d737436018764a647fe5b6cb36371" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6acbbe54215d5f4251593000cff2bf51d6748713", "url": "https://git.kernel.org/stable/c/6acbbe54215d5f4251593000cff2bf51d6748713" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/acd7df8d955480a6f6e5bb809da67b1500cc3cf4", "url": "https://git.kernel.org/stable/c/acd7df8d955480a6f6e5bb809da67b1500cc3cf4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae5d0d9ce767b20a5580bb6dc5e06f3e1b8a0fb0", "url": "https://git.kernel.org/stable/c/ae5d0d9ce767b20a5580bb6dc5e06f3e1b8a0fb0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b9e100815f4b55e9ccaf6af9a3aba173eb13d381", "url": "https://git.kernel.org/stable/c/b9e100815f4b55e9ccaf6af9a3aba173eb13d381" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-90435", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix integer overflow of user QP buffer size\n\nset_user_buf_size() computes the QP buffer size by left-shifting the\nuser-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers.\nA sufficiently large rq.wqe_cnt causes signed integer overflow, which\nis undefined behavior, and yields a small or negative buf_size, causing\nib_umem_get() to map a buffer smaller than the hardware will actually\nwrite into.\n\nReplace the shifts and addition with check_shl_overflow() and\ncheck_add_overflow(), rejecting invalid user inputs.\n\nMoreover, guard the identical shift computing qp->sq.offset in\n_create_user_qp() before set_user_buf_size() is reached.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90435" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/42fb8aefffff5b458aaa66803364a16e0ea44129", "url": "https://git.kernel.org/stable/c/42fb8aefffff5b458aaa66803364a16e0ea44129" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5b6cfc6d7ff0959dd9766fdc24286a253b59ca77", "url": "https://git.kernel.org/stable/c/5b6cfc6d7ff0959dd9766fdc24286a253b59ca77" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c845e5e05140ea1bc64a5b1107942d93c876034d", "url": "https://git.kernel.org/stable/c/c845e5e05140ea1bc64a5b1107942d93c876034d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ccce6b7ef1d7efc59ccba3421e1339c6e63a3d20", "url": "https://git.kernel.org/stable/c/ccce6b7ef1d7efc59ccba3421e1339c6e63a3d20" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d7fa2ff72ad1861eac194a4e0075d504ba8c246e", "url": "https://git.kernel.org/stable/c/d7fa2ff72ad1861eac194a4e0075d504ba8c246e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d99622e40aaa910ade681dfd4dc0fa240a011331", "url": "https://git.kernel.org/stable/c/d99622e40aaa910ade681dfd4dc0fa240a011331" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dec47e4b0fe34afdf38caa72b4408ba95502e5de", "url": "https://git.kernel.org/stable/c/dec47e4b0fe34afdf38caa72b4408ba95502e5de" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f917707f0de0832b8ab582391b1f64e549995c6c", "url": "https://git.kernel.org/stable/c/f917707f0de0832b8ab582391b1f64e549995c6c" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89607", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\necryptfs: reject oversized encrypted_key_size in parse_tag_3_packet\n\nparse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body\nwithout bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When\nencrypted_key_size > 64, decrypt_passphrase_encrypted_session_key()\nsets decrypted_key_size = encrypted_key_size and performs two\nout-of-bounds writes:\n\n1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into\n decrypted_key[64] via scatterlist, overflowing into the parent\n ecryptfs_auth_tok struct.\n2. memcpy(crypt_stat->key, decrypted_key, decrypted_key_size) writes\n into crypt_stat->key[64], corrupting root_iv, keysig_list, and\n mutexes in ecryptfs_crypt_stat.\n\nOnly AES-192 (cipher code 0x08) enables this because it sets\ncrypt_stat->key_size = 24 independently of encrypted_key_size,\nallowing crypto_skcipher_setkey() to succeed while encrypted_key_size\nexceeds ECRYPTFS_MAX_KEY_BYTES.\n\nThe PKI decryption path (parse_tag_65_packet) already validates\ndecrypted_key_size <= ECRYPTFS_MAX_KEY_BYTES; the passphrase path\nomits this check.\n\nBound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather\nthan ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also\nprotects the 512-byte encrypted_key[] buffer, so the former 512-byte\ncheck is removed as redundant.\n\n[tyhicks: Adjust the code comment to refer to macros representing the\n buffer sizes rather than mentioning the buffer size values since they\n may change in the future]", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89607" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14cb36a500a5a3afbc955dbf69dabc565f1a3b26", "url": "https://git.kernel.org/stable/c/14cb36a500a5a3afbc955dbf69dabc565f1a3b26" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2cd21340163494d312836c77c9fbfe2530b3d075", "url": "https://git.kernel.org/stable/c/2cd21340163494d312836c77c9fbfe2530b3d075" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/33e050cac841498b5175f0f385eee903fd98863c", "url": "https://git.kernel.org/stable/c/33e050cac841498b5175f0f385eee903fd98863c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5babe9c177c364521e3e682b949c5a8c47f4a441", "url": "https://git.kernel.org/stable/c/5babe9c177c364521e3e682b949c5a8c47f4a441" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a419c9ebfc9a40ee56aaad6dc68bfd67d400817b", "url": "https://git.kernel.org/stable/c/a419c9ebfc9a40ee56aaad6dc68bfd67d400817b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ccd13eff0e7356d2aa28b127b577e4e5ad4563f5", "url": "https://git.kernel.org/stable/c/ccd13eff0e7356d2aa28b127b577e4e5ad4563f5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d2802414081184f79a619ede178aeef3aa989793", "url": "https://git.kernel.org/stable/c/d2802414081184f79a619ede178aeef3aa989793" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e2152d491ae62d96a32ed59778680a242af1fbc6", "url": "https://git.kernel.org/stable/c/e2152d491ae62d96a32ed59778680a242af1fbc6" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74583", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_route: fix fastmap use-after-free on filter\n\nThe route4 classifier maintains a 16-slot fastmap cache that stores raw\nstruct route4_filter pointers indexed by (id, iif). The reader\n(route4_classify) populates this cache via route4_set_fastmap() for every\nclassified packet that hits a filter. The writer (route4_delete,\nroute4_change) clears the cache via route4_reset_fastmap() before\nRCU-deferred kfree of the filter.\n\nThis creates a UAF race:\n 1. Reader walks the RCU-protected bucket chain, finds filter f\n 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()\n 3. Reader calls route4_set_fastmap() and writes f into the cache\n *after* the writer's reset, caching a pointer about to be freed\n 4. After the RCU grace period, kfree(f) executes\n 5. Next classified packet on the same (id, iif) tuple hits the stale\n fastmap entry and reads f->res from freed memory\n\nReproduced with an mdelay(100) accelerator in route4_set_fastmap() and a\nconcurrent add/delete stress test (provided by both zdi and Santosh).\nBoth triggered KASAN slab-use-after-free reports in the route4 fastmap\npaths.\n\nFix:\nIntroduce a per-filter boolean dying flag to suppress stale fastmap\nrepublishing by in-flight readers.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74583" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc", "url": "https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df", "url": "https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f", "url": "https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f", "url": "https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139", "url": "https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1", "url": "https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d", "url": "https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2", "url": "https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2" } ], "release_date": "2026-08-21T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89973", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: check the data direction of a C2HData PDU\n\nnvme_tcp_handle_c2h_data() finds the request by command id and checks\nthat it has a payload, but it does not check that the command asked for\ndata to be read. A controller that answers a write command with C2HData\ntherefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits\nWARN_ON_ONCE(i->data_source) and returns 0. The receive path turns that\ninto -EFAULT and resets the controller.\n\nNo data is copied, so this is not memory corruption. What a controller\ngets is a kernel warning it can raise at will, which is fatal on a host\nbooted with panic_on_warn.\n\nThe send path already knows the direction - it consults rq_data_dir()\nwhen it builds a command - and nvme_tcp_handle_r2t() checks the length\nand the offset of the request it names. The C2HData path does not check\nthe direction at all.\n\nReject a C2HData PDU whose command is not a read. Rejecting it fails\nthe command and resets the controller, as the neighbouring check in this\nfunction does; what goes away is the warning.\n\n [ 6.885580] ------------[ cut here ]------------\n [ 6.886457] WARNING: lib/iov_iter.c:193 at _copy_to_iter+0x289/0x1330, CPU#0: kworker/0:1H/71\n [ 6.888137] CPU: 0 UID: 0 PID: 71 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy)\n [ 6.891165] Workqueue: nvme_tcp_wq nvme_tcp_io_work\n [ 6.891875] RIP: 0010:_copy_to_iter+0x289/0x1330\n [ 6.903739] Call Trace:\n [ 6.904085] \n [ 6.909254] __skb_datagram_iter+0x433/0x820\n [ 6.911026] skb_copy_datagram_iter+0x37/0x120\n [ 6.911622] nvme_tcp_recv_skb+0xa07/0x4320\n [ 6.913378] __tcp_read_sock+0x1ab/0x810\n [ 6.915788] nvme_tcp_try_recv+0x152/0x1e0\n [ 6.918222] nvme_tcp_io_work+0x1e4/0x6c0\n [ 6.926906] \n [ 6.927226] ---[ end trace 0000000000000000 ]---\n [ 6.927878] nvme nvme0: queue 1 failed to copy request 0x71 data\n [ 6.928709] nvme nvme0: receive failed: -14", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89973" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0673a2affe45ca76b60de31a83c67b1e60f81bde", "url": "https://git.kernel.org/stable/c/0673a2affe45ca76b60de31a83c67b1e60f81bde" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5b115d932f6e769ac80783fb18edd21b0aed256e", "url": "https://git.kernel.org/stable/c/5b115d932f6e769ac80783fb18edd21b0aed256e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/80d56202fbdff8906be6954b2776e5c14a4026f2", "url": "https://git.kernel.org/stable/c/80d56202fbdff8906be6954b2776e5c14a4026f2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/980d990f3c0560d7dfbfbf14699651fdf02f26ee", "url": "https://git.kernel.org/stable/c/980d990f3c0560d7dfbfbf14699651fdf02f26ee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a0c389b8a495bda1eb719d2503853c924b7a8355", "url": "https://git.kernel.org/stable/c/a0c389b8a495bda1eb719d2503853c924b7a8355" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4af7999a998787d5eb6facb5a333e04a4f1d2d9", "url": "https://git.kernel.org/stable/c/b4af7999a998787d5eb6facb5a333e04a4f1d2d9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/df74950ba6008655d4a977d17df7faf4b6e52b74", "url": "https://git.kernel.org/stable/c/df74950ba6008655d4a977d17df7faf4b6e52b74" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f83af377c148f6ad94b41c0e8313f12adf45e1c1", "url": "https://git.kernel.org/stable/c/f83af377c148f6ad94b41c0e8313f12adf45e1c1" } ], "release_date": "2026-09-16T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2023-53432", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: net: fix use after free in fwnet_finish_incoming_packet()\n\nThe netif_rx() function frees the skb so we can't dereference it to\nsave the skb->len.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53432" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2ea70379e4f4efa95c9daa7f3f9bdd4d40aec927", "url": "https://git.kernel.org/stable/c/2ea70379e4f4efa95c9daa7f3f9bdd4d40aec927" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3ff256751a2853e1ffaa36958ff933ccc98c6cb5", "url": "https://git.kernel.org/stable/c/3ff256751a2853e1ffaa36958ff933ccc98c6cb5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9040adc38cf6bfbb77034d558ac2c52f70d840ac", "url": "https://git.kernel.org/stable/c/9040adc38cf6bfbb77034d558ac2c52f70d840ac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9860921ab4521252dc39bb21b9c936bd09a00982", "url": "https://git.kernel.org/stable/c/9860921ab4521252dc39bb21b9c936bd09a00982" } ], "release_date": "2025-09-18T16:04:12Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53264", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_api: use RCU with deferred freeing for action lifecycle\n\nWhen NEWTFILTER and DELFILTER are run concurrently it is possible to create a\nrace with an associated action.\n\nLet's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:\n\n 0: mutex_lock() <-- holds the idr lock\n 0: rcu_read_lock()\n 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR)\n 0: mutex_unlock() <-- releases the idr lock\n 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held\n 1: idr_remove(idr, index) <-- Action removed from IDR\n 1: mutex_unlock() <-- mutex released allowing us to delete the action\n 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral\n 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory\n\nThis patch fixes the race condition between NEWTFILTER and DELFILTER by\nadding struct rcu_head to tc_action used in the deferral and introducing a\ncall_rcu() in the delete path to defer the final kfree().\n\nNote: this is a revert of commit d7fb60b9cafb (\"net_sched: get rid of tcfa_rcu\")\nbut also modernization/simplification to directly use kfree_rcu().\n\nLet's illustrate the new restored code path:\n\n 0: rcu_read_lock()\n 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held\n 1: idr_remove(idr, index)\n 1: mutex_unlock()\n 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period\n 0: p = idr_find(idr, index)\n 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0\n 1: rcu_read_unlock() <-- release so freeing can run after grace period\n\nAfter CPU1 calls idr_remove(), the object is no longer reachable through the IDR.\nCPU0's subsequent idr_find() will return NULL, and even if it still held a\nstale pointer, the immediate kfree() is now deferred until after the RCU grace\nperiod, so no UAF can occur.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53264" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835", "url": "https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2", "url": "https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305", "url": "https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113", "url": "https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009", "url": "https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7", "url": "https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3", "url": "https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5", "url": "https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" }, { "category": "external", "summary": "https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/", "url": "https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/" } ], "release_date": "2026-06-25T09:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-68236", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: set new_stream to NULL after release\n\nIn dm_update_crtc_state(), the skip_modeset path releases new_stream\nvia dc_stream_release() but does not set the pointer to NULL.\n\nIf a later error (e.g., color management failure) triggers the fail\nlabel, the error path calls dc_stream_release() again on the same\ndangling pointer, causing a double release and potential use-after-free.\n\nFix this by setting new_stream to NULL after the initial release.\n\n(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68236" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/01ba5b36898d6258f584269537cc49e7b05cf7c6", "url": "https://git.kernel.org/stable/c/01ba5b36898d6258f584269537cc49e7b05cf7c6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0676fecbb5242aa22c057e78326d6d6041db034c", "url": "https://git.kernel.org/stable/c/0676fecbb5242aa22c057e78326d6d6041db034c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5182e442e61397d446c36995b8f5676942d35b82", "url": "https://git.kernel.org/stable/c/5182e442e61397d446c36995b8f5676942d35b82" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/679f23f0a3606afcef1ffabd72222f00a54ad9e3", "url": "https://git.kernel.org/stable/c/679f23f0a3606afcef1ffabd72222f00a54ad9e3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/92b7c6e3a1546c6db868b07e93fa6fb950d1d3a0", "url": "https://git.kernel.org/stable/c/92b7c6e3a1546c6db868b07e93fa6fb950d1d3a0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9fa26b9eed6195bf840f39ac183b9a6237548755", "url": "https://git.kernel.org/stable/c/9fa26b9eed6195bf840f39ac183b9a6237548755" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76", "url": "https://git.kernel.org/stable/c/ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bf9c06c70f496f1ba4474caf95c69696c828340e", "url": "https://git.kernel.org/stable/c/bf9c06c70f496f1ba4474caf95c69696c828340e" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-52993", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix double-free in tipc_buf_append()\n\ntipc_msg_validate() can potentially reallocate the skb it is validating,\nfreeing the old one. In tipc_buf_append(), it was being called with a\npointer to a local variable which was a copy of the caller's skb\npointer.\n\nIf the skb was reallocated and validation subsequently failed, the error\nhandling path would free the original skb pointer, which had already\nbeen freed, leading to double-free.\n\nFix this by checking if head now points to a newly allocated reassembled\nskb. If it does, reassign *headbuf for later freeing operations.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-52993" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0274f24485fc38032d4093e463dc3ff5c7a667c9", "url": "https://git.kernel.org/stable/c/0274f24485fc38032d4093e463dc3ff5c7a667c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1d5e589055880fae229e229e1929e087dbe08cf3", "url": "https://git.kernel.org/stable/c/1d5e589055880fae229e229e1929e087dbe08cf3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/29940fff14110ca48c5ccc168d121665b51bb778", "url": "https://git.kernel.org/stable/c/29940fff14110ca48c5ccc168d121665b51bb778" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4d104882bc815d4ec666ace9155f5f52715879a6", "url": "https://git.kernel.org/stable/c/4d104882bc815d4ec666ace9155f5f52715879a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4ee4deadaae7cb2e3d53af0fc889cf92a73413c0", "url": "https://git.kernel.org/stable/c/4ee4deadaae7cb2e3d53af0fc889cf92a73413c0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a438975a6dcdbd70865978c021650d1485586f0b", "url": "https://git.kernel.org/stable/c/a438975a6dcdbd70865978c021650d1485586f0b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a", "url": "https://git.kernel.org/stable/c/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d3556656c6daebf8def751c7e71d11dd0a180d24", "url": "https://git.kernel.org/stable/c/d3556656c6daebf8def751c7e71d11dd0a180d24" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:45115", "url": "https://access.redhat.com/errata/RHSA-2026:45115" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:45116", "url": "https://access.redhat.com/errata/RHSA-2026:45116" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47017", "url": "https://access.redhat.com/errata/RHSA-2026:47017" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49212", "url": "https://access.redhat.com/errata/RHSA-2026:49212" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-52993", "url": "https://access.redhat.com/security/cve/CVE-2026-52993" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2492437", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492437" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52993.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52993.json" } ], "release_date": "2026-06-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68188", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix session UAF in set_termios\n\nrfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and\nlater passes the pointer to rfcomm_send_rpn(). The latter dereferences\nboth session->initiator and session->sock. Meanwhile, krfcommd can\nunlink the DLC and free the session while holding rfcomm_mutex.\n\nThe race can proceed as follows:\n\n TTY ioctl task krfcommd\n -------------- --------\n load dlc->session\n enter rfcomm_send_rpn()\n lock rfcomm_mutex\n clear dlc->session\n free session\n unlock rfcomm_mutex\n read session->initiator\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in rfcomm_send_rpn+0x297/0x2a0\n Read of size 4 at addr ffff88810012a850 by task poc/92\n\n Call Trace:\n rfcomm_send_rpn+0x297/0x2a0\n rfcomm_tty_set_termios+0x50d/0x850\n tty_set_termios+0x596/0x950\n set_termios+0x46a/0x6e0\n tty_mode_ioctl+0x152/0xbd0\n tty_ioctl+0x915/0x1240\n __x64_sys_ioctl+0x134/0x1c0\n\n Allocated by task 92:\n rfcomm_session_add+0x9e/0x2e0\n rfcomm_dlc_open+0x8b1/0xe00\n rfcomm_dev_activate+0x85/0x1a0\n rfcomm_tty_open+0x90/0x280\n\n Freed by task 68:\n kfree+0x131/0x3c0\n rfcomm_session_del+0x119/0x180\n rfcomm_run+0x737/0x4710\n\nAdd rfcomm_dlc_send_rpn(), which holds rfcomm_mutex while it verifies\nthat the DLC is still attached and sends the RPN frame. Have the TTY\npath use the helper and drop its unlocked session check. This keeps the\nsession valid through both the frame construction and socket send.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68188" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2894bd8c68e97accd758ca6e5fc375d7e9e8882c", "url": "https://git.kernel.org/stable/c/2894bd8c68e97accd758ca6e5fc375d7e9e8882c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4eac4576a072084b06459de6c054b4ebc764b4ea", "url": "https://git.kernel.org/stable/c/4eac4576a072084b06459de6c054b4ebc764b4ea" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/780b04d09c941262ee2a2b4a09906451b69df8a6", "url": "https://git.kernel.org/stable/c/780b04d09c941262ee2a2b4a09906451b69df8a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/82c383f9031f1ce919ac6c3c06bc5bd492a6b078", "url": "https://git.kernel.org/stable/c/82c383f9031f1ce919ac6c3c06bc5bd492a6b078" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/98bc68194e37bfa5e8ddc80b5c1eb0be4dc607ea", "url": "https://git.kernel.org/stable/c/98bc68194e37bfa5e8ddc80b5c1eb0be4dc607ea" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a82a9d3891f5607030b0672c255087a12bb9837b", "url": "https://git.kernel.org/stable/c/a82a9d3891f5607030b0672c255087a12bb9837b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c5c060597247131f90f39ea7c8c978fa0c2e79d0", "url": "https://git.kernel.org/stable/c/c5c060597247131f90f39ea7c8c978fa0c2e79d0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c783399efc22d035443f1dfbf2a09bf9562aaa5e", "url": "https://git.kernel.org/stable/c/c783399efc22d035443f1dfbf2a09bf9562aaa5e" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98515", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix double-free in nvif_vmm_dtor\n\nOn failure, nouveau_cli_init() calls nouveau_cli_fini() to tear\nthe client down. Then, nouveau_drm_open() also enters into its\ncleanup path and calls nouveau_cli_fini() AGAIN. nouveau_cli_fini()\ncalls nouveau_vmm_fini():\n\n\tvoid\n\tnouveau_vmm_fini(struct nouveau_vmm *vmm)\n\t{\n\t\tnouveau_svmm_fini(&vmm->svmm);\n\t\tnvif_vmm_dtor(&vmm->vmm);\n\t\tvmm->cli = NULL;\n\t}\n\nInside nvif_vmm_dtor(), vmm->page is freed unconditionally:\n\n\tvoid\n\tnvif_vmm_dtor(struct nvif_vmm *vmm)\n\t{\n\t\tkfree(vmm->page);\n\t\tnvif_object_dtor(&vmm->object);\n\t}\n\nvmm->page is never cleared after being freed, so the second call of\nnvif_vmm_dtor() will cause a double-free.\n\nFound by fuzzing the nouveau driver with a modified Syzkaller:\n\n\tBUG: KASAN: double-free in nvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194\n\tFree of addr ffff888010fcdc30 by task syz.0.173/2567\n\n\tCPU: 1 UID: 0 PID: 2567 Comm: syz.0.173 Not tainted 7.2.0 #24 PREEMPT(lazy)\n\tHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n\tCall Trace:\n\t\n\t__dump_stack lib/dump_stack.c:94 [inline]\n\tdump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120\n\tprint_address_description mm/kasan/report.c:378 [inline]\n\tprint_report+0xcb/0x5a0 mm/kasan/report.c:482\n\tkasan_report_invalid_free+0xaa/0xd0 mm/kasan/report.c:557\n\tcheck_slab_allocation+0xe4/0x110 mm/kasan/common.c:235\n\tkasan_slab_pre_free include/linux/kasan.h:199 [inline]\n\tslab_free_hook mm/slub.c:2622 [inline]\n\tslab_free mm/slub.c:6377 [inline]\n\tkfree+0x192/0x590 mm/slub.c:6692\n\tnvif_vmm_dtor+0x31/0x50 drivers/gpu/drm/nouveau/nvif/vmm.c:194\n\tnouveau_vmm_fini+0x16/0x50 drivers/gpu/drm/nouveau/nouveau_vmm.c:127\n\tnouveau_cli_fini+0x10e/0x210 drivers/gpu/drm/nouveau/nouveau_drm.c:225\n\tnouveau_drm_open+0x24e/0x740 drivers/gpu/drm/nouveau/nouveau_drm.c:1255\n\tdrm_file_alloc+0x5f2/0xad0 drivers/gpu/drm/drm_file.c:176\n\tdrm_open_helper+0x1d7/0x4a0 drivers/gpu/drm/drm_file.c:335\n\tdrm_open+0x190/0x3d0 drivers/gpu/drm/drm_file.c:388\n\tdrm_stub_open+0x1f2/0x460 drivers/gpu/drm/drm_drv.c:1211\n\tchrdev_open+0x21c/0x660 fs/char_dev.c:411\n\tdo_dentry_open+0x59d/0x12b0 fs/open.c:947\n\tvfs_open+0x82/0x390 fs/open.c:1052\n\tdo_open fs/namei.c:4700 [inline]\n\tpath_openat+0x2345/0x3420 fs/namei.c:4863\n\tdo_file_open+0x207/0x460 fs/namei.c:4892\n\tdo_sys_openat2+0xd1/0x1d0 fs/open.c:1368\n\tdo_sys_open fs/open.c:1374 [inline]\n\t__do_sys_openat fs/open.c:1390 [inline]\n\t__se_sys_openat fs/open.c:1385 [inline]\n\t__x64_sys_openat+0x144/0x200 fs/open.c:1385\n\tdo_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n\tdo_syscall_64+0x115/0x690 arch/x86/entry/syscall_64.c:94\n\tentry_SYSCALL_64_after_hwframe+0x77/0x7f\n\tRIP: 0033:0x7fc6d687594d\n\tCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\n\tRSP: 002b:00007fc6d5295008 EFLAGS: 00000246 ORIG_RAX: 0000000000000101\n\tRAX: ffffffffffffffda RBX: 00007fc6d6b06180 RCX: 00007fc6d687594d\n\tRDX: 0000000000022501 RSI: 0000200000000000 RDI: ffffffffffffff9c\n\tRBP: 00007fc6d691c303 R08: 0000000000000000 R09: 0000000000000000\n\tR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n\tR13: 00007fc6d6b06218 R14: 00007fc6d6b06180 R15: 00007ffd9451d760\n\t\n\n\tAllocated by task 2567 on cpu 1 at 163.593900s:\n\tkasan_save_stack+0x24/0x50 mm/kasan/common.c:57\n\tkasan_save_track+0x17/0x60 mm/kasan/common.c:78\n\tpoison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n\t__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415\n\tkasan_kmalloc include/linux/kasan.h:263 [inline]\n\t__do_kmalloc_node mm/slub.c:5334 [inline]\n\t__kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359\n\t_kmalloc_noprof include/linux/slab.h:992 [inline]\n\tnvif_vmm_ctor+0x3c0/0x7e0 drivers/gpu/drm/nouveau/nvif/vmm.c:237\n\tnouveau_vmm_init+0x40/0x90 drivers/gpu/drm/nouveau/nouveau_vmm.c:134\n\tnouveau_cli_init+0x7b9/0\n---truncated---", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98515" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/023e7a01f8fb27799f0987b5bcda325d73a2904c", "url": "https://git.kernel.org/stable/c/023e7a01f8fb27799f0987b5bcda325d73a2904c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/109a8d2d5b7d2719ebe09df3f9241023900b3846", "url": "https://git.kernel.org/stable/c/109a8d2d5b7d2719ebe09df3f9241023900b3846" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/279e5ac137370e274a09dd552547ae6bddd0d4d5", "url": "https://git.kernel.org/stable/c/279e5ac137370e274a09dd552547ae6bddd0d4d5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/375901ac0f286e81be00a4126e57d488cb401884", "url": "https://git.kernel.org/stable/c/375901ac0f286e81be00a4126e57d488cb401884" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/872a5473c02a26c955be44d52b7ab2f8ea70a2cf", "url": "https://git.kernel.org/stable/c/872a5473c02a26c955be44d52b7ab2f8ea70a2cf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/97077ac87afe9e91ec074ef0be64454e7ccbf344", "url": "https://git.kernel.org/stable/c/97077ac87afe9e91ec074ef0be64454e7ccbf344" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bf542ecd4f60d4689818d194e7ca74772fe0f8b5", "url": "https://git.kernel.org/stable/c/bf542ecd4f60d4689818d194e7ca74772fe0f8b5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f09f4a536935b15539f2de9fe775a2641202be90", "url": "https://git.kernel.org/stable/c/f09f4a536935b15539f2de9fe775a2641202be90" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-64007", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: refresh tcphdr after skb_ensure_writable\n\nsynproxy_tstamp_adjust() rewrites the TCP timestamp option in place\nand then patches the TCP checksum via inet_proto_csum_replace4() on\nthe caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()\nbefore calling in, so it may either alias skb->head directly or\npoint at the caller's on-stack _tcph buffer.\n\nBetween obtaining the pointer and using it, the function calls\nskb_ensure_writable(skb, optend), which on a cloned or non-linear\nskb invokes pskb_expand_head() and frees the old skb->head. After\nthat point the cached th is stale:\n\n caller (ipv[46]_synproxy_hook)\n th = skb_header_pointer(skb, ..., &_tcph)\n synproxy_tstamp_adjust(skb, protoff, th, ...)\n skb_ensure_writable(skb, optend)\n pskb_expand_head() /* kfree(old skb->head) */\n ...\n inet_proto_csum_replace4(&th->check, ...)\n /* writes into freed head, or\n into the caller's stack copy\n leaving the on-wire checksum\n stale */\n\nThe option bytes are written through skb->data and are fine; only\nthe checksum update goes through th and so lands in the wrong\nplace. The result is either a write into freed slab memory or a\npacket leaving with a checksum that does not match its payload.\n\nFix by re-deriving th from skb->data + protoff immediately after\nskb_ensure_writable() succeeds, so the subsequent checksum update\ntargets the linear, writable header.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64007" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1", "url": "https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c", "url": "https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e", "url": "https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7", "url": "https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96", "url": "https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04", "url": "https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc", "url": "https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf", "url": "https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf" } ], "release_date": "2026-07-19T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98836", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: reject oversized playback packets\n\nEach playback URB is handed a slice of out.buffer that is exactly\nLINE6_ISO_PACKETS * max_packet_size_out bytes, sized from the OUT\nendpoint, but the number of bytes written into that slice is never\ncompared against it.\n\nsubmit_audio_out_urb() takes the frame count from prev_fsize, which\naudio_in_callback() derived from the *IN* endpoint's received packet\nlength, and rescales it with the playback frame size; when prev_fsize is\nstill zero it synthesizes a length from the sample rate instead. On a\ndevice declaring a large IN wMaxPacketSize and a small OUT\nwMaxPacketSize, the resulting memcpy(), or the memset() when the\nplayback stream is idle, runs past its slice and, as the reproducer\nbelow shows, beyond the allocation.\n\nusb_submit_urb() is not a backstop. max_packet_size_out comes from\nusb_maxpacket(), which returns only the low 11 bits of wMaxPacketSize,\nwhile USB core validates a high-speed isochronous length against that\nbase scaled by usb_endpoint_maxp_mult(). A length of up to three times\nthe allocated slice is therefore accepted, and even a rejected URB is\nonly rejected after the write.\n\nReject a packet that does not fit the slice the driver allocated for it.\nClamping it instead would silently shorten the capture-derived rate\nfeedback and desynchronize the two streams.\n\n BUG: KASAN: slab-out-of-bounds in submit_audio_out_urb (sound/usb/line6/playback.c:229)\n Write of size 1024 at addr ffff888100bbd400 by task kworker/1:2/5002\n Workqueue: events line6_startup_work\n Call Trace:\n __asan_memcpy (mm/kasan/shadow.c:106)\n submit_audio_out_urb (sound/usb/line6/playback.c:229)\n line6_submit_audio_out_all_urbs (sound/usb/line6/playback.c:291)\n line6_stream_start (sound/usb/line6/pcm.c:194)\n line6_pcm_acquire (sound/usb/line6/pcm.c:337)\n line6_startup_work (sound/usb/line6/driver.c:728)\n process_one_work (kernel/workqueue.c:3396)\n worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\n The buggy address belongs to the object at ffff888100bbd400\n which belongs to the cache kmalloc-256 of size 256\n The buggy address is located 0 bytes inside of\n allocated 256-byte region [ffff888100bbd400, ffff888100bbd500)", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98836" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f75da1e4ee699f6650d23d6897cf443b01856c7", "url": "https://git.kernel.org/stable/c/3f75da1e4ee699f6650d23d6897cf443b01856c7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/61b0a5a114fa4552892da5c0ff2f42e63bf08c6b", "url": "https://git.kernel.org/stable/c/61b0a5a114fa4552892da5c0ff2f42e63bf08c6b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/933d8ac23388eb208ea195231d682dce0bec86ca", "url": "https://git.kernel.org/stable/c/933d8ac23388eb208ea195231d682dce0bec86ca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a84371be89c39ccc46c7af8b9eb15c448df9265f", "url": "https://git.kernel.org/stable/c/a84371be89c39ccc46c7af8b9eb15c448df9265f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b78748424f29f07d310484b2b36afdececa74389", "url": "https://git.kernel.org/stable/c/b78748424f29f07d310484b2b36afdececa74389" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-80558", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Avoid using invalid osd indices from primary_temp\n\nA corrupted osdmap received from a Ceph monitor or OSD may contain osd\nindices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts\nthat don't exist, i.e., that are greater than max_osd or smaller than\nCEPH_HOMELESS_OSD (-1). These indices are used to create the up and\nacting set in ceph_pg_to_up_acting_osds(), called from calc_target().\nWhile most of these osd indices are checked, the one from primary_temp\nis not. Subsequently, this may lead to calc_target() returning this\n(potentially invalid) index as target osd for a (linger) request.\nBecause the osd_state, osd_weight, and osd_addr arrays only contain\nmax_osd entries (with indices 0 to max_osd -1), this leads to\nout-of-bounds accesses when trying to read values from these arrays.\n\nThis patch fixes the issue by adding a check to get_temp_osds(), so that\nonly valid osd indices from primary_temp are used, and it falls back to\nusing the primary from pg_temp or the up set if it is invalid.\n\n[ idryomov: changelog ]", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80558" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1c705fe8e59c6b16f48964973fb23c8ec4735b73", "url": "https://git.kernel.org/stable/c/1c705fe8e59c6b16f48964973fb23c8ec4735b73" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3660b98d1204b419f6a77e9a295f148dcf38d042", "url": "https://git.kernel.org/stable/c/3660b98d1204b419f6a77e9a295f148dcf38d042" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4f392fec075562dc93bb0c69f37423ca2af9b48f", "url": "https://git.kernel.org/stable/c/4f392fec075562dc93bb0c69f37423ca2af9b48f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/505fc50b8ff8e687b7e3ef6866269dea27366224", "url": "https://git.kernel.org/stable/c/505fc50b8ff8e687b7e3ef6866269dea27366224" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6799d4a916ffcb3d450d8440f9fe0f0862f768d6", "url": "https://git.kernel.org/stable/c/6799d4a916ffcb3d450d8440f9fe0f0862f768d6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dfe1877d351b99eb1b1a62a3fc2d174220e88e20", "url": "https://git.kernel.org/stable/c/dfe1877d351b99eb1b1a62a3fc2d174220e88e20" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e009c5f0ad634c62f5c48a41f1f3c019ecf52555", "url": "https://git.kernel.org/stable/c/e009c5f0ad634c62f5c48a41f1f3c019ecf52555" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e2ffeec85201b2bb748e99e12539ee1b92f62796", "url": "https://git.kernel.org/stable/c/e2ffeec85201b2bb748e99e12539ee1b92f62796" } ], "release_date": "2026-08-26T15:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68289", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()\n\nIn tipc_recvmsg(), the copy length is computed as:\n\n copy = min_t(int, dlen - offset, buflen);\n\nbuflen is size_t but min_t(int, ...) casts it to int. When buflen\nexceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it\nwraps negative, wins the comparison, and the negative copy length\npropagates to simple_copy_to_iter() where int-to-size_t promotion\nmakes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the\nsame pattern.\n\n Kernel panic - not syncing: kernel: panic_on_warn set ...\n RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521)\n Call Trace:\n __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402)\n skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534)\n tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934)\n io_recvmsg+0x47e/0xda0\n\nFix by changing min_t(int, ...) to min_t(size_t, ...) in both\nfunctions. The result is always <= (dlen - offset), which is bounded\nby TIPC maximum message size (0x1ffff bytes), so the implicit\nnarrowing on assignment to int copy is always safe.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68289" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1b6066313b9b8fac870483bf7a26d6bd56579747", "url": "https://git.kernel.org/stable/c/1b6066313b9b8fac870483bf7a26d6bd56579747" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/47f42ff521b4eeb46e82f9a46a4783a99f7570d7", "url": "https://git.kernel.org/stable/c/47f42ff521b4eeb46e82f9a46a4783a99f7570d7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7364014fdc289225229eb08de8bcbf4580e78e4d", "url": "https://git.kernel.org/stable/c/7364014fdc289225229eb08de8bcbf4580e78e4d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/93580911f02d1f4a506ec0a6fc4354140c53ffe8", "url": "https://git.kernel.org/stable/c/93580911f02d1f4a506ec0a6fc4354140c53ffe8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9fd4f92671146b068809b6c34b50346cb30cf8f7", "url": "https://git.kernel.org/stable/c/9fd4f92671146b068809b6c34b50346cb30cf8f7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fe9bf32bb18f2d35789d4960fb007d1059bbaa38", "url": "https://git.kernel.org/stable/c/fe9bf32bb18f2d35789d4960fb007d1059bbaa38" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-43049", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure\n\nPresently, if the force feedback initialisation fails when probing the\nLogitech G920 Driving Force Racing Wheel for Xbox One, an error number\nwill be returned and propagated before the userspace infrastructure\n(sysfs and /dev/input) has been torn down. If userspace ignores the\nerrors and continues to use its references to these dangling entities, a\nUAF will promptly follow.\n\nWe have 2 options; continue to return the error, but ensure that all of\nthe infrastructure is torn down accordingly or continue to treat this\ncondition as a warning by emitting the message but returning success.\nIt is thought that the original author's intention was to emit the\nwarning but keep the device functional, less the force feedback feature,\nso let's go with that.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-43049" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/772f99cc8d6e5d95613bce93c9624e154c1abe88", "url": "https://git.kernel.org/stable/c/772f99cc8d6e5d95613bce93c9624e154c1abe88" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9a793ac19eb84f44ed759c0fce80cf29bc2a2453", "url": "https://git.kernel.org/stable/c/9a793ac19eb84f44ed759c0fce80cf29bc2a2453" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b846fb0a73e99174f08238e083e284c0463a2102", "url": "https://git.kernel.org/stable/c/b846fb0a73e99174f08238e083e284c0463a2102" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/df966f0def87550bd81d0892cdff992202de2712", "url": "https://git.kernel.org/stable/c/df966f0def87550bd81d0892cdff992202de2712" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f7a4c78bfeb320299c1b641500fe7761eadbd101", "url": "https://git.kernel.org/stable/c/f7a4c78bfeb320299c1b641500fe7761eadbd101" } ], "release_date": "2026-05-01T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-74359", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs_lookup(): don't leave ->s_dentry dangling on failure\n\nNormally ->s_dentry is cleared when dentry it's pointing to becomes\nnegative (on eviction, realistically). However, that only happens\nif dentry gets to be positive in the first place; in case of inode\nallocation failure dentry never becomes positive, so ->d_iput()\nis not called at all.\n\nWe do part of what normally would've been done by configfs_d_iput()\n(dropping the reference to configfs_dirent) manually, but we do\nnot clear ->s_dentry there. Sloppy as it is, it does not matter in\ncase of configfs_create_{dir,link}() - there configfs_dirent does\nnot survive dropping the sole reference to it.\n\nHowever, for configfs_lookup() it *does* survive, with a dangling\npointer to soon to be freed dentry sitting it its ->s_dentry.\n\nSubsequent getdents(2) in that directory will end up dereferencing\nthat pointer in order to pick the inode number. Use after free...\n\nThis is the minimal fix; the right approach is to set the linkage\nbetween dentry and configfs_dirent only after we know that we have\nan inode, but that takes more surgery and the bug had been there\nsince 2006, so...", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74359" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/10da12d352b7b2bb330a8609fdda9a58bf0e9856", "url": "https://git.kernel.org/stable/c/10da12d352b7b2bb330a8609fdda9a58bf0e9856" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3e83b2203aa59bd279e4f677ec793d49dc9d019e", "url": "https://git.kernel.org/stable/c/3e83b2203aa59bd279e4f677ec793d49dc9d019e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/57088b06109f3222963c639d8d743f42c2899b13", "url": "https://git.kernel.org/stable/c/57088b06109f3222963c639d8d743f42c2899b13" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9c747dcee164ead300de90550ad9e4122f0d1bbb", "url": "https://git.kernel.org/stable/c/9c747dcee164ead300de90550ad9e4122f0d1bbb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b6e9c82522ddaa3ac0706b295ff4a71975d4f883", "url": "https://git.kernel.org/stable/c/b6e9c82522ddaa3ac0706b295ff4a71975d4f883" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c3b073a209a9baa691b744318ac929fecdd8847c", "url": "https://git.kernel.org/stable/c/c3b073a209a9baa691b744318ac929fecdd8847c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eee07d769da5ac4e4f7bd0bc17828646a318d499", "url": "https://git.kernel.org/stable/c/eee07d769da5ac4e4f7bd0bc17828646a318d499" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-93104", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rvt: Return NULL after port allocation failure\n\nrvt_alloc_device() deallocates the IB device when its port array cannot\nbe allocated but then returns the pointer to the released allocation.\nCallers treat any non-NULL value as valid and dereference it, resulting\nin a use-after-free.\n\nReturn NULL immediately after deallocation so callers can propagate the\nallocation failure.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-93104" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2982eaf3b9d2d953318c74cd6f1b7576ea6d7b1f", "url": "https://git.kernel.org/stable/c/2982eaf3b9d2d953318c74cd6f1b7576ea6d7b1f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a1a7a5e2fe1a15824fa9ae5edd8f008259471d1", "url": "https://git.kernel.org/stable/c/5a1a7a5e2fe1a15824fa9ae5edd8f008259471d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/80968b42d13080bf7bc1f3ee17fef126ce2ad98f", "url": "https://git.kernel.org/stable/c/80968b42d13080bf7bc1f3ee17fef126ce2ad98f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b1e1b25723af44328524c7b54433e4bf0ab9930c", "url": "https://git.kernel.org/stable/c/b1e1b25723af44328524c7b54433e4bf0ab9930c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b7129930d1ec46c03a0de07fdce6c29f75795006", "url": "https://git.kernel.org/stable/c/b7129930d1ec46c03a0de07fdce6c29f75795006" } ], "release_date": "2026-09-17T17:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68399", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF in sock clone early bailouts\n\nSimilar to recent commit 9b51a6155d14 (\"bpf,fork: wipe ->bpf_storage\nbefore bailouts that access it\"), sk_clone() performs an initial\nshallow copy of the socket field ->sk_bpf_storage via sock_copy()\nfor the cloned socket newsk.\n\nIf sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior\nto calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points\nto the parent socket's BPF local storage. When newsk is subsequently\nfreed via sk_free(), the deallocation path (__sk_destruct() ->\nbpf_sk_storage_free()) destroys the parent socket's BPF local storage,\nleading to a use-after-free (UAF) on the parent socket.\n\nFix this by resetting newsk->sk_bpf_storage to NULL immediately after\nsock_copy() in sk_clone(), and remove the now redundant initialization\nfrom bpf_sk_storage_clone().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68399" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/01f8a354497ba739f81b691b3702bc4c46500a4d", "url": "https://git.kernel.org/stable/c/01f8a354497ba739f81b691b3702bc4c46500a4d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14b49b5ab29979552c219a09e569b424fbbf4a6e", "url": "https://git.kernel.org/stable/c/14b49b5ab29979552c219a09e569b424fbbf4a6e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/24139461545e44442df9b80deace26b2eb3e103d", "url": "https://git.kernel.org/stable/c/24139461545e44442df9b80deace26b2eb3e103d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f", "url": "https://git.kernel.org/stable/c/7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f6814814b3bdd6ecb6bc1fc53ba4e827e0185f01", "url": "https://git.kernel.org/stable/c/f6814814b3bdd6ecb6bc1fc53ba4e827e0185f01" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2025-71082", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: revert use of devm_kzalloc in btusb\n\nThis reverts commit 98921dbd00c4e (\"Bluetooth: Use devm_kzalloc in\nbtusb.c file\").\n\nIn btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This\nties the lifetime of all the btusb data to the binding of a driver to\none interface, INTF. In a driver that binds to other interfaces, ISOC\nand DIAG, this is an accident waiting to happen.\n\nThe issue is revealed in btusb_disconnect(), where calling\nusb_driver_release_interface(&btusb_driver, data->intf) will have devm\nfree the data that is also being used by the other interfaces of the\ndriver that may not be released yet.\n\nTo fix this, revert the use of devm and go back to freeing memory\nexplicitly.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-71082" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339", "url": "https://git.kernel.org/stable/c/1e54c19eaf84ba652c4e376571093e58e144b339" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880", "url": "https://git.kernel.org/stable/c/252714f1e8bdd542025b16321c790458014d6880" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b", "url": "https://git.kernel.org/stable/c/c0ecb3e4451fe94f4315e6d09c4046dfbc42090b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc", "url": "https://git.kernel.org/stable/c/cca0e9206e3bcc63cd3e72193e60149165d493cc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003", "url": "https://git.kernel.org/stable/c/fdf7c640fb8a44a59b0671143d8c2f738bc48003" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fff9206b0907252a41eb12b7c1407b9347df18b1", "url": "https://git.kernel.org/stable/c/fff9206b0907252a41eb12b7c1407b9347df18b1" } ], "release_date": "2026-01-13T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-74569", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()\n\nsip_help_tcp() stores the size change of each NAT-rewritten SIP message\nin s16 diff and accumulates it in s16 tdiff, but a single message can\ngrow by more than S16_MAX while the packet stays under the 65535\nenlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long\nContact list expands the message by tens of kilobytes. diff then wraps,\nand \"datalen = datalen + diff - msglen\" yields a huge unsigned datalen,\nso the next iteration's ct_sip_get_header() reads past the linearized skb\ntail.\n\nWiden diff, tdiff and the seq_adjust hook to s32. Both are bounded by the\n65535 byte packet limit, and the seqadj core is already s32\n(nf_ct_seqadj_set() takes s32), so no previously accepted input is\nrejected.\n\n BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25\n ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694)\n nf_confirm (net/netfilter/nf_conntrack_proto.c:183)\n nf_hook_slow (net/netfilter/core.c:619)\n ip6_output (net/ipv6/ip6_output.c:246)\n ip6_forward (net/ipv6/ip6_output.c:690)\n ipv6_rcv (net/ipv6/ip6_input.c:351)\n __netif_receive_skb_one_core (net/core/dev.c:6212)\n process_backlog (net/core/dev.c:6676)\n __napi_poll (net/core/dev.c:7735)\n net_rx_action (net/core/dev.c:7955)\n handle_softirqs (kernel/softirq.c:622)\n run_ksoftirqd (kernel/softirq.c:1076)\n ...", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74569" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c", "url": "https://git.kernel.org/stable/c/1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/32d4abc8923b0d4046fd63ad6e4917872e44eb6d", "url": "https://git.kernel.org/stable/c/32d4abc8923b0d4046fd63ad6e4917872e44eb6d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/63eea41759fd682229c14e0a2205802b46d106f3", "url": "https://git.kernel.org/stable/c/63eea41759fd682229c14e0a2205802b46d106f3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c97621a110e386b2dd69e276eb699e1d3cec581d", "url": "https://git.kernel.org/stable/c/c97621a110e386b2dd69e276eb699e1d3cec581d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5", "url": "https://git.kernel.org/stable/c/db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d", "url": "https://git.kernel.org/stable/c/ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64", "url": "https://git.kernel.org/stable/c/ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f74554e67ccf04d1fa71069e8c9afa2717e40716", "url": "https://git.kernel.org/stable/c/f74554e67ccf04d1fa71069e8c9afa2717e40716" } ], "release_date": "2026-08-15T13:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68363", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request\n\nath9k_hif_request_firmware() re-arms an asynchronous firmware load via\nrequest_firmware_nowait(), passing hif_dev as the completion context, and\nthen still dereferences hif_dev:\n\n\tdev_info(&hif_dev->udev->dev, \"ath9k_htc: Firmware %s requested\\n\",\n\t\t hif_dev->fw_name);\n\nThe re-armed callback ath9k_hif_usb_firmware_cb() runs on the \"events\"\nworkqueue and, when the firmware is missing, walks the retry chain into\nath9k_hif_usb_firmware_fail() -> complete_all(&hif_dev->fw_done). That\nreleases the wait_for_completion(&hif_dev->fw_done) in a concurrent\nath9k_hif_usb_disconnect(), which then kfree()s hif_dev. The trailing\ndev_info() in the frame that re-armed the request can therefore read freed\nmemory (hif_dev->udev, the first field of struct hif_device_usb):\n\n BUG: KASAN: slab-use-after-free in ath9k_hif_request_firmware\n Read of size 8 ... by task kworker/...\n ath9k_hif_request_firmware\n ath9k_hif_usb_firmware_cb drivers/net/wireless/ath/ath9k/hif_usb.c:1247\n request_firmware_work_func\n Allocated by ...:\n ath9k_hif_usb_probe drivers/net/wireless/ath/ath9k/hif_usb.c\n Freed by ...:\n ath9k_hif_usb_disconnect -> kfree drivers/net/wireless/ath/ath9k/hif_usb.c\n\nThe fw_done barrier only makes disconnect wait for the firmware chain to\n*terminate*; it does not protect the outer ath9k_hif_request_firmware()\nframe that re-armed the request and keeps touching hif_dev afterwards.\n\nDrop the post-request dev_info(): it is the only use of hif_dev after the\nasync request is armed, and it is purely informational (the dev_err() on the\nfailure path runs only when request_firmware_nowait() did not arm a callback,\nso hif_dev is still alive there).\n\nThis was first reported by syzbot as a single, non-reproduced crash that was\nlater auto-obsoleted, and was independently rediscovered by the reFuzz fuzzer,\nwhich produced a C reproducer (USB-gadget connect/disconnect of an ath9k_htc\ndevice whose firmware download fails). The vulnerable code is unchanged and\nstill present in v7.1-rc6, where the slab-use-after-free reproduces under KASAN\nonce the (sub-microsecond) race window is widened.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68363" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/063497cc9f320ab71a7a937c3bc0a23e630aefe2", "url": "https://git.kernel.org/stable/c/063497cc9f320ab71a7a937c3bc0a23e630aefe2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/10b0ce629123a3737b4eda50188f73bb7be7b68b", "url": "https://git.kernel.org/stable/c/10b0ce629123a3737b4eda50188f73bb7be7b68b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/47ed81aaa7f94d9808f4719e78a760c2ec1e6c86", "url": "https://git.kernel.org/stable/c/47ed81aaa7f94d9808f4719e78a760c2ec1e6c86" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/48a69cedde7388294e4ea6fd804156cd62bc04fc", "url": "https://git.kernel.org/stable/c/48a69cedde7388294e4ea6fd804156cd62bc04fc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/48de0c6952192b0771fca468df4364d11ec74ad9", "url": "https://git.kernel.org/stable/c/48de0c6952192b0771fca468df4364d11ec74ad9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c9046d92c4b9789c9d9d775e4fd5f34be64cb0a", "url": "https://git.kernel.org/stable/c/7c9046d92c4b9789c9d9d775e4fd5f34be64cb0a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7f184ca38a90889f3f6665ff96748b95da39dbee", "url": "https://git.kernel.org/stable/c/7f184ca38a90889f3f6665ff96748b95da39dbee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dad9f96945d77ecd4708f730c06ef54dcd8cc057", "url": "https://git.kernel.org/stable/c/dad9f96945d77ecd4708f730c06ef54dcd8cc057" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-97445", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()\n\nEnhance buffer validation in acpi_ut_walk_aml_resources() to prevent\nbuffer overflows.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97445" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/37c794f87a72471f7ef71633ac0550ad14ac0885", "url": "https://git.kernel.org/stable/c/37c794f87a72471f7ef71633ac0550ad14ac0885" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/50a11e2f3dc8a7189e7ebbd3eeafa51f16128a56", "url": "https://git.kernel.org/stable/c/50a11e2f3dc8a7189e7ebbd3eeafa51f16128a56" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/816badec122fe01d05265f2d306212739f5d3fdb", "url": "https://git.kernel.org/stable/c/816badec122fe01d05265f2d306212739f5d3fdb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d", "url": "https://git.kernel.org/stable/c/b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cd60a407a3a6d75347a04f9271b7b561d06d21c8", "url": "https://git.kernel.org/stable/c/cd60a407a3a6d75347a04f9271b7b561d06d21c8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0fb1973f705c8b8bd7e118e4a9a65d05d800fba", "url": "https://git.kernel.org/stable/c/d0fb1973f705c8b8bd7e118e4a9a65d05d800fba" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f65e2ef7ccca11dc874f48aff996a6a26528f8e7", "url": "https://git.kernel.org/stable/c/f65e2ef7ccca11dc874f48aff996a6a26528f8e7" } ], "release_date": "2026-09-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-80622", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nchar: tlclk: fix use-after-free in tlclk_cleanup()\n\nThis patch improves the module cleanup process in the tlclk driver to\nprevent potential use-after-free and race conditions.\n\nCurrently, the file_operations structure does not specify the .owner\nfield, which could allow the module to be unloaded while user-space\nprocesses are still interacting with the device. Additionally, the\ntlclk_cleanup() function frees the alarm_events memory before ensuring\nthat blocked processes in the waitqueue are fully awakened and that the\nswitchover_timer has completed.\n\nTo address these cases, this patch:\n- Sets '.owner = THIS_MODULE' in tlclk_fops to safely defer module\n unloading while the device is in use.\n- Updates tlclk_cleanup() to explicitly wake up all blocked readers\n (wake_up_all), properly release hardware I/O regions, and safely\n delete the timer (timer_delete_sync) prior to freeing memory.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80622" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/09d8d2a46a9ec9ff728f3159a174a2ab25dd0f0a", "url": "https://git.kernel.org/stable/c/09d8d2a46a9ec9ff728f3159a174a2ab25dd0f0a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/166dd1d5265e067459e674c11688919901813ec2", "url": "https://git.kernel.org/stable/c/166dd1d5265e067459e674c11688919901813ec2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3d5e4cc0d9dce79b0429da3134ac7b072ab9009f", "url": "https://git.kernel.org/stable/c/3d5e4cc0d9dce79b0429da3134ac7b072ab9009f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/42223445607a9a5df3cb1c4729abfe3a5085e7ce", "url": "https://git.kernel.org/stable/c/42223445607a9a5df3cb1c4729abfe3a5085e7ce" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/764723bd67a6c8f53a8d8309211fb039e2ebcf49", "url": "https://git.kernel.org/stable/c/764723bd67a6c8f53a8d8309211fb039e2ebcf49" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/96902299a22d126ef5eb3f45cd5d8ceea9e6a735", "url": "https://git.kernel.org/stable/c/96902299a22d126ef5eb3f45cd5d8ceea9e6a735" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bbf003b7794d6ad6f939fdd29f1f1bde8ac554c1", "url": "https://git.kernel.org/stable/c/bbf003b7794d6ad6f939fdd29f1f1bde8ac554c1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c3f0cd76561ae611c2d247ee96dfd559e4197cb7", "url": "https://git.kernel.org/stable/c/c3f0cd76561ae611c2d247ee96dfd559e4197cb7" } ], "release_date": "2026-08-28T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98432", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the\nchild socket (newinet->inet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt->optlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98432" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568", "url": "https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936", "url": "https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a", "url": "https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036", "url": "https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5", "url": "https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2", "url": "https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6", "url": "https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b", "url": "https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b" } ], "release_date": "2026-10-15T12:08:22Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98375", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: drop RX packets with a short Ethernet header\n\nhandle_incoming_queue() pulls pull_to bytes into the head before\ncalling eth_type_trans(). pull_to is the length of the first RX slot,\ncapped at RX_COPY_THRESHOLD, and that length comes from the backend.\nNothing checks it against ETH_HLEN.\n\nIf the first slot is shorter than ETH_HLEN and more slots follow, the\nhead ends up shorter than an Ethernet header while skb->len is longer,\nand eth_type_trans() BUG()s in __skb_pull(). If the whole packet is\nshorter than ETH_HLEN, eth_type_trans() reads the header past the end\nof the data instead.\n\nPull at least ETH_HLEN, and drop the packet if that fails, which also\ndrops packets too short to hold an Ethernet header. This also checks\nthe return value of the pull, which was ignored.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98375" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0542d213253eec18785a24b603b28bd385dfe4a5", "url": "https://git.kernel.org/stable/c/0542d213253eec18785a24b603b28bd385dfe4a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/089e58805c452e52179482b1025a8e309a57f801", "url": "https://git.kernel.org/stable/c/089e58805c452e52179482b1025a8e309a57f801" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/236a17caebcff31f75bec5ff4136bde2de944e40", "url": "https://git.kernel.org/stable/c/236a17caebcff31f75bec5ff4136bde2de944e40" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/72d2f54367895d6e236b9857892e2e6b6036e067", "url": "https://git.kernel.org/stable/c/72d2f54367895d6e236b9857892e2e6b6036e067" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e2b721bc30f40ffa7ccc36a56d4e8990b8c0538e", "url": "https://git.kernel.org/stable/c/e2b721bc30f40ffa7ccc36a56d4e8990b8c0538e" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/09/3", "url": "http://www.openwall.com/lists/oss-security/2026/10/09/3" }, { "category": "external", "summary": "http://xenbits.xen.org/xsa/advisory-522.html", "url": "http://xenbits.xen.org/xsa/advisory-522.html" } ], "release_date": "2026-10-09T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-52957", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential null-ptr-deref in decode_choose_args()\n\nA message of type CEPH_MSG_OSD_MAP contains an OSD map that itself\ncontains a CRUSH map. When decoding this CRUSH map in crush_decode(), an\narray of max_buckets CRUSH buckets is decoded, where some indices may\nnot refer to actual buckets and are therefore set to NULL. The received\nCRUSH map may optionally contain choose_args that get decoded in\ndecode_choose_args(). When decoding a crush_choose_arg_map, a series of\nchoose_args for different buckets is decoded, with the bucket_index\nbeing read from the incoming message. It is only checked that the bucket\nindex does not exceed max_buckets, but not that it doesn't point to an\nindex with a NULL bucket. If a (potentially corrupted) message contains\na crush_choose_arg_map including such a bucket_index, a null pointer\ndereference may occur in the subsequent processing when attempting to\naccess the bucket with the given index.\n\nThis patch fixes the issue by extending the affected check. Now, it is\nonly attempted to access the bucket if it is not NULL.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-52957" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bf", "url": "https://git.kernel.org/stable/c/28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/301286c0ccd37d66b0e40786fd35a4f19cdbd88a", "url": "https://git.kernel.org/stable/c/301286c0ccd37d66b0e40786fd35a4f19cdbd88a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/312ec973efac0efb9b9ed64214235910e9ecbaa8", "url": "https://git.kernel.org/stable/c/312ec973efac0efb9b9ed64214235910e9ecbaa8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7169f326a23d0f547fcd90e68b72fd387622e126", "url": "https://git.kernel.org/stable/c/7169f326a23d0f547fcd90e68b72fd387622e126" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a20e16ebfe2fa65348eb4b2dc7deac330ce03e9c", "url": "https://git.kernel.org/stable/c/a20e16ebfe2fa65348eb4b2dc7deac330ce03e9c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d55ffad8d422b5d1cc44dad32bd3d25f4471cd9f", "url": "https://git.kernel.org/stable/c/d55ffad8d422b5d1cc44dad32bd3d25f4471cd9f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d7a65a34d2453f8cd3e0cc0e1319740af7e24276", "url": "https://git.kernel.org/stable/c/d7a65a34d2453f8cd3e0cc0e1319740af7e24276" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f2f95e6d4b97e70bb876139b0583fc8079983f85", "url": "https://git.kernel.org/stable/c/f2f95e6d4b97e70bb876139b0583fc8079983f85" } ], "release_date": "2026-06-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98419", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n al = sizeof(struct net_dm_alert_msg);\n al += dm_hit_limit * sizeof(struct net_dm_drop_point);\n al += sizeof(struct nlattr);\n\n skb = genlmsg_new(al, GFP_KERNEL);\n ...\n nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n ...\n msg = nla_data(nla);\n memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98419" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202", "url": "https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8", "url": "https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9", "url": "https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c", "url": "https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6", "url": "https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855", "url": "https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631", "url": "https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9", "url": "https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9" } ], "release_date": "2026-10-14T14:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-90205", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate orphan slot during inode read\n\nPatch series \"ocfs2: validate active orphan slots during inode read\".\n\nOCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes.\nA corrupted slot can therefore index osb_orphan_wipes or the slot-local\nsystem-inode cache outside their allocations before the corruption is\nreported.\n\nPatch 1 validates the ordinary orphan slot used by inode wipe processing.\nPatch 2 validates the append-DIO orphan slot used by DIO completion and\norphan recovery. Both checks reject corrupt metadata at the existing inode\nvalidation boundary.\n\n\nThis patch (of 2):\n\n[BUG]\nA corrupted dinode with OCFS2_ORPHANED_FL can carry an\ni_orphaned_slot outside the mounted filesystem slot range.\nocfs2_wipe_inode() uses it to index osb_orphan_wipes before looking\nup the orphan directory, causing an out-of-bounds memory access.\n\nBUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102\nRead of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85\nCall Trace:\n ...\n ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102\n ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840\n ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline]\n ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295\n evict+0x38e/0x8f0 fs/inode.c:810\n iput_final fs/inode.c:1914 [inline]\n iput fs/inode.c:1966 [inline]\n iput+0x55b/0x8b0 fs/inode.c:1926\n ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374\n ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373\n ...\n\n[CAUSE]\nocfs2_validate_inode_block() validates i_suballoc_slot but leaves\nthe active ordinary orphan slot unchecked. Downstream consumers\nassume that the value is smaller than osb->max_slots.\n\n[FIX]\nReject an active i_orphaned_slot outside the slot range during\ndinode validation, before the inode reaches orphan wipe processing.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90205" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3d7c4b7ce7b4baedfd8699fa692cd95f77d332de", "url": "https://git.kernel.org/stable/c/3d7c4b7ce7b4baedfd8699fa692cd95f77d332de" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b2d31acbd3b182755b019183fb46949ba5e39b9f", "url": "https://git.kernel.org/stable/c/b2d31acbd3b182755b019183fb46949ba5e39b9f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c6c908f9b4edfb04534b15573168ae038f7a9cbf", "url": "https://git.kernel.org/stable/c/c6c908f9b4edfb04534b15573168ae038f7a9cbf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dea50e8049b0db2eb3d468e2505034962e81d8cd", "url": "https://git.kernel.org/stable/c/dea50e8049b0db2eb3d468e2505034962e81d8cd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f535a34831f8325950933b401c76bfa99624419c", "url": "https://git.kernel.org/stable/c/f535a34831f8325950933b401c76bfa99624419c" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68160", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()\n\nceph_handle_caps() reads snap_trace_len from the wire-format\nceph_mds_caps header and uses it unconditionally to build a fake\nend pointer (snaptrace + snaptrace_len) that is later handed to\nceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case:\n\n snaptrace = h + 1;\n snaptrace_len = le32_to_cpu(h->snap_trace_len);\n p = snaptrace + snaptrace_len;\n ...\n case CEPH_CAP_OP_IMPORT:\n if (snaptrace_len) {\n ...\n if (ceph_update_snap_trace(mdsc, snaptrace,\n snaptrace + snaptrace_len,\n false, &realm)) { ... }\n\nceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm\nfrom snaptrace using ceph_decode_need(&p, e, sizeof(*ri), bad)\nwith the attacker-supplied fake end e == snaptrace + snaptrace_len.\nWith snaptrace_len == 0xFFFFFFFF the bound check is trivially\nsatisfied, ri = p reads sizeof(struct ceph_mds_snap_realm) past\nthe legitimate msg->front buffer, and ri->num_snaps /\nri->num_prior_parent_snaps then drive further out-of-bounds\nreads of the encoded snap arrays.\n\nThe eleven msg_version >= 2 .. msg_version >= 12 decoder blocks\nabove the op switch each catch this OOB through their\nceph_decode_*_safe() / ceph_decode_need() helpers, but they sit\nbehind a hdr.version-gated if, so a malicious or compromised\nMDS that sets msg->hdr.version = 1 reaches the IMPORT path with\nno version-gated decoder having validated snap_trace_len. The\nshape has been present since ceph_handle_caps() was introduced.\n\nValidate snap_trace_len against the message front buffer before\nconsuming it, using the canonical ceph_decode_need() / ceph_has_room()\nhelper. The helper bounds the length with subtraction (n <= end - p,\nguarded by end >= p) rather than pointer addition, so it is wrap-safe\nfor the attacker-controlled u32 length on 32-bit builds where\np + snap_trace_len could overflow the address space. This matches the\nrest of the ceph decode path (e.g. the pool_ns_len check a few lines\nbelow), and the existing goto bad cleanup already covers this exit\npath.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68160" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/03b417afce19ee6b6e61f1bbbbebac924c9f36d1", "url": "https://git.kernel.org/stable/c/03b417afce19ee6b6e61f1bbbbebac924c9f36d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c011137194036424e974677e0f1592e22a33d8c", "url": "https://git.kernel.org/stable/c/0c011137194036424e974677e0f1592e22a33d8c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02", "url": "https://git.kernel.org/stable/c/4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/71893c342a26bcff92eaab0b2b75d64aed19308a", "url": "https://git.kernel.org/stable/c/71893c342a26bcff92eaab0b2b75d64aed19308a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9081c71796724ffe96cba253f68fbe42363c5295", "url": "https://git.kernel.org/stable/c/9081c71796724ffe96cba253f68fbe42363c5295" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a4228b93706fb74a484e6ffb271c1cc2af3a2ddb", "url": "https://git.kernel.org/stable/c/a4228b93706fb74a484e6ffb271c1cc2af3a2ddb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cc93f68a31c9b831abf2db8647b5f5b10329d793", "url": "https://git.kernel.org/stable/c/cc93f68a31c9b831abf2db8647b5f5b10329d793" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f913192fc782288e060dafc329b2346934be34cc", "url": "https://git.kernel.org/stable/c/f913192fc782288e060dafc329b2346934be34cc" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-46163", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: b43legacy: enforce bounds check on firmware key index in RX path\n\nSame fix as b43: the firmware-controlled key index in b43legacy_rx()\ncan exceed dev->max_nr_keys. The existing B43legacy_WARN_ON is\nnon-enforcing in production builds, allowing an out-of-bounds read of\ndev->key[].\n\nMake the check enforcing by dropping the frame for invalid indices.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46163" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1baaeb6adecb9691748c0253dab6ddd19a2b4e9e", "url": "https://git.kernel.org/stable/c/1baaeb6adecb9691748c0253dab6ddd19a2b4e9e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4242db36de99de734cc1f60e5edd86cda7e598c6", "url": "https://git.kernel.org/stable/c/4242db36de99de734cc1f60e5edd86cda7e598c6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6ee946077607d7783ae6709a899213fc4fe08f35", "url": "https://git.kernel.org/stable/c/6ee946077607d7783ae6709a899213fc4fe08f35" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9d1bc155802943e92c57a5fb923d23edfbf0b525", "url": "https://git.kernel.org/stable/c/9d1bc155802943e92c57a5fb923d23edfbf0b525" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a035766f970bde2d4298346a31a80685be5c0205", "url": "https://git.kernel.org/stable/c/a035766f970bde2d4298346a31a80685be5c0205" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a92bd0503df2488f2cc040f329ebccff1c1934cb", "url": "https://git.kernel.org/stable/c/a92bd0503df2488f2cc040f329ebccff1c1934cb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/df805c1d085b7a96077f0964185764c87060950d", "url": "https://git.kernel.org/stable/c/df805c1d085b7a96077f0964185764c87060950d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fdd4e51979f42ca8b1ab7e6176b607e1caabf2a5", "url": "https://git.kernel.org/stable/c/fdd4e51979f42ca8b1ab7e6176b607e1caabf2a5" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" } ], "release_date": "2026-05-28T10:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89729", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature\n\nsensor_hub_get_feature() clamps its return value to the caller's buffer\nsize, but the copy loop still copies field->report_size / 8 bytes for\neach report value. A malicious HID descriptor can advertise a large\nfeature field size while an IIO caller supplies a small stack buffer,\nsuch as a single s32, causing an out-of-bounds write.\n\nHID core stores parsed report values in __s32 slots and clamps extracted\nvalues to 32 bits. Reject feature fields that require more than one slot\nper value, guard the total byte count calculation, and clamp each\nper-value copy to the remaining caller buffer.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89729" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1c0463f0f028801a933f090cd2695f132635b374", "url": "https://git.kernel.org/stable/c/1c0463f0f028801a933f090cd2695f132635b374" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4145aa149a32e4b35d5d47e380d0c6c438b4e6fe", "url": "https://git.kernel.org/stable/c/4145aa149a32e4b35d5d47e380d0c6c438b4e6fe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8bf8aaf2f74de64f801eb30bc38927dba1f8e40a", "url": "https://git.kernel.org/stable/c/8bf8aaf2f74de64f801eb30bc38927dba1f8e40a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9f43499ce6458a572b781f6bb46c464ab59fa825", "url": "https://git.kernel.org/stable/c/9f43499ce6458a572b781f6bb46c464ab59fa825" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bc3d72c44bff17688dc5f3e5132a53b51dae0f04", "url": "https://git.kernel.org/stable/c/bc3d72c44bff17688dc5f3e5132a53b51dae0f04" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c5c60260a07e627084e792ea959ab468ccfa4d50", "url": "https://git.kernel.org/stable/c/c5c60260a07e627084e792ea959ab468ccfa4d50" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c92693f3ed099401d0383ef35ca1fe1e6ba033de", "url": "https://git.kernel.org/stable/c/c92693f3ed099401d0383ef35ca1fe1e6ba033de" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fa95b14198b6c8ea721b4784f466d3c2c2bac83a", "url": "https://git.kernel.org/stable/c/fa95b14198b6c8ea721b4784f466d3c2c2bac83a" } ], "release_date": "2026-09-11T20:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89856", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation\n\nha->msix_count is u16, but ha->max_req_queues, ha->max_rsp_queues and\nha->max_qpairs are u8. Deriving the queue count as\n\"ha->max_req_queues = ha->msix_count - 1\" therefore truncates: a board\n(or a misconfigured/malicious hot-plugged device) advertising 257 MSI-X\nvectors yields msix_count - 1 == 256, which truncates to 0. An MSI-X\ncount of 1 zeroes it as well, and in target mode the subsequent\n\"ha->max_req_queues--\" then underflows 0 to 255.\n\nWhen the count is 0, qla2x00_alloc_queues() calls\nkzalloc_objs(struct req_que *, 0), which returns ZERO_SIZE_PTR. That is\nnot NULL, so the allocation check passes and the following\n\"ha->req_q_map[0] = req\" dereferences ZERO_SIZE_PTR, corrupting memory\nor crashing the kernel.\n\nAdd qla_calc_queue_count() to clamp the derived value into\n[1, QLA_MAX_QUEUES - 1] so it always fits in u8 and is never zero, and\nuse it at all three derivation sites (qla25xx_iospace_config(),\nqla83xx_iospace_config() and qla24xx_enable_msix()). Also guard the\ntarget-mode decrement so it cannot reintroduce a zero (which would in\nturn underflow max_qpairs).", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89856" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2efe50b2da829909023de4a2eb87badb7cfa53cc", "url": "https://git.kernel.org/stable/c/2efe50b2da829909023de4a2eb87badb7cfa53cc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/33c77254e6e91f37c72c7fad4051777452b10de8", "url": "https://git.kernel.org/stable/c/33c77254e6e91f37c72c7fad4051777452b10de8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a448f5ed0b283dbde4e9183dd1e98c221432dab", "url": "https://git.kernel.org/stable/c/7a448f5ed0b283dbde4e9183dd1e98c221432dab" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/802068b9b683b8008fcccbf6e9ad133e597ec87c", "url": "https://git.kernel.org/stable/c/802068b9b683b8008fcccbf6e9ad133e597ec87c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9eeddbeaa896f39d943644b16d83a6ad0ceab255", "url": "https://git.kernel.org/stable/c/9eeddbeaa896f39d943644b16d83a6ad0ceab255" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cf623d32761b00f221a9cfded3303d56e84b429d", "url": "https://git.kernel.org/stable/c/cf623d32761b00f221a9cfded3303d56e84b429d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e80adfeac61b4d5db7ffe0f5af43999c33a4145e", "url": "https://git.kernel.org/stable/c/e80adfeac61b4d5db7ffe0f5af43999c33a4145e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ebfd35c64433821bd5619a6d07ccc2df8b5b1de3", "url": "https://git.kernel.org/stable/c/ebfd35c64433821bd5619a6d07ccc2df8b5b1de3" } ], "release_date": "2026-09-16T11:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68155", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Reject monmaps advertising zero monitors\n\nA message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a\nmonitor to the client. This monmap contains information about the\nexisting monitors in the cluster. Currently, a monmap indicating that\nthere are zero monitors in the cluster is treated as valid. However, it\nis impossible to have zero monitors in the cluster and still receive a\nvalid monmap from a monitor. Therefore, such a monmap must be corrupted\nand should be treated as invalid. Furthermore, a monmap with a monitor\ncount of zero can subsequently crash the client when attempting to open\na session with a monitor in __open_session(). This happens because the\n\"BUG_ON(monc->monmap->num_mon < 1)\" assertion in pick_new_mon() is\ntriggered.\n\nThis patch extends a check in ceph_monmap_decode() to also reject\narriving mon_maps with num_mon == 0 rather than only with\nnum_mon > CEPH_MAX_MON.\n\n[ idryomov: drop \"log output for unusual values of num_mon\" part ]", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68155" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0591a15815b498be628a937146e44487d599ba33", "url": "https://git.kernel.org/stable/c/0591a15815b498be628a937146e44487d599ba33" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b249546f59c3d6d3592c10657f82bc3f1faa07c", "url": "https://git.kernel.org/stable/c/3b249546f59c3d6d3592c10657f82bc3f1faa07c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/40480eee361ed9676b3f844d532ac28b47251634", "url": "https://git.kernel.org/stable/c/40480eee361ed9676b3f844d532ac28b47251634" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ba5f0015bfd376d764163045a61c17be75f44dae", "url": "https://git.kernel.org/stable/c/ba5f0015bfd376d764163045a61c17be75f44dae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/caf082ef8609a6ac26159ce115f55ab7d00231a3", "url": "https://git.kernel.org/stable/c/caf082ef8609a6ac26159ce115f55ab7d00231a3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cd0d41bc569632eaaeccde9d2a6bc919ec00c407", "url": "https://git.kernel.org/stable/c/cd0d41bc569632eaaeccde9d2a6bc919ec00c407" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3ccd4ecab09b22f507f49cb7ed9990c7158ceab", "url": "https://git.kernel.org/stable/c/e3ccd4ecab09b22f507f49cb7ed9990c7158ceab" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e67e8b694872c9bc66996040f9de9242f6236ed9", "url": "https://git.kernel.org/stable/c/e67e8b694872c9bc66996040f9de9242f6236ed9" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74408", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: fix OOB access from firmware tx status queue ID\n\nath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a\n4-bit hardware field (0-15), but the txq array only has\nATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array\naccess.\n\nAdd a bounds check on ts.qid before using it as an array index.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74408" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0", "url": "https://git.kernel.org/stable/c/336d4c8cd9b1646060ee690c881d465dfc09c6c0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc", "url": "https://git.kernel.org/stable/c/46ca1451f61b598f45cb5259e066d305444d95fc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc", "url": "https://git.kernel.org/stable/c/5435fd3edcb11c7cc4002847c83e9a50b49284dc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25", "url": "https://git.kernel.org/stable/c/734db72d55ca578a344dfa33e30145032c074b25" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0", "url": "https://git.kernel.org/stable/c/7ce2f118a2389e8f0a64068c6fe7cc7d40639be0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379", "url": "https://git.kernel.org/stable/c/a9e055ac62cb3fcea262d4b687ec73eed82b3379" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481", "url": "https://git.kernel.org/stable/c/f5931d06b45ed402572bfe5832fff15864ef5481" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54", "url": "https://git.kernel.org/stable/c/fb11083db9d7d6fb8f98bbba1cbfcf3fb7b4bf54" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-90334", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: clear cdev pointer after cdev_add() failure\n\ntty_cdev_add() drops the cdev reference when cdev_add() fails, but\nleaves driver->cdevs[index] pointing to freed memory.\ntty_unregister_device() later passes that stale pointer to cdev_del(),\ncausing a use-after-free.\n\nClear the slot after dropping the reference.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90334" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/33a44333a9dfda044b0e233399b12ead7f8a90ae", "url": "https://git.kernel.org/stable/c/33a44333a9dfda044b0e233399b12ead7f8a90ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4f6bd79bb7e55095f09bec9b4eb6c09df1306116", "url": "https://git.kernel.org/stable/c/4f6bd79bb7e55095f09bec9b4eb6c09df1306116" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5c5a795bf6248fe96f96dd9fd79d66bbb4a92077", "url": "https://git.kernel.org/stable/c/5c5a795bf6248fe96f96dd9fd79d66bbb4a92077" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6645856f0df3aeecd45519cb611415b4b89c2223", "url": "https://git.kernel.org/stable/c/6645856f0df3aeecd45519cb611415b4b89c2223" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a83fcddf3c75d004f12aa13555bb73da19fb75a9", "url": "https://git.kernel.org/stable/c/a83fcddf3c75d004f12aa13555bb73da19fb75a9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d331c63570af61ef7aaf516b64a8d6f47518a3a4", "url": "https://git.kernel.org/stable/c/d331c63570af61ef7aaf516b64a8d6f47518a3a4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e9e64dd02fd68776afda00777591eca0c3984285", "url": "https://git.kernel.org/stable/c/e9e64dd02fd68776afda00777591eca0c3984285" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fb1de260033c215dba438973d82b48562bdc86bb", "url": "https://git.kernel.org/stable/c/fb1de260033c215dba438973d82b48562bdc86bb" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-97596", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reject invalid states in connection template sync records\n\nIPVS sync receivers validate protocol states before creating or updating a\nconnection. For connection templates, however, they only log states outside\nthe template state range and still store the value in the connection.\n\nA template can be returned by ordinary connection lookup. TCP and SCTP then\nuse the invalid state as an index into their transition tables.\n\nReject invalid template states in both sync protocol versions before\nlooking up or modifying a connection. The version 1 path handles both\nIPv4 and IPv6 records.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97596" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c61f7d8e18a978aec2a16d9acd5f682f1c72476", "url": "https://git.kernel.org/stable/c/0c61f7d8e18a978aec2a16d9acd5f682f1c72476" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1a8f15911352bb3cf4663aa02049c49c7f30e524", "url": "https://git.kernel.org/stable/c/1a8f15911352bb3cf4663aa02049c49c7f30e524" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/50c3f06222eafe9cca7ca51a0ef83311d7cab353", "url": "https://git.kernel.org/stable/c/50c3f06222eafe9cca7ca51a0ef83311d7cab353" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5677e81ffdbfc1c03dcb427fb8b1c38289bed76d", "url": "https://git.kernel.org/stable/c/5677e81ffdbfc1c03dcb427fb8b1c38289bed76d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/652d9caa5ac925ab012834e325d77b9ed638d4fc", "url": "https://git.kernel.org/stable/c/652d9caa5ac925ab012834e325d77b9ed638d4fc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/74cb39735b6cd0aff4b5584158f09376fd97aadf", "url": "https://git.kernel.org/stable/c/74cb39735b6cd0aff4b5584158f09376fd97aadf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d4eb339b442a0ffaa565779b975494a0a0664f18", "url": "https://git.kernel.org/stable/c/d4eb339b442a0ffaa565779b975494a0a0664f18" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fc10dc4511e6e2e2b4098ee115c8e5639471f23d", "url": "https://git.kernel.org/stable/c/fc10dc4511e6e2e2b4098ee115c8e5639471f23d" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-46294", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix a buffer overflow in ioctl processing\n\nTony Asleson (using Claude) found a buffer overflow in dm-ioctl in the\nfunction retrieve_status:\n\n1. The code in retrieve_status checks that the output string fits into\n the output buffer and writes the output string there\n2. Then, the code aligns the \"outptr\" variable to the next 8-byte\n boundary:\n\toutptr = align_ptr(outptr);\n3. The alignment doesn't check overflow, so outptr could point past the\n buffer end\n4. The \"for\" loop is iterated again, it executes:\n\tremaining = len - (outptr - outbuf);\n5. If \"outptr\" points past \"outbuf + len\", the arithmetics wraps around\n and the variable \"remaining\" contains unusually high number\n6. With \"remaining\" being high, the code writes more data past the end of\n the buffer\n\nLuckily, this bug has no security implications because:\n1. Only root can issue device mapper ioctls\n2. The commonly used libraries that communicate with device mapper\n (libdevmapper and devicemapper-rs) use buffer size that is aligned to\n 8 bytes - thus, \"outptr = align_ptr(outptr)\" can't overshoot the input\n buffer and the bug can't happen accidentally", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46294" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159", "url": "https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c", "url": "https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d", "url": "https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5af6a879e915ae7bcd83695c316ebb32e1c61bc2", "url": "https://git.kernel.org/stable/c/5af6a879e915ae7bcd83695c316ebb32e1c61bc2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8daa6c708ef524089ae43f2aed9190acb26d7df8", "url": "https://git.kernel.org/stable/c/8daa6c708ef524089ae43f2aed9190acb26d7df8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c8c5311237448f6ffeecc9aec2362e3692623668", "url": "https://git.kernel.org/stable/c/c8c5311237448f6ffeecc9aec2362e3692623668" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d271631023cbe1cbe7c31a0275ab797883be6e0a", "url": "https://git.kernel.org/stable/c/d271631023cbe1cbe7c31a0275ab797883be6e0a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a", "url": "https://git.kernel.org/stable/c/f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" } ], "release_date": "2026-06-08T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90414", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: reject PDUs declaring more data than was received\n\nisert_recv_done() hands each received PDU to the opcode handlers without\never looking at wc->byte_len, the number of bytes the HCA actually placed\nin the receive descriptor. The handlers then copy that many bytes - the\ndata-segment length the initiator declared in the BHS\n(ntoh24(hdr->dlength), via the derived unsol_data_len / imm_data_len) -\nout of the fixed-size descriptor:\n\n isert_handle_iscsi_dataout():\n sg_copy_from_buffer(sg_start, sg_nents, isert_get_data(rx_desc),\n unsol_data_len);\n isert_handle_scsi_cmd():\n sg_copy_from_buffer(cmd->se_cmd.t_data_sg, sg_nents,\n isert_get_data(rx_desc), imm_data_len);\n\nBecause the declared length is never checked against wc->byte_len, an\ninitiator can declare a data segment larger than the bytes it actually\nsent (and larger than the descriptor) and cause an out-of-bounds read of\nthe receive buffer.\n\nNothing upstream of isert closes this door:\n\n - __iscsit_check_dataout_hdr() bounds the inbound payload against\n conn_ops->MaxXmitDataSegmentLength (MXDSL) - a transmit parameter,\n used here for the inbound check.\n - iscsi_set_connection_parameters() sets\n ops->MaxXmitDataSegmentLength = ops->TargetRecvDataSegmentLength;\n and TARGETRECVDATASEGMENTLENGTH is absent from the min()-clamp list in\n iscsi_check_acceptor_state(), so the value the initiator declares is\n adopted verbatim (type range 512..16777215). The initiator effectively\n raises its own ceiling.\n - isert never clamps the negotiated value to its own fixed receive\n descriptor (ISER_RX_SIZE, 9216 bytes), so the target core's bound and\n the descriptor size are unrelated.\n\nThe imm_data_len == data_len path is more than an over-read: it aliases\nthe receive descriptor via sg_set_buf() and passes it to the backend as\nthe data source for the SCSI WRITE, so an over-declared length causes heap\ncontents past the descriptor to be written through the backend to the\nbacking store. The backend is the victim of the oversized scatterlist\nisert hands it, not the cause; no read-back of the written bytes was\ndemonstrated.\n\nTrigger: after login completes (full feature phase), an initiator that has\ndeclared a large TargetRecvDataSegmentLength and a FirstBurstLength that\npermits unsolicited/immediate data sends a PDU whose declared data-segment\nlength exceeds what was received. With KASAN:\n\n BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0\n Read of size 4096 at addr ffff888109720800 by task kworker/1:0H/25\n Workqueue: ib-comp-wq ib_cq_poll_work\n Call Trace:\n sg_copy_buffer+0x150/0x1c0\n isert_recv_done+0xba6/0x2390\n __ib_process_cq+0xe1/0x390\n ib_cq_poll_work+0x46/0x150\n\nisert_recv_done+0xba6 resolves to isert_handle_iscsi_dataout()\n(ib_isert.c:1160), inlined through isert_rx_opcode().\n\nValidate wc->byte_len against the framing in isert_recv_done() before the\nPDU reaches any handler, and reinstate the connection if it is short.\nBecause the test compares without subtracting the header length, it also\nrejects PDUs shorter than the iSER and iSCSI headers, which would otherwise\nbe parsed out of stale descriptor contents. The login handler rejects PDUs\nshorter than ISER_HEADERS_LEN (commit 29e7b925ae6d (\"IB/isert: Reject login\nPDUs shorter than ISER_HEADERS_LEN\")) but does not bound the declared\nlength either; that is fixed in the next patch. The data handlers had no\nlength check at all.\n\nisert reads the data segment from a fixed offset: isert_get_data()\nreturns the iSER header plus ISER_HEADERS_LEN and makes no adjustment for\nan AHS. The bytes the handlers touch are therefore exactly\n[ISER_HEADERS_LEN, ISER_HEADERS_LEN + dlength), and comparing that sum\nagainst wc->byte_len bounds precisely the region that is read. An AHS\nterm would only make the test stricter without bounding anything furth\n---truncated---", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90414" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/274b1ad7e78338710864c4b4235bb1ce7e7107f9", "url": "https://git.kernel.org/stable/c/274b1ad7e78338710864c4b4235bb1ce7e7107f9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2a6b8f88fb7ee51714a1922a039225bdcaf12855", "url": "https://git.kernel.org/stable/c/2a6b8f88fb7ee51714a1922a039225bdcaf12855" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/352dc85324b29f5c85876f2666f3158b645e3f18", "url": "https://git.kernel.org/stable/c/352dc85324b29f5c85876f2666f3158b645e3f18" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/39da0b7e1f530347d284cebcfc5b5afa90a173bf", "url": "https://git.kernel.org/stable/c/39da0b7e1f530347d284cebcfc5b5afa90a173bf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/957f92ea4022fb6af4618271615a2a21a7b5bef9", "url": "https://git.kernel.org/stable/c/957f92ea4022fb6af4618271615a2a21a7b5bef9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4706722ed3ea72882b3c986a19b4a1ba66384c4", "url": "https://git.kernel.org/stable/c/b4706722ed3ea72882b3c986a19b4a1ba66384c4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bc58e9d3dc560220c57b8bdfc12af0cff1c8a43d", "url": "https://git.kernel.org/stable/c/bc58e9d3dc560220c57b8bdfc12af0cff1c8a43d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cf36fa5357a2fb25776a568d13a3653da7d99bcb", "url": "https://git.kernel.org/stable/c/cf36fa5357a2fb25776a568d13a3653da7d99bcb" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98096", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: restore network header before routing and forwarding\n\nipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH)\nwhile skb_network_header() points at the IPv6 header.\n\nWhen segments_left > 0, ipv6_srh_rcv() previously restored the skb->data\nposition by pushing sizeof(struct ipv6hdr), assuming the SRH immediately\nfollowed the fixed IPv6 header. If another extension header (such as a\nHop-by-Hop options header) precedes the SRH, skb_network_offset()\nremained negative.\n\nThis led to two problems:\n1. During ip6_route_input(), fib6_rules_early_flow_dissect() invokes\n __skb_flow_dissect() which passes the negative skb_network_offset()\n to flow dissection, breaking BPF and C flow dissector logic.\n2. If forwarded via ip6_forward() or redirected via act_mirred, downstream\n handlers (like sch_fragment() or neighbour output) pass the negative\n offset as an unsigned length, triggering OOB memcpy or buffer overflows.\n\nFix this by pushing -skb_network_offset(skb) before routing, ensuring\nskb_network_offset(skb) is 0 for route lookup / flow dissection as well as\ndownstream forwarding. On the loopback path, pull skb_transport_offset(skb)\nto restore skb->data to the SRH before looping back.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98096" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3ad7dca5e03bd64c65983a19734337512fd75491", "url": "https://git.kernel.org/stable/c/3ad7dca5e03bd64c65983a19734337512fd75491" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f44d4160bcdb3136a9145a4b9c7816382976925", "url": "https://git.kernel.org/stable/c/8f44d4160bcdb3136a9145a4b9c7816382976925" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/975b5b067f525a1b1338c4a3bee1c46545801518", "url": "https://git.kernel.org/stable/c/975b5b067f525a1b1338c4a3bee1c46545801518" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/97b21ef57dfabbff660a4672c9fef7edfb720f47", "url": "https://git.kernel.org/stable/c/97b21ef57dfabbff660a4672c9fef7edfb720f47" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9cfbe2c381ab6d00a08e7a5b6028865adfb4e1bc", "url": "https://git.kernel.org/stable/c/9cfbe2c381ab6d00a08e7a5b6028865adfb4e1bc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/af08f62b5a5a446d6134a92d86771d3d12e0e3da", "url": "https://git.kernel.org/stable/c/af08f62b5a5a446d6134a92d86771d3d12e0e3da" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ce4c8beedc19aceeab0e7bdc6f34394fb158c47c", "url": "https://git.kernel.org/stable/c/ce4c8beedc19aceeab0e7bdc6f34394fb158c47c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f463c4786cf27376de7dfc0833a12e924a98f698", "url": "https://git.kernel.org/stable/c/f463c4786cf27376de7dfc0833a12e924a98f698" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-46056", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: fix potential UAF in SSP passkey handlers\n\nhci_conn lookup and field access must be covered by hdev lock in\nhci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise\nthe connection can be freed concurrently.\n\nExtend the hci_dev_lock critical section to cover all conn usage in both\nhandlers.\n\nKeep the existing keypress notification behavior unchanged by routing\nthe early exits through a common unlock path.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46056" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/01a6431766c35dfedb86e0cb5d3fc80c6d604a47", "url": "https://git.kernel.org/stable/c/01a6431766c35dfedb86e0cb5d3fc80c6d604a47" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/204028af77a265e31ceb4ba7f643349a3cca72b2", "url": "https://git.kernel.org/stable/c/204028af77a265e31ceb4ba7f643349a3cca72b2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/85fa3512048793076eef658f66489112dcc91993", "url": "https://git.kernel.org/stable/c/85fa3512048793076eef658f66489112dcc91993" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c6443bb9257b780986fb67ec08565bf48ecb8d7", "url": "https://git.kernel.org/stable/c/8c6443bb9257b780986fb67ec08565bf48ecb8d7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b6ae482f88654db407c8c17619d4b62959b903ef", "url": "https://git.kernel.org/stable/c/b6ae482f88654db407c8c17619d4b62959b903ef" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d28311539ac9f65e29308ea219ecaa48aa5e76e5", "url": "https://git.kernel.org/stable/c/d28311539ac9f65e29308ea219ecaa48aa5e76e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e08d75753db17aa943d7622f09d9c217b5bfd3b8", "url": "https://git.kernel.org/stable/c/e08d75753db17aa943d7622f09d9c217b5bfd3b8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ea18732d2614557e59f4c0d8cdbe6611aeab33b7", "url": "https://git.kernel.org/stable/c/ea18732d2614557e59f4c0d8cdbe6611aeab33b7" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" } ], "release_date": "2026-05-27T14:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98532", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not let ipv6_find_hdr() return an offset past the packet end\n\nipv6_find_hdr() walks the extension header chain, skipping each header by\nthe length that header itself declares. ipv6_optlen() returns up to 2048,\nand the skip is never checked against skb->len, so the offset stored in\n*offset can point past the end of the packet.\n\nopenvswitch installs that offset as the transport header, and\nupdate_ipv6_checksum() then reads and writes the transport checksum field\nout of bounds:\n\n BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470\n Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629\n CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348\n Call Trace:\n inet_proto_csum_replace16+0x445/0x470\n set_ipv6_addr+0x3dd/0x460\n do_execute_actions+0x6a3d/0x7c40\n ovs_execute_actions+0xfd/0x480\n ovs_packet_cmd_execute+0xc38/0xf20\n genl_rcv_msg+0x59e/0x870\n netlink_rcv_skb+0x18b/0x450\n genl_rcv+0x2d/0x40\n netlink_unicast+0x6bc/0xa20\n\n The buggy address belongs to the object at ffff88810b754980\n which belongs to the cache skbuff_small_head of size 704\n The buggy address is located 390 bytes inside of\n freed 704-byte region [ffff88810b754980, ffff88810b754c40)\n\nOther callers use that offset too, so bound it here rather than in one\ncaller.\n\nReject a header whose declared length does not fit in the packet.\nipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this\nadds no new failure mode.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98532" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1c70275ca87e769e1a52abc644d61372d8c016cb", "url": "https://git.kernel.org/stable/c/1c70275ca87e769e1a52abc644d61372d8c016cb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1d42828565889632068fbc2983c34d57c66af4e0", "url": "https://git.kernel.org/stable/c/1d42828565889632068fbc2983c34d57c66af4e0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4254d5878c320c19961dd0b8e1d0aca4800d8b7d", "url": "https://git.kernel.org/stable/c/4254d5878c320c19961dd0b8e1d0aca4800d8b7d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/531255de8971c06d5d5986f85fdc2525d707ba71", "url": "https://git.kernel.org/stable/c/531255de8971c06d5d5986f85fdc2525d707ba71" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/543354c6efb27eae3372a3a9674aeaa2a86e2b2c", "url": "https://git.kernel.org/stable/c/543354c6efb27eae3372a3a9674aeaa2a86e2b2c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ca96b38730e31357ef4a9d76af1336958ac670d7", "url": "https://git.kernel.org/stable/c/ca96b38730e31357ef4a9d76af1336958ac670d7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dc92cb972e86790b8078337ec41015b748b8f8e5", "url": "https://git.kernel.org/stable/c/dc92cb972e86790b8078337ec41015b748b8f8e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee319bd3a0e976af5087cbe59ebc50a66f31d202", "url": "https://git.kernel.org/stable/c/ee319bd3a0e976af5087cbe59ebc50a66f31d202" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-97455", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix use-after-free in acpi_ds_terminate_control_method()\n\nFix use-after-free issue in acpi_ds_terminate_control_method() by\nclearing references to method locals and arguments.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97455" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2793b1c38f0053fd9b119ce4607dd056eb05d382", "url": "https://git.kernel.org/stable/c/2793b1c38f0053fd9b119ce4607dd056eb05d382" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3855d8992f5a88b033925cc4f6aef7a485f326cb", "url": "https://git.kernel.org/stable/c/3855d8992f5a88b033925cc4f6aef7a485f326cb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/460aed7b408508a2c28ca4fdd8d90a82bb4005aa", "url": "https://git.kernel.org/stable/c/460aed7b408508a2c28ca4fdd8d90a82bb4005aa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/63ca6f67816a229e07a08cac4bef1b3858abde66", "url": "https://git.kernel.org/stable/c/63ca6f67816a229e07a08cac4bef1b3858abde66" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/945e87267cfd90937b3c637f87324cbb56998b72", "url": "https://git.kernel.org/stable/c/945e87267cfd90937b3c637f87324cbb56998b72" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef5a8d939c1e5b36e75450bbb5b6348faff4dcf3", "url": "https://git.kernel.org/stable/c/ef5a8d939c1e5b36e75450bbb5b6348faff4dcf3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fe7b3d3b7490c2c0119f2d84fa33996dcbc71042", "url": "https://git.kernel.org/stable/c/fe7b3d3b7490c2c0119f2d84fa33996dcbc71042" } ], "release_date": "2026-09-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-64471", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: fix use-after-free on registration failure\n\nMake sure to release the sibling interfaces in case controller\nregistration fails to avoid use-after-free and double-free when they are\neventually disconnected.\n\nThis issue was reported by Sashiko while reviewing a fix for a wakeup\nsource leak in the btusb probe errors paths.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64471" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14e02f1449ba425a44dedbec9a21efafb056e09f", "url": "https://git.kernel.org/stable/c/14e02f1449ba425a44dedbec9a21efafb056e09f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1ce5012944afaddbda939ec6bae9800fce84abbc", "url": "https://git.kernel.org/stable/c/1ce5012944afaddbda939ec6bae9800fce84abbc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/468fcdfaeb937163dd250773a9fed17ab1fa203c", "url": "https://git.kernel.org/stable/c/468fcdfaeb937163dd250773a9fed17ab1fa203c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8db0ce3de78367f61c2970c0f16d9adee8830a23", "url": "https://git.kernel.org/stable/c/8db0ce3de78367f61c2970c0f16d9adee8830a23" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/da7d7758fe884b256ddc9fef562e5ddef7952383", "url": "https://git.kernel.org/stable/c/da7d7758fe884b256ddc9fef562e5ddef7952383" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e09ac7d0c6859a360bf36e7104aef03f88184e0b", "url": "https://git.kernel.org/stable/c/e09ac7d0c6859a360bf36e7104aef03f88184e0b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e6313b800da61a26c2fdd5eba0105e197c0ab3bc", "url": "https://git.kernel.org/stable/c/e6313b800da61a26c2fdd5eba0105e197c0ab3bc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eedc6867ebad73edbfaf9a0a65fbef7115cc4753", "url": "https://git.kernel.org/stable/c/eedc6867ebad73edbfaf9a0a65fbef7115cc4753" } ], "release_date": "2026-07-25T10:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89892", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: em28xx: defer audio-only extension registration\n\nThe audio-only path registers extensions while probing the primary device.\nFor a dual-TS board, this happens before dev_next is created. The duplicate\ndevice inherits is_audio_only and is then independently inserted into\nem28xx_devlist.\n\nThe list is intended to contain only primary devices: extension operations\nreach the secondary device through dev_next. The independently linked\nsecondary can be freed during disconnect while its list node remains\nreachable, resulting in a use-after-free.\n\nDefer audio-only extension registration to the module-request work item. It\nruns only after probing has completed construction of the optional\nsecondary device, so only the primary is registered and extension callbacks\nreach the secondary through dev_next.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89892" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0da1e627f4fc9d0e947fdae90913042120878923", "url": "https://git.kernel.org/stable/c/0da1e627f4fc9d0e947fdae90913042120878923" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1abe9524dec0fd26e9ceb8d586034d6f68dd8273", "url": "https://git.kernel.org/stable/c/1abe9524dec0fd26e9ceb8d586034d6f68dd8273" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4666197ca4f7d80cd3b0292054fe45d76be9ba04", "url": "https://git.kernel.org/stable/c/4666197ca4f7d80cd3b0292054fe45d76be9ba04" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4e11c45dfdc72ab656067b1df8fcebaf52fd4715", "url": "https://git.kernel.org/stable/c/4e11c45dfdc72ab656067b1df8fcebaf52fd4715" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/95f76f51937fdfb0fc1e14cae606b1ef574a56f3", "url": "https://git.kernel.org/stable/c/95f76f51937fdfb0fc1e14cae606b1ef574a56f3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d06067ee32620f272cfb80c7bc7c572ad4e74724", "url": "https://git.kernel.org/stable/c/d06067ee32620f272cfb80c7bc7c572ad4e74724" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f8d7e77d9c621b42a191c67a9b37bec23dc1d555", "url": "https://git.kernel.org/stable/c/f8d7e77d9c621b42a191c67a9b37bec23dc1d555" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f9322ac9f862961d7f377b87ec26c8565af7e073", "url": "https://git.kernel.org/stable/c/f9322ac9f862961d7f377b87ec26c8565af7e073" } ], "release_date": "2026-09-16T11:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-72014", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: reject data replies with an out-of-range payload size\n\nrecv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an\noutstanding read request. The peer-supplied payload length reaches it as\nthe signed int data_size, and two peer-controlled inputs can make it\nnegative. With a negotiated data-integrity-alg the digest length is\nsubtracted first, so a reply whose payload is smaller than the digest\nunderflows data_size. With no integrity algorithm (the default) data_size\nis assigned from the unsigned h95/h100 wire length and drbdd() never\nbounds it for a payload-carrying command, so a length above INT_MAX casts\nit negative; this path needs no non-default feature. The bio receive loop\nthen computes expect = min_t(int, data_size, bv_len), which is negative,\nand drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX\ninto the first mapped page.\n\nThe sibling receive path read_in_block() is not affected: it uses an\nunsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving.\nReject a data reply whose size is negative after the optional digest\nsubtraction, covering both triggers.\n\nImpact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen\nbytes past a bio page in the receiver, corrupting kernel memory. A node\nthat reads from its peer (a diskless node, or read-balancing to the peer)\nis exposed in the default configuration; data-integrity-alg is not\nrequired.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72014" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/38cc4867540ae8beedfe41a1a1a6ed37052c77d6", "url": "https://git.kernel.org/stable/c/38cc4867540ae8beedfe41a1a1a6ed37052c77d6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5f59a8142000f0b8f75c432209ead73c424a745d", "url": "https://git.kernel.org/stable/c/5f59a8142000f0b8f75c432209ead73c424a745d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/648d4317326e6aa3f8c05cbf0fd14cc2eba6ca99", "url": "https://git.kernel.org/stable/c/648d4317326e6aa3f8c05cbf0fd14cc2eba6ca99" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/741a682535deffe9ab7e5c89caf83571efbc9dd9", "url": "https://git.kernel.org/stable/c/741a682535deffe9ab7e5c89caf83571efbc9dd9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bca33f5442c3094511719d9db792ce3165d87e76", "url": "https://git.kernel.org/stable/c/bca33f5442c3094511719d9db792ce3165d87e76" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bd910a7660d280595ef94cb6d193951d855d330f", "url": "https://git.kernel.org/stable/c/bd910a7660d280595ef94cb6d193951d855d330f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f14e87d7b166490bceb9603b39310e51595d05b9", "url": "https://git.kernel.org/stable/c/f14e87d7b166490bceb9603b39310e51595d05b9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f16866c62656865854106b79bcf6e4ca97a51a92", "url": "https://git.kernel.org/stable/c/f16866c62656865854106b79bcf6e4ca97a51a92" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2025-38159", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds\n\nSet the size to 6 instead of 2, since 'para' array is passed to\n'rtw_fw_bt_wifi_control(rtwdev, para[0], ¶[1])', which reads\n5 bytes:\n\nvoid rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data)\n{\n ...\n SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data);\n SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1));\n ...\n SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4));\n\nDetected using the static analysis tool - Svace.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38159" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1ee8ea6937d13b20f90ff35d71ccc03ba448182d", "url": "https://git.kernel.org/stable/c/1ee8ea6937d13b20f90ff35d71ccc03ba448182d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4c2c372de2e108319236203cce6de44d70ae15cd", "url": "https://git.kernel.org/stable/c/4c2c372de2e108319236203cce6de44d70ae15cd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/68a1037f0bac4de9a585aa9c879ef886109f3647", "url": "https://git.kernel.org/stable/c/68a1037f0bac4de9a585aa9c879ef886109f3647" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/74e18211c2c89ab66c9546baa7408288db61aa0d", "url": "https://git.kernel.org/stable/c/74e18211c2c89ab66c9546baa7408288db61aa0d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9febcc8bded8be0d7efd8237fcef599b6d93b788", "url": "https://git.kernel.org/stable/c/9febcc8bded8be0d7efd8237fcef599b6d93b788" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c13255389499275bc5489a0b5b7940ccea3aef04", "url": "https://git.kernel.org/stable/c/c13255389499275bc5489a0b5b7940ccea3aef04" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "release_date": "2025-07-03T09:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-97427", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: bound pp_dpm_set_pp_table() memcpy\n\nThe powerplay path allocates hardcode_pp_table once with kmemdup(...,\nsoft_pp_table_size). memcpy(..., size) used the sysfs store count (up to\nPAGE_SIZE) with no upper bound, causing heap overflow. Reject\nwrites where size exceeds soft_pp_table_size.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97427" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3334985f8b4c7c637a829744c81518ad9a671bcb", "url": "https://git.kernel.org/stable/c/3334985f8b4c7c637a829744c81518ad9a671bcb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/43d2ab8408f9f468b232350c74160ae21e763020", "url": "https://git.kernel.org/stable/c/43d2ab8408f9f468b232350c74160ae21e763020" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9b5cb2e4eb297fe52be26fd895fc5ea28fc22bf9", "url": "https://git.kernel.org/stable/c/9b5cb2e4eb297fe52be26fd895fc5ea28fc22bf9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/abe61d067b48b947bedc9bae3725cb8f48dc8c0a", "url": "https://git.kernel.org/stable/c/abe61d067b48b947bedc9bae3725cb8f48dc8c0a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f193e71fa9fab2e68ef85201b106e8f580d3a25b", "url": "https://git.kernel.org/stable/c/f193e71fa9fab2e68ef85201b106e8f580d3a25b" } ], "release_date": "2026-09-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74282", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: prevent snt_unacked underflow on CONN_ACK\n\ntipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count\nfrom the unsigned 16-bit send counter snt_unacked without checking that it\ndoes not exceed the number of messages actually outstanding:\n\n\ttsk->snt_unacked -= msg_conn_ack(hdr);\n\nmsg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK\nmessage. If the ack count is larger than snt_unacked, the subtraction\nwraps to a near-maximum value, leaving tsk_conn_cong() permanently true\nand starving the connection of further transmits.\n\nValidate the ACK count at the start of the CONN_ACK block and drop the\nmessage if it acknowledges more messages than are outstanding. A peer (or,\nfor a local connection, the connected peer socket) can otherwise wedge a\nTIPC connection's send side by sending an oversized connection ack.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74282" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1e2c956745777e6ffdee7f30da5935741c03ee1e", "url": "https://git.kernel.org/stable/c/1e2c956745777e6ffdee7f30da5935741c03ee1e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3388145d258cf2c4c98278e3987296007d30672e", "url": "https://git.kernel.org/stable/c/3388145d258cf2c4c98278e3987296007d30672e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3cfa3d8e0dc167850edeb5bf5a07757db83fd54e", "url": "https://git.kernel.org/stable/c/3cfa3d8e0dc167850edeb5bf5a07757db83fd54e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/47ed873e4ceda34098bd46d8e96b4bb13cad3a04", "url": "https://git.kernel.org/stable/c/47ed873e4ceda34098bd46d8e96b4bb13cad3a04" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/67e55b054bf8025658dc0e255057f2a6236416bd", "url": "https://git.kernel.org/stable/c/67e55b054bf8025658dc0e255057f2a6236416bd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/96f91b8ae1a489b3eca137e7acf42cf985fb8939", "url": "https://git.kernel.org/stable/c/96f91b8ae1a489b3eca137e7acf42cf985fb8939" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ab3e10b44ba5411779aac7afd2477917dd77750f", "url": "https://git.kernel.org/stable/c/ab3e10b44ba5411779aac7afd2477917dd77750f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b44bebdd32c9ff66ee2aebfc317ced44bedd9335", "url": "https://git.kernel.org/stable/c/b44bebdd32c9ff66ee2aebfc317ced44bedd9335" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-97539", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xusbatm: don't rely on id table pointer arithmetic\n\nThe current code is broken when dynamic ID is involved; in such cases\nusb_device_id parameter of probe lives on the heap and the pointer\narithmetic will get an index that is wildly out of bound. xusbatm\ninitialize the USB device IDs dynamically so it can just use driver_info\ntoo.\n\nEven with conversion, xusbatm still cannot support dynamic IDs, so also set\nno_dynamic_id.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97539" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5086f5639197f321b766cec0dce383492eaf2305", "url": "https://git.kernel.org/stable/c/5086f5639197f321b766cec0dce383492eaf2305" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8944ef1bfda537aaf329c82e7a5f9faf61340aa9", "url": "https://git.kernel.org/stable/c/8944ef1bfda537aaf329c82e7a5f9faf61340aa9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eb6cd6d3d8abeac5d7e8251b898067184afdad8a", "url": "https://git.kernel.org/stable/c/eb6cd6d3d8abeac5d7e8251b898067184afdad8a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee4006c2175e8b50ff5d47a54bff52eb29bb1f0d", "url": "https://git.kernel.org/stable/c/ee4006c2175e8b50ff5d47a54bff52eb29bb1f0d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f7db611d98b68d15661561d2cefa774208774ccc", "url": "https://git.kernel.org/stable/c/f7db611d98b68d15661561d2cefa774208774ccc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fad6cab36474758abf55c6419dd79a06a27fcefc", "url": "https://git.kernel.org/stable/c/fad6cab36474758abf55c6419dd79a06a27fcefc" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98772", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix port tear down use-after-free\n\nSome drivers for multiport devices access port driver data from\ncompletion handlers of shared URBs submitted at attach() or first open()\nand stopped at disconnect() or last close(), respectively.\n\nA simple NULL check before accessing the driver data makes sure that a\nport state container has at least been allocated, but a completion\nhandler can still race with port tear down.\n\nReorder the disconnect handling so that ports are not deregistered (and\ntheir driver data freed) until after all ports have been hung up and the\ndriver disconnect() callback has run so that all I/O has been stopped.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98772" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/33c920f7c5952dfc42d1b8ea6efe16b1f0bb0c5b", "url": "https://git.kernel.org/stable/c/33c920f7c5952dfc42d1b8ea6efe16b1f0bb0c5b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5e8980a81af195c49084be5b4c031085b56c7443", "url": "https://git.kernel.org/stable/c/5e8980a81af195c49084be5b4c031085b56c7443" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/60cc9379c3e650d1ebfba4de63f1242537a62a32", "url": "https://git.kernel.org/stable/c/60cc9379c3e650d1ebfba4de63f1242537a62a32" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e4a6883ad9b4686a5f4bd90ff55a44d7ab65bd3c", "url": "https://git.kernel.org/stable/c/e4a6883ad9b4686a5f4bd90ff55a44d7ab65bd3c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e80ee74206f260eb1282e7d1339ff146a4a410d0", "url": "https://git.kernel.org/stable/c/e80ee74206f260eb1282e7d1339ff146a4a410d0" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98568", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use one headroom snapshot for neighbour replies\n\nvxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then\nsamples it again to reserve headroom. A concurrent vxlan_changelink() can\nupdate needed_headroom between the two reads, creating a TOCTOU race. The\nsecond value can exceed the allocation and make the Ethernet header write out\nof bounds.\n\nThe race is reproducible on the unpatched kernel. It occurred when\nvxlan_na_create() generated a neighbour reply while vxlan_changelink() changed\nthe link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte\nskbuff_small_head allocation.\n\nSnapshot the headroom once and use that value for both allocation and\nreservation.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98568" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/315d42ca39f69846662961c25dcf2bb07c350d14", "url": "https://git.kernel.org/stable/c/315d42ca39f69846662961c25dcf2bb07c350d14" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/45a67662bf8ce3aa5643accf98d328dfbb47eaf6", "url": "https://git.kernel.org/stable/c/45a67662bf8ce3aa5643accf98d328dfbb47eaf6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/481506a756dcd828ef42391cb08f38d8d96d38fc", "url": "https://git.kernel.org/stable/c/481506a756dcd828ef42391cb08f38d8d96d38fc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a3c5eb6e382dd426a5e7eb08608897ed57167ff7", "url": "https://git.kernel.org/stable/c/a3c5eb6e382dd426a5e7eb08608897ed57167ff7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff022fd9d0f0282c575e11778b96bd1b637503eb", "url": "https://git.kernel.org/stable/c/ff022fd9d0f0282c575e11778b96bd1b637503eb" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68376", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix auth_hmacs array size in struct sctp_cookie\n\nThe auth_hmacs array in struct sctp_cookie is supposed to store a complete\nSCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr\nfollowed by N HMAC identifiers.\n\nHowever, the array size was calculated using an extra 2 bytes instead of\nsizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers\nare configured, the HMAC-ALGO parameter stored in the endpoint is larger\nthan the auth_hmacs buffer in the cookie.\n\nAs a result, sctp_association_init() copies beyond the end of auth_hmacs\nwhen initializing the association, corrupting the adjacent auth_chunks\nfield. This can lead to an invalid HMAC identifier being accepted and later\ncause an out-of-bounds read in sctp_auth_get_hmac().\n\nFix the array size calculation by including the full SCTP parameter header\nsize.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68376" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0528485f27016a42804abe01aa61b39d85fa803e", "url": "https://git.kernel.org/stable/c/0528485f27016a42804abe01aa61b39d85fa803e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0b4414e43e0861d67276031cc21401d7e87de3da", "url": "https://git.kernel.org/stable/c/0b4414e43e0861d67276031cc21401d7e87de3da" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/317731d01b03c529809df36d3a7d149677a8729d", "url": "https://git.kernel.org/stable/c/317731d01b03c529809df36d3a7d149677a8729d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3aa40c3bccac2312ea7cf97f329190637f972b5d", "url": "https://git.kernel.org/stable/c/3aa40c3bccac2312ea7cf97f329190637f972b5d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db", "url": "https://git.kernel.org/stable/c/a8d20ba0ab518c9ccbcde258f25fc1ee6e51d5db" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0a59ba58578e2b330fff80a44fe519f3ba7d8c7", "url": "https://git.kernel.org/stable/c/d0a59ba58578e2b330fff80a44fe519f3ba7d8c7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e0b5252a59383b77d1b8dbeda00b7184dd95f4d3", "url": "https://git.kernel.org/stable/c/e0b5252a59383b77d1b8dbeda00b7184dd95f4d3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee5e65964f456adfe14d526fba0bd055de98ecf3", "url": "https://git.kernel.org/stable/c/ee5e65964f456adfe14d526fba0bd055de98ecf3" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74394", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: fix integer overflow in immediate data length check\n\nimm_buf->len is a user-controlled uint32_t received from the network.\nAdding it to imm_data_offset without overflow checking allows a\nmalicious initiator to send len=0xFFFFFFFF, causing req_size to wrap\naround to a small value, bypassing the bounds check, and subsequently\npassing a ~4GB length to sg_init_one().\n\nUse check_add_overflow() to detect wrapping before the comparison.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74394" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/067b9556eeb007f28b7c2033b4dcde5b6d88418f", "url": "https://git.kernel.org/stable/c/067b9556eeb007f28b7c2033b4dcde5b6d88418f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/07dec3f6dcb6c6cc891162d252b800eb0e6d5e8e", "url": "https://git.kernel.org/stable/c/07dec3f6dcb6c6cc891162d252b800eb0e6d5e8e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3efa5301137140a3ca3677a9098c0a93a0acfd49", "url": "https://git.kernel.org/stable/c/3efa5301137140a3ca3677a9098c0a93a0acfd49" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/65572fbd86033ae2370125593d59b8be34253aaf", "url": "https://git.kernel.org/stable/c/65572fbd86033ae2370125593d59b8be34253aaf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/72497172a4799119a0282a5eb5e2b8ddcc821921", "url": "https://git.kernel.org/stable/c/72497172a4799119a0282a5eb5e2b8ddcc821921" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c82c860f8c8e4f4f454c9f14d0ad0c0466965f7d", "url": "https://git.kernel.org/stable/c/c82c860f8c8e4f4f454c9f14d0ad0c0466965f7d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dcf7a986f377cce0749ed53f1d64195fbd5fdf91", "url": "https://git.kernel.org/stable/c/dcf7a986f377cce0749ed53f1d64195fbd5fdf91" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eb4ecdf631fe00e8020bf461503cb9b7017ed796", "url": "https://git.kernel.org/stable/c/eb4ecdf631fe00e8020bf461503cb9b7017ed796" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2022-48792", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task\n\nCurrently a use-after-free may occur if a sas_task is aborted by the upper\nlayer before we handle the I/O completion in mpi_ssp_completion() or\nmpi_sata_completion().\n\nIn this case, the following are the two steps in handling those I/O\ncompletions:\n\n - Call complete() to inform the upper layer handler of completion of\n the I/O.\n\n - Release driver resources associated with the sas_task in\n pm8001_ccb_task_free() call.\n\nWhen complete() is called, the upper layer may free the sas_task. As such,\nwe should not touch the associated sas_task afterwards, but we do so in the\npm8001_ccb_task_free() call.\n\nFix by swapping the complete() and pm8001_ccb_task_free() calls ordering.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-48792" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d9d93f32534a0a80a1c26bdb0746d90a7b19c2c2", "url": "https://git.kernel.org/stable/c/d9d93f32534a0a80a1c26bdb0746d90a7b19c2c2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/df7abcaa1246e2537ab4016077b5443bb3c09378", "url": "https://git.kernel.org/stable/c/df7abcaa1246e2537ab4016077b5443bb3c09378" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f61f9fccb2cb4bb275674a79d638704db6bc2171", "url": "https://git.kernel.org/stable/c/f61f9fccb2cb4bb275674a79d638704db6bc2171" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fe9ac3eaa2e387a5742b380b73a5a6bc237bf184", "url": "https://git.kernel.org/stable/c/fe9ac3eaa2e387a5742b380b73a5a6bc237bf184" } ], "release_date": "2024-07-16T11:43:48Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89655", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock\n\nlist_for_each_entry() iterates ci->i_cap_flush_list but drops\ni_ceph_lock to send cap messages. During the unlock window,\nhandle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries\nwith tid <= flush_tid from the list, release i_ceph_lock, and free\nthem via ceph_free_cap_flush() outside any lock. When the original\nthread reacquires i_ceph_lock and the for-loop macro advances via\ncf = list_next_entry(cf, i_list), it dereferences cf->i_list.next\non freed memory.\n\nThe race timeline:\n\n __kick_flushing_caps() handle_cap_flush_ack()\n ----------------------- -----------------------\n holds i_ceph_lock <---\n iterates to cf (tid=10)\n prepares FLUSH message\n drops i_ceph_lock <---\n __send_cap() ── FLUSH(tid=10)\n\t MDS sends FLUSH_ACK(tid=10)\n ---> acquires i_ceph_lock\n cf->tid(10) <= flush_tid(10),\n detaches cf from i_cap_flush_list\n drops i_ceph_lock\n ceph_free_cap_flush(cf) <- frees it!\n acquires i_ceph_lock <---\n for-loop advances:\n cf = list_next_entry(cf, i_list)\n -- UAF on freed cf->i_list.next\n\nThe cf was just sent by __kick_flushing_caps itself via __send_cap().\nThe MDS may respond with FLUSH_ACK quickly enough that\nhandle_cap_flush_ack() frees cf before __kick_flushing_caps can\nfinish the iteration.\n\nFix by converting to a manual while loop: save the next pointer\nunder i_ceph_lock before dropping it, then use the saved pointer\nafter reacquiring, so the potentially-freed cf is never accessed again.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89655" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/01542430081014d80fc9e70e92d6647432ddb7fc", "url": "https://git.kernel.org/stable/c/01542430081014d80fc9e70e92d6647432ddb7fc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/091137821e1fc88f37e15201abf055c9494ddc61", "url": "https://git.kernel.org/stable/c/091137821e1fc88f37e15201abf055c9494ddc61" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/19f16f04c2b014a7dd214dc1e42557d8530b16f3", "url": "https://git.kernel.org/stable/c/19f16f04c2b014a7dd214dc1e42557d8530b16f3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/23eb34a53a53cb1a6dab1eeee830633207ac158d", "url": "https://git.kernel.org/stable/c/23eb34a53a53cb1a6dab1eeee830633207ac158d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2701431aa3cc8b23efe6890182e7b04f5e76fab5", "url": "https://git.kernel.org/stable/c/2701431aa3cc8b23efe6890182e7b04f5e76fab5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2dba24dcd5050be4b7b119e6f0b01f62203b5d26", "url": "https://git.kernel.org/stable/c/2dba24dcd5050be4b7b119e6f0b01f62203b5d26" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7af4c4f01305b0935adf6d4301b1ec407025485d", "url": "https://git.kernel.org/stable/c/7af4c4f01305b0935adf6d4301b1ec407025485d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fe46746087b5b9c5bb2d022df6c7819218494ced", "url": "https://git.kernel.org/stable/c/fe46746087b5b9c5bb2d022df6c7819218494ced" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89847", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Avoid double completion in async IOCB timeout\n\nqla2x00_async_iocb_timeout() tries to abort a timed-out async IOCB. When\nqla24xx_async_abort_cmd() fails, both the SRB_LOGIN_CMD path and the\nSRB_CTRL_VP/default path scan outstanding_cmds[] for the SRB and then\ncall sp->done(sp, QLA_FUNCTION_TIMEOUT) unconditionally, without checking\nwhether the SRB was actually found and removed.\n\nIf the response ISR completes the same handle first, it removes the SRB\nunder qp_lock_ptr and runs sp->done() -> complete(sp->comp). The\nsubmitter qla24xx_control_vp() wakes from wait_for_completion(), clears\nsp->comp, drops its reference and returns, reclaiming the on-stack\ncompletion. The timer reference keeps the SRB alive across the timeout\nhandler, but not the submitter's stack. The timeout then issues a second\nsp->done() -> qla_ctrlvp_sp_done(), which evaluates \"if (sp->comp)\ncomplete(sp->comp)\"; with the pointer loaded before the submitter's NULL\nstore, complete() writes into the freed stack frame, a use-after-free.\n\nTrack whether this path removed the SRB from outstanding_cmds and only\ncall sp->done() when it did, so the command is completed exactly once by\nwhichever path owns it. This mirrors the sp_found guard already used in\nqla24xx_abort_iocb_timeout().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89847" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6e217a9482eabbd8b29847be334c74cf468d3544", "url": "https://git.kernel.org/stable/c/6e217a9482eabbd8b29847be334c74cf468d3544" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/71a7b6e3c7f121439f51a058e53d4a8e05b63dec", "url": "https://git.kernel.org/stable/c/71a7b6e3c7f121439f51a058e53d4a8e05b63dec" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7257b5e1fb6c9387714f66e01b79ec82b717eede", "url": "https://git.kernel.org/stable/c/7257b5e1fb6c9387714f66e01b79ec82b717eede" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/845d4abd92cd2f97551356c8b281ad6e197acb07", "url": "https://git.kernel.org/stable/c/845d4abd92cd2f97551356c8b281ad6e197acb07" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9fa1d71233a82416492d9c9de9756ebe140fe714", "url": "https://git.kernel.org/stable/c/9fa1d71233a82416492d9c9de9756ebe140fe714" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bb45bc4bd53c95a7bf6f782577b5ede94c0f8aa8", "url": "https://git.kernel.org/stable/c/bb45bc4bd53c95a7bf6f782577b5ede94c0f8aa8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d6d856c722f40f0694ff755208552e658db6dd42", "url": "https://git.kernel.org/stable/c/d6d856c722f40f0694ff755208552e658db6dd42" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f5b660e0b0d9190d8853c795c2522cc5f8c93003", "url": "https://git.kernel.org/stable/c/f5b660e0b0d9190d8853c795c2522cc5f8c93003" } ], "release_date": "2026-09-16T11:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-26872", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Do not register event handler until srpt device is fully setup\n\nUpon rare occasions, KASAN reports a use-after-free Write\nin srpt_refresh_port().\n\nThis seems to be because an event handler is registered before the\nsrpt device is fully setup and a race condition upon error may leave a\npartially setup event handler in place.\n\nInstead, only register the event handler after srpt device initialization\nis complete.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-26872" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6413e78086caf7bf15639923740da0d91fdfd090", "url": "https://git.kernel.org/stable/c/6413e78086caf7bf15639923740da0d91fdfd090" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7104a00fa37ae898a827381f1161fa3286c8b346", "url": "https://git.kernel.org/stable/c/7104a00fa37ae898a827381f1161fa3286c8b346" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/85570b91e4820a0db9d9432098778cafafa7d217", "url": "https://git.kernel.org/stable/c/85570b91e4820a0db9d9432098778cafafa7d217" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bdd895e0190c464f54f84579e7535d80276f0fc5", "url": "https://git.kernel.org/stable/c/bdd895e0190c464f54f84579e7535d80276f0fc5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c21a8870c98611e8f892511825c9607f1e2cd456", "url": "https://git.kernel.org/stable/c/c21a8870c98611e8f892511825c9607f1e2cd456" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e362d007294955a4fb929e1c8978154a64efdcb6", "url": "https://git.kernel.org/stable/c/e362d007294955a4fb929e1c8978154a64efdcb6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ec77fa12da41260c6bf9e060b89234b980c5130f", "url": "https://git.kernel.org/stable/c/ec77fa12da41260c6bf9e060b89234b980c5130f" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "release_date": "2024-04-17T11:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-99082", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use active memslots for the per-vCPU MMIO cache\n\nKVM tags the per-vCPU MMIO cache with a memslot generation so that a\nmemslot update invalidates cached MMIO information. Both the fill and\nvalidation paths use kvm_memslots(), which unconditionally selects address\nspace 0, even when the vCPU is running in SMM and using address space 1.\n\nCommit 56f17dd3fbc4 (\"kvm: x86: fix stale mmio cache bug\") added the\nmemslot generation to the cache key so that a memslot update could not\nleave a stale entry valid. When commit 699023e23965 (\"KVM: x86: add SMM\nto the MMU role, support SMRAM address space\") added the SMM address space,\nthese helpers were not converted to use the active memslots.\n\nConsequently, an update to the SMM memslots can leave an entry from the old\nSMM address space apparently valid after the vCPU returns to the normal\naddress space. A guest can then cause an access to valid RAM at the same\nGFN to be returned to userspace as KVM_EXIT_MMIO.\n\nCompleting that exit through the VMM's RAM address space writes the backing\npage without going through KVM's write-tracking path. If the page backs a\nnested EPT table, KVM can continue using shadow translations derived from\nthe old contents. The WARN_ON_ONCE() in kvm_mmu_write_protect_fault()\ncatches this invalid cache and memslot combination.\n\nUse the vCPU's active memslots when caching and validating the entry.\nMemslot generations are unique across address spaces, so the generation\nalso distinguishes the normal and SMM views. This matches the MMIO SPTE\ncache, which already uses kvm_vcpu_memslots().\n\nOn an unpatched current-mainline kernel, a regression test that fills the\ncache in SMM and updates only the SMM memslots fails the intended RAM write\nand triggers the kvm_mmu_write_protect_fault() warning. With this change,\nthe same test completes the RAM write without a warning. The x86/smm_test,\nset_memory_region_test, and memslot_modification_stress_test selftests also\npass.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-99082" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312", "url": "https://git.kernel.org/stable/c/2566780c684c9c21241d409d790087c73070f312" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd", "url": "https://git.kernel.org/stable/c/7fd4e64f4bbc8c35ae8f0d2a1fb5b77a76d5b4fd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876", "url": "https://git.kernel.org/stable/c/a63f79d9da9468952396af73e1e53330845cf876" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b3e6212dea2e4328a841ceb37f377583176dc735", "url": "https://git.kernel.org/stable/c/b3e6212dea2e4328a841ceb37f377583176dc735" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e792a9ace39d2812a5b342a1987186c7bc653204", "url": "https://git.kernel.org/stable/c/e792a9ace39d2812a5b342a1987186c7bc653204" } ], "release_date": "2026-10-23T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-80681", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: re-fetch eth header after route_shortcircuit()\n\nBefore route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb).\n\nInside route_shortcircuit(), pskb_may_pull() can be called, which may\nreallocate skb->head.\n\nIn this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to\nfreed memory, leading to a use-after-free when dereferencing eth->h_dest.\n\nFix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80681" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1235e017aa11cf01e91b613c4c5ed6aa28934fff", "url": "https://git.kernel.org/stable/c/1235e017aa11cf01e91b613c4c5ed6aa28934fff" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1395a676ec15a0a02a2a6d86602324f2d5fd41d5", "url": "https://git.kernel.org/stable/c/1395a676ec15a0a02a2a6d86602324f2d5fd41d5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585", "url": "https://git.kernel.org/stable/c/1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1b7f7b653e3557690047c62f03b80a24ea5a58a5", "url": "https://git.kernel.org/stable/c/1b7f7b653e3557690047c62f03b80a24ea5a58a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2355c8c26d2aa1b4385b369e67202e47d460d555", "url": "https://git.kernel.org/stable/c/2355c8c26d2aa1b4385b369e67202e47d460d555" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6375093eb45cd7d89f1945f939eeae3b29d79f56", "url": "https://git.kernel.org/stable/c/6375093eb45cd7d89f1945f939eeae3b29d79f56" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bf045341dfb3e767f0ff94cf240ce3c371973bd4", "url": "https://git.kernel.org/stable/c/bf045341dfb3e767f0ff94cf240ce3c371973bd4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c9dceac9e1c7c772c43c732fc0d325e72835801a", "url": "https://git.kernel.org/stable/c/c9dceac9e1c7c772c43c732fc0d325e72835801a" } ], "release_date": "2026-08-28T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98827", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE\n\n__hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a\nsingle tx_buf of MAX_TX_BUF_SIZE (32768) bytes, limiting the batch\nby record count but never by cumulative byte length.\n\nWith large frames (MTU 2304), 20 aggregated frames of 2292 bytes\neach exceed the allocation (20 * 2296 = 45920 bytes), so the\nmemcpy() in the loop writes up to 13152 bytes past tx_buf->buf\nbefore usb_submit_urb().\n\nPeek the queue head and stop before copying any record that would\ncross MAX_TX_BUF_SIZE, then dispatch the current batch. Leftover\nskbs remain queued and are drained on the next URB completion.\n\nThe byte bound changes the loop's exit semantics: it can now exit\nbefore i == tx_skb_cnt - 1. Stock only finalized tx_buf->len on\nthat last index (len += offset), so an early break would submit a\nURB holding only the last record's length while every dequeued skb\nis freed on completion, silently dropping frames. Make tx_buf->len\na running total and advance tx_buf->offset per record instead; the\nstride round_up(nskb->len + 4, 4) is identical to the stock stride\nwhen the loop runs to completion.\n\nTested on hardware with an MTU 2304 flood: the loop stops at\nrecord 15 (len = 32144, offset = 32144, within 32768), no\noversized URB is submitted, and MTU 1500 pings pass 20/20.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98827" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/345ce265cf604e84b5b560c21beaf4c6f269ab14", "url": "https://git.kernel.org/stable/c/345ce265cf604e84b5b560c21beaf4c6f269ab14" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aeaca27c1db3106967ffbb2b517d98c835f6d500", "url": "https://git.kernel.org/stable/c/aeaca27c1db3106967ffbb2b517d98c835f6d500" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c18882768a0fe253c70986c5fe66d9241570fbc4", "url": "https://git.kernel.org/stable/c/c18882768a0fe253c70986c5fe66d9241570fbc4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e73a619f91b6cfec47bc1a94aea28df6849e5be3", "url": "https://git.kernel.org/stable/c/e73a619f91b6cfec47bc1a94aea28df6849e5be3" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-64582", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix a use-after-free problem in rxe_mmap\n\nrxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list\nand releases pending_lock while the struct's kref is still at 1:\n\n list_del_init(&ip->pending_mmaps);\n spin_unlock_bh(&rxe->pending_lock); /* ref == 1, no lock held */\n ret = remap_vmalloc_range(vma, ip->obj, 0); /* walks PTEs */\n [...]\n rxe_vma_open(vma); /* kref_get, ref → 2 */\n remap_vmalloc_range_partial() walks PTEs without any lock.\n\nA concurrent DESTROY_CQ ioctl on another CPU calls:\n\n kref_put(&q->ip->ref, rxe_mmap_release) /* ref 1→0 */\n vfree(ip->obj) /* clears vmalloc PTEs mid-walk */\n kfree(ip) /* frees rxe_mmap_info */\n\nThis yields:\n\n 1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the\n per-PTE race -> vm_insert_page(NULL) → GPF in validate_page_before_insert\n\n 2. Page UAF, vmalloc_to_page() reads a stale PTE before vfree clears\n it. User VMA holds a PTE to a free'd page which might eventually get\n reallocated later by vmalloc which allows the attacker to get a clean\n page-level UAF.\n\n It is worth noting that even though a page-level UAF is possible given\n the strong primitive, it is statistically very difficult to achieve\n given the very short time window (after the last insert_page and before\n the kref_get).\n\nThe call trace are as below:\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n CPU: 0 UID: 1000 PID: 413 Comm: poc Not tainted 7.0.0-rc5-dirty #28 PREEMPT(lazy)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n RIP: 0010:validate_page_before_insert+0x32/0x300\n Code: e5 41 57 41 56 49 89 fe 41 55 41 54 53 48 89 f3 e8 93 b5 a3 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 7b 02 00 00 4c 8b 63 08 31 ff 4d 89 e5 41 83 e5\n RSP: 0018:ffff88811b15f2f0 EFLAGS: 00000202\n RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000008\n RBP: ffff88811b15f318 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881181eee00\n R13: 0000000000000000 R14: ffff8881181eee00 R15: ffff8881181eee20\n FS: 00007b1e000f76c0(0000) GS:ffff8884268e0000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007b1e00a24ac0 CR3: 0000000116eb3000 CR4: 00000000000006f0\n Call Trace:\n \n insert_page+0x8f/0x190\n ? __pfx_insert_page+0x10/0x10\n ? kasan_save_alloc_info+0x38/0x60\n vm_insert_page+0x2e7/0x400\n remap_vmalloc_range_partial+0x212/0x3e0\n remap_vmalloc_range+0x6e/0xb0\n ? __kasan_check_write+0x14/0x30\n rxe_mmap+0x2e9/0x5d0\n ib_uverbs_mmap+0x1ad/0x2c0\n __mmap_region+0x12c2/0x2ad0\n ? __pfx___mmap_region+0x10/0x10\n ? __sanitizer_cov_trace_switch+0x58/0xb0\n ? mas_prev_slot+0x360/0x39c0\n ? __sanitizer_cov_trace_switch+0x58/0xb0\n ? mas_next_slot+0x1e5b/0x2f40\n ? __sanitizer_cov_trace_cmp8+0x18/0x30\n ? unmapped_area_topdown+0x4dd/0x610\n ? kfree+0x1b1/0x440\n ? free_cpumask_var+0x16/0x30\n ? __kasan_slab_free+0x7d/0xa0\n ? __sanitizer_cov_trace_cmp8+0x18/0x30\n mmap_region+0x2e6/0x3c0\n do_mmap+0xa3e/0x12a0\n ? __pfx_do_mmap+0x10/0x10\n ? __kasan_check_write+0x14/0x30\n ? down_write_killable+0xba/0x160\n ? __pfx_down_write_killable+0x10/0x10\n ? __sanitizer_cov_trace_cmp4+0x16/0x30\n vm_mmap_pgoff+0x2d4/0x4a0\n ? __pfx_vm_mmap_pgoff+0x10/0x10\n ? fget+0x1bf/0x270\n ksys_mmap_pgoff+0x40c/0x690\n ? __sanitizer_cov_trace_const_cmp4+0x16/0x30\n ? __pfx_ksys_mmap_pgoff+0x10/0x10\n ? __kasan_check_write+0x14/0x30\n ? _raw_spin_trylock+0xbb/0x130\n ? __pfx__raw_spin_trylock+0x10/0x10\n __x64_sys_mmap+0x135/0x1e0\n x64_sys_c\n---truncated---", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64582" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3371f2036e0f970166bbb624e25bba46d32fa18e", "url": "https://git.kernel.org/stable/c/3371f2036e0f970166bbb624e25bba46d32fa18e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3525987a392536f31a484833af258971af63b24c", "url": "https://git.kernel.org/stable/c/3525987a392536f31a484833af258971af63b24c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/35744ab3d03c5fca8c1752f53fc8fc674e14c561", "url": "https://git.kernel.org/stable/c/35744ab3d03c5fca8c1752f53fc8fc674e14c561" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/665fb7d22a700c66a78db0cf88c6e6a649aba9d0", "url": "https://git.kernel.org/stable/c/665fb7d22a700c66a78db0cf88c6e6a649aba9d0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aef5ea8578f97f2701039600846a8bcf5f21e863", "url": "https://git.kernel.org/stable/c/aef5ea8578f97f2701039600846a8bcf5f21e863" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b810352d0916796dabe633cdb9adee9863ab4911", "url": "https://git.kernel.org/stable/c/b810352d0916796dabe633cdb9adee9863ab4911" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e", "url": "https://git.kernel.org/stable/c/e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6", "url": "https://git.kernel.org/stable/c/e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6" } ], "release_date": "2026-08-05T12:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-90011", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Reserve a terminator byte for the login payload\n\niscsi_target_check_login_request() rejects a login PDU whose\nDataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and\nlogin->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS\nbytes. Since iscsit_get_login_rx() receives payload_length + padding\nbytes, where\n\n\tpadding = ((-payload_length) & 3);\n\nany payload_length from 8189 to 8192 fills the whole 8192 byte\nbuffer. The write stays in bounds, but no byte is left for a NUL\nterminator.\n\nThe buffer is subsequently consumed as a C string. In the CHAP path\nchap_check_algorithm() calls kstrdup(a_str), and extract_param() calls\nstrstr(in_buf, pattern) followed by strlen_semi(), none of which take a\nlength. convert_null_to_semi() additionally rewrites every embedded NUL\nto ';', so even a payload made of well formed NUL separated key=value\nrecords is left without a terminator. These walk past the end of the\nobject into adjacent slab memory. It is reachable by an unauthenticated\ninitiator against a portal configured for CHAP; when authentication is\nnot required iscsi_login_zero_tsih_s2() rewrites AuthMethod to None and\nthe CHAP path is never entered.\n\nAllocate one extra byte. kzalloc() zeroes it and nothing ever writes to\nit, as every writer copies to offset 0 for at most MAX_KEY_VALUE_PAIRS\nbytes, so the buffer is always terminated.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90011" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1624bff4c5118ad494d50ad94d44f22064667a7f", "url": "https://git.kernel.org/stable/c/1624bff4c5118ad494d50ad94d44f22064667a7f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3ddf3ea291a0ef2ea93b82e158960ac2cc42302b", "url": "https://git.kernel.org/stable/c/3ddf3ea291a0ef2ea93b82e158960ac2cc42302b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5fac79f248c37774d1dd761406f83d25ca6ff8e4", "url": "https://git.kernel.org/stable/c/5fac79f248c37774d1dd761406f83d25ca6ff8e4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076", "url": "https://git.kernel.org/stable/c/6b589ef9d5f6cdc70d2b4f269ca6cf26b5ebb076" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6ddddcad436d8e6e619204d3c848147ff2f5bf1e", "url": "https://git.kernel.org/stable/c/6ddddcad436d8e6e619204d3c848147ff2f5bf1e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b19dc17ed963ac36c0db4b52a1803fb11169f91f", "url": "https://git.kernel.org/stable/c/b19dc17ed963ac36c0db4b52a1803fb11169f91f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eb9dadf4d552ebe10644871c5189286552aa48f5", "url": "https://git.kernel.org/stable/c/eb9dadf4d552ebe10644871c5189286552aa48f5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f4825922d2fb371e2b969697d792077f1b62b62c", "url": "https://git.kernel.org/stable/c/f4825922d2fb371e2b969697d792077f1b62b62c" } ], "release_date": "2026-09-16T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-64009", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n install an IPv4 ESP tunnel SA with a large authentication key\n (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n large value. When a single UDP datagram is then sent through the\n tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n esp_output() consumes it as a signed int via:\n\n padto = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))\n esp.tfclen = padto - skb->len (assigned to int)\n\n esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n when passed to memset() inside esp_output_fill_trailer(), producing a\n ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64009" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93", "url": "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed", "url": "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789", "url": "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90", "url": "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3", "url": "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda", "url": "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2", "url": "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0", "url": "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0" } ], "release_date": "2026-07-19T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98276", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lock the socket in sock_gettstamp()\n\nsk->sk_flags must only be changed while holding the socket lock,\nbecause sock_set_flag() and sock_reset_flag() use non atomic\noperations (__set_bit() and __clear_bit()).\n\nsock_gettstamp() is one of the last places where a bit of sk->sk_flags\nis changed from a syscall without owning the socket lock, through\nsock_enable_timestamp(sk, SOCK_TIMESTAMP).\n\nsk_set_memalloc() and sk_clear_memalloc() also change sk->sk_flags\nwithout the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp,\nsunrpc, wireguard) need a careful audit, this will be addressed in a\nseparate patch.\n\nJungwoo Lee and Wongi Lee reported an UDP socket use-after-free\ncaused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind()\ncan cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set,\nbecause both threads perform a read-modify-write on the same word.\n\n CPU 0 (bind) CPU 1 (SIOCGSTAMPNS_NEW)\n -------------------------------- ----------------------------\n read sk_flags = F read sk_flags = F\n compute F | BIT(SOCK_RCU_FREE) compute F | BIT(SOCK_TIMESTAMP)\n store F | BIT(SOCK_RCU_FREE)\n sk_add_node_rcu(sk, ...)\n store F | BIT(SOCK_TIMESTAMP)\n\nAfter the lost update, SOCK_RCU_FREE is clear while the socket is\nvisible to lockless UDP receive lookups. sk_destruct() then frees\nthe socket immediately instead of waiting for a RCU grace period,\nwhile the receive path still holds a reference-less pointer to it:\n\n BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410\n Read of size 8 at addr ffff888008806610 by task exploit/207\n CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1\n ipv4_pktinfo_prepare+0x30/0x410\n udp_queue_rcv_one_skb+0x51c/0x1180\n udp_unicast_rcv_skb+0x109/0x350\n ip_protocol_deliver_rcu+0x14b/0x310\n ip_local_deliver_finish+0x29d/0x390\n ip_local_deliver+0x24d/0x2a0\n\nOnly grab the socket lock when SOCK_TIMESTAMP has to be set,\nto keep the common case lockless.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98276" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f", "url": "https://git.kernel.org/stable/c/17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/18899e2e4023369a8f7739c2255a59a9748d8d17", "url": "https://git.kernel.org/stable/c/18899e2e4023369a8f7739c2255a59a9748d8d17" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1f73253add8365d0dad0a4f421acaa8c21d20cef", "url": "https://git.kernel.org/stable/c/1f73253add8365d0dad0a4f421acaa8c21d20cef" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b12d3967e96f1b7b977d9fc352ae29a1b299a82", "url": "https://git.kernel.org/stable/c/3b12d3967e96f1b7b977d9fc352ae29a1b299a82" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/88c804847dd87dc613b771b392ccecdb94725032", "url": "https://git.kernel.org/stable/c/88c804847dd87dc613b771b392ccecdb94725032" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/899650bbf985b7bfd2a7b808357df9b16e6d6959", "url": "https://git.kernel.org/stable/c/899650bbf985b7bfd2a7b808357df9b16e6d6959" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9ed55f3dbef4f4adfe65eb03b0c35c53229a8490", "url": "https://git.kernel.org/stable/c/9ed55f3dbef4f4adfe65eb03b0c35c53229a8490" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d9f96bc2d822501f84d1caa6275a2c6b316ca2c4", "url": "https://git.kernel.org/stable/c/d9f96bc2d822501f84d1caa6275a2c6b316ca2c4" } ], "release_date": "2026-10-06T09:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-23204", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: use skb_header_pointer_careful()\n\nskb_header_pointer() does not fully validate negative @offset values.\n\nUse skb_header_pointer_careful() instead.\n\nGangMin Kim provided a report and a repro fooling u32_classify():\n\nBUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0\nnet/sched/cls_u32.c:221", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-23204" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/13336a6239b9d7c6e61483017bb8bdfe3ceb10a5", "url": "https://git.kernel.org/stable/c/13336a6239b9d7c6e61483017bb8bdfe3ceb10a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/29681ed51e737be14d18ecd1c304c57002e4b72c", "url": "https://git.kernel.org/stable/c/29681ed51e737be14d18ecd1c304c57002e4b72c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/66e4b63d61c15de6ca5332d9ca6db59a404d7136", "url": "https://git.kernel.org/stable/c/66e4b63d61c15de6ca5332d9ca6db59a404d7136" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8a672f177ebe19c93d795fbe967846084fbc7943", "url": "https://git.kernel.org/stable/c/8a672f177ebe19c93d795fbe967846084fbc7943" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cabd1a976375780dabab888784e356f574bbaed8", "url": "https://git.kernel.org/stable/c/cabd1a976375780dabab888784e356f574bbaed8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cfa745830e45ecb75c061aa34330ee0cac941cc7", "url": "https://git.kernel.org/stable/c/cfa745830e45ecb75c061aa34330ee0cac941cc7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e41a23e61259f5526af875c3b86b3d42a9bae0e5", "url": "https://git.kernel.org/stable/c/e41a23e61259f5526af875c3b86b3d42a9bae0e5" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" } ], "release_date": "2026-02-14T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-23307", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-23307" }, { "category": "external", "summary": "https://bugzilla.openanolis.cn/show_bug.cgi?id=7975", "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=7975" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "release_date": "2024-01-25T07:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-53494", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: xts - Handle EBUSY correctly\n\nAs it is xts only handles the special return value of EINPROGRESS,\nwhich means that in all other cases it will free data related to the\nrequest.\n\nHowever, as the caller of xts may specify MAY_BACKLOG, we also need\nto expect EBUSY and treat it in the same way. Otherwise backlogged\nrequests will trigger a use-after-free.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-53494" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/51c082514c2dedf2711c99d93c196cc4eedceb40", "url": "https://git.kernel.org/stable/c/51c082514c2dedf2711c99d93c196cc4eedceb40" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/57c3e1d63b63dc0841d41df729297cd7c1c35808", "url": "https://git.kernel.org/stable/c/57c3e1d63b63dc0841d41df729297cd7c1c35808" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/912eb10b65646ffd222256c78a1c566a3dac177d", "url": "https://git.kernel.org/stable/c/912eb10b65646ffd222256c78a1c566a3dac177d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/92a07ba4f0af2cccdc2aa5ee32679c9c9714db90", "url": "https://git.kernel.org/stable/c/92a07ba4f0af2cccdc2aa5ee32679c9c9714db90" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d5870848879291700fe6c5257dcb48aadd10425c", "url": "https://git.kernel.org/stable/c/d5870848879291700fe6c5257dcb48aadd10425c" } ], "release_date": "2025-10-01T11:45:45Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98548", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: discard the rest of the packet on a stale-cookie error\n\nWhen an association is in COOKIE-ECHOED state and the peer sends a\nbundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary\naddresses, processing the ERROR chunk takes the non-fatal stale-cookie\nretry path sctp_sf_do_5_2_6_stale(), which queues\nSCTP_CMD_DEL_NON_PRIMARY while keeping the association alive.\nsctp_cmd_del_non_primary() removes every non-primary transport -\nincluding the very transport this packet arrived on, which is still\nreferenced by the receive lookup and shared by all chunks of the\npacket via chunk->transport.\n\nsctp_assoc_rm_peer() does redirect asoc->peer.last_data_from away from\nthe removed transport, but right afterwards the bundled DATA chunk\nmakes sctp_assoc_bh_rcv() re-register\nasoc->peer.last_data_from = chunk->transport unconditionally, undoing\nthe redirection with the just-removed transport.\n\nOnce the packet is done, the receive reference is dropped and the\ntransport is RCU-freed, while the surviving association keeps the\ndangling last_data_from. A later FWD-TSN (or the delayed SACK timer)\nmakes sctp_gen_sack() dereference it (->param_flags and friends), and\nsctp_make_sack()/sctp_outq_select_transport() may write to the freed\nobject and link it into the live transport list. This is a\nuse-after-free triggerable by any malicious SCTP peer (or a local\nunprivileged user acting as one) with no capabilities required:\n\n BUG: KASAN: slab-use-after-free in sctp_do_sm+0x498a/0x5660\n Read of size 4 at addr ffff88800e1e356c by task poc/115\n Call Trace: sctp_do_sm <- sctp_assoc_bh_rcv <- sctp_inq_push <-\n sctp_rcv <- ip_protocol_deliver_rcu <- ip_rcv\n Allocated: sctp_transport_new <- sctp_assoc_add_peer <-\n sctp_process_init (INIT-ACK processing)\n Freed: kfree <- sctp_transport_destroy_rcu <- rcu_core\n (call_rcu queued by sctp_transport_put at end of sctp_rcv)\n The buggy address is located 364 bytes inside of freed 1024-byte\n region [ffff88800e1e3400, ffff88800e1e3800), cache kmalloc-1k\n\nNote that commit 03a9d10ecf71 (\"sctp: drop a chunk if its transport\nwas removed\") only covers the window between the receive lookup and\nthe chunk processing (e.g. an ASCONF DEL-IP racing the socket backlog);\nhere the transport is removed *while* the packet is being processed,\nby an earlier chunk of the same packet, so the drop in sctp_inq_push()\ndoes not reach this path. Verified with the bundled [ERROR(Stale\nCookie)][DATA] + FWD-TSN reproducer: the KASAN report above still\nfires with that commit applied, and is gone with this patch on top.\n\nFix it by discarding the rest of the packet on this path, as suggested\nby Xin. After the stale-cookie ERROR has sent the association back to\nCOOKIE-WAIT and removed the non-primary transports, the remaining\nchunks of the packet can only run against the restarted handshake\nwhile referencing the removed arrival transport through\nchunk->transport: besides the last_data_from registration above,\nsctp_cmd_setup_t2() and the sctp_make_*() reply builders would also\ncopy that pointer into association-lifetime state that\nsctp_assoc_rm_peer() has already sanitized. Let the peer retransmit\nthem, in line with what sctp_inq_push() does for chunks whose\ntransport was removed before processing.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98548" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1cd246b214dc9acf4e2f11d58c035e1e672fe7d2", "url": "https://git.kernel.org/stable/c/1cd246b214dc9acf4e2f11d58c035e1e672fe7d2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4498467a8af06cfa3d71cb04bd7c4170dec8f449", "url": "https://git.kernel.org/stable/c/4498467a8af06cfa3d71cb04bd7c4170dec8f449" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6df536c5acbc0abd6f119d02e24f4a2ed97707f4", "url": "https://git.kernel.org/stable/c/6df536c5acbc0abd6f119d02e24f4a2ed97707f4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/854c053c71459f8db7ef07db9cfa4eec5f5206f2", "url": "https://git.kernel.org/stable/c/854c053c71459f8db7ef07db9cfa4eec5f5206f2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/965e21ea16acb394d5e5801998ca9b0adc669665", "url": "https://git.kernel.org/stable/c/965e21ea16acb394d5e5801998ca9b0adc669665" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a", "url": "https://git.kernel.org/stable/c/c0af3fd150fdc43821df3bb77e5ec74faf4dfc7a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d68c9287b3ca0d6faadc61fbcb18d1a6b5493321", "url": "https://git.kernel.org/stable/c/d68c9287b3ca0d6faadc61fbcb18d1a6b5493321" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ec23855274a73906b02f0d124fefd9cb3c008b1d", "url": "https://git.kernel.org/stable/c/ec23855274a73906b02f0d124fefd9cb3c008b1d" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-72406", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sungem: fix probe error cleanup\n\ngem_init_one() calls gem_remove_one() when register_netdev() fails.\ngem_remove_one() unregisters and frees resources owned by the net_device,\nincluding the DMA block, MMIO mapping, PCI regions, and the net_device\nitself. gem_init_one() then falls through to its own cleanup labels and\nfrees the same resources again.\n\nKeep the register_netdev() error path in gem_init_one(): clear drvdata so\nPM/remove paths do not see a half-registered device, remove the NAPI\ninstance added during probe, and let the existing cleanup labels release\nthe resources once.\n\nThe issue was found by a local static-analysis checker for probe error\npaths. The reported path was manually inspected before sending this fix.\n\nCompile-tested with CONFIG_SUNGEM=y. Runtime testing was not performed\nbecause no sungem hardware is available.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72406" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/331c99029a1cee1111f82f63d15b3cdebefbd341", "url": "https://git.kernel.org/stable/c/331c99029a1cee1111f82f63d15b3cdebefbd341" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/36dea2f639249460d13f6ca66b2a9064187cd34d", "url": "https://git.kernel.org/stable/c/36dea2f639249460d13f6ca66b2a9064187cd34d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a63eaf7605d1579cf3f551792e478cfaf5ac37d1", "url": "https://git.kernel.org/stable/c/a63eaf7605d1579cf3f551792e478cfaf5ac37d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b15a3cc68e2450aa0edd94a74a7bdd45fcc17dd9", "url": "https://git.kernel.org/stable/c/b15a3cc68e2450aa0edd94a74a7bdd45fcc17dd9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bc49e8746584564dba47d963d1916cc876fc6f6b", "url": "https://git.kernel.org/stable/c/bc49e8746584564dba47d963d1916cc876fc6f6b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1d04fefb0c2a2de32d9cee22cdc2088be3758d1", "url": "https://git.kernel.org/stable/c/f1d04fefb0c2a2de32d9cee22cdc2088be3758d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f3bd60b26814b7c3c57c629abb0857dfc76d214a", "url": "https://git.kernel.org/stable/c/f3bd60b26814b7c3c57c629abb0857dfc76d214a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fb73cdc50b6755e5c3a80a195b2708a39ada0230", "url": "https://git.kernel.org/stable/c/fb73cdc50b6755e5c3a80a195b2708a39ada0230" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89972", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: add missing SRCU grace period in error path\n\nnvme_alloc_ns() error path at out_unlink_ns removes ns from the\nnamespace head siblings list with list_del_rcu(&ns->siblings) but\ndoes not wait for SRCU readers before freeing the namespace struct.\nMultipath code iterates the head->list under srcu_read_lock() in\nnvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent\nreader can still hold a reference to ns when kfree(ns) runs.\n\nThe normal removal path in nvme_ns_remove() correctly calls\nsynchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for\nin-progress readers. Add the same grace period in the error path.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89972" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0d4735418512ef825176726eaaa8bd6a35f6b46d", "url": "https://git.kernel.org/stable/c/0d4735418512ef825176726eaaa8bd6a35f6b46d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3868476cd39161f18720582df17a1b621e805b5d", "url": "https://git.kernel.org/stable/c/3868476cd39161f18720582df17a1b621e805b5d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/76023560d60f10b4f808941163aa2975f1631683", "url": "https://git.kernel.org/stable/c/76023560d60f10b4f808941163aa2975f1631683" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d663944dbad81bb0e3635d7090db4713e6300858", "url": "https://git.kernel.org/stable/c/d663944dbad81bb0e3635d7090db4713e6300858" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef248d5de4469fb6bbaf8dbe0c4c47800080d648", "url": "https://git.kernel.org/stable/c/ef248d5de4469fb6bbaf8dbe0c4c47800080d648" } ], "release_date": "2026-09-16T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-90033", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()\n\nThe snd_usbmidi_us122l_output() picks a count of 2 on anything slower\nthan high speed and never relates it to ep->max_transfer. The URB\nbuffer holds exactly max_transfer bytes, so a device declaring a one\nbyte bulk endpoint takes two bytes from snd_rawmidi_transmit(), and the\nmemset that pads the rest computes 1 - 2 in int and wraps to SIZE_MAX.\n\nOnly 0x800e and 0x800f are pinned to nine bytes. The US-122MKII at\n0x0644:0x8021 falls to the default and takes usb_maxpacket(), which the\nUSB core only clamps downward.\n\nThe akai and novation output ops in this file were given the same guard\nrecently. Do the same here.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90033" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1d4add2b832b56f81bb0eab065ec35c610343018", "url": "https://git.kernel.org/stable/c/1d4add2b832b56f81bb0eab065ec35c610343018" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2dae0e3a59e31f78222279d544b98e747cd1fbff", "url": "https://git.kernel.org/stable/c/2dae0e3a59e31f78222279d544b98e747cd1fbff" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5538daf2a5cc80ac3f3e913c0db045d92d995d40", "url": "https://git.kernel.org/stable/c/5538daf2a5cc80ac3f3e913c0db045d92d995d40" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9392a2c346762ffee8edd1ba8bac50d2e24a2ed7", "url": "https://git.kernel.org/stable/c/9392a2c346762ffee8edd1ba8bac50d2e24a2ed7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9d81885d97cba7796d1f8edc88f2499c8296f5b9", "url": "https://git.kernel.org/stable/c/9d81885d97cba7796d1f8edc88f2499c8296f5b9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a441a8e52148c91c2f2a91f42e3b9bc961a13a4b", "url": "https://git.kernel.org/stable/c/a441a8e52148c91c2f2a91f42e3b9bc961a13a4b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/de6d252f115be887a701c09a05cdb076f3a590c9", "url": "https://git.kernel.org/stable/c/de6d252f115be887a701c09a05cdb076f3a590c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e4637ce34607f1733a34a57294966d26b263e626", "url": "https://git.kernel.org/stable/c/e4637ce34607f1733a34a57294966d26b263e626" } ], "release_date": "2026-09-16T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-90382", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt76x02: do not WARN on invalid rx descriptor length\n\nThe MPDU length in the rx descriptor comes from the hardware. In\nmonitor mode with the fcsfail filter enabled, the hardware passes up\ncorrupted frames, and a corrupted frame can report a length larger\nthan the received buffer. The bounds check correctly discards such\nframes, but its WARN_ON_ONCE wrapper means any over-the-air garbage\nframe taints the kernel, and panics it on the first such frame when\npanic_on_warn is set.\n\nDrop the WARN and discard the frame silently, matching what\ncommit c2d4c8723dbf (\"mt76x2: remove some harmless WARN_ONs in tx\nstatus and rx path\") did for the neighboring rx and tx status paths.\n\nObserved immediately on rx with an MT7612U in fcsfail monitor mode\non a busy channel.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90382" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/17d6b89e09eac2d90272fceeba3644e92212e02f", "url": "https://git.kernel.org/stable/c/17d6b89e09eac2d90272fceeba3644e92212e02f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2d31e332c13b1db7745a7bd9cf74bc105524bcac", "url": "https://git.kernel.org/stable/c/2d31e332c13b1db7745a7bd9cf74bc105524bcac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/61b1f6d92249bc34580ff19de7c69c805f82adca", "url": "https://git.kernel.org/stable/c/61b1f6d92249bc34580ff19de7c69c805f82adca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6def491fe9c4e83aa8cba62d74e9d4ab751ee967", "url": "https://git.kernel.org/stable/c/6def491fe9c4e83aa8cba62d74e9d4ab751ee967" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/81497634d9f872fd3e8b03aada55574afff6f174", "url": "https://git.kernel.org/stable/c/81497634d9f872fd3e8b03aada55574afff6f174" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b6e7958602bd1acdb8ae92703b6689a28bcc9bc0", "url": "https://git.kernel.org/stable/c/b6e7958602bd1acdb8ae92703b6689a28bcc9bc0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe", "url": "https://git.kernel.org/stable/c/c65bbfc730df9ebf0fea8e286b0ad2dfab03dbfe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d55e7aede542c4c76ead82d37d0c112f21eb2ac2", "url": "https://git.kernel.org/stable/c/d55e7aede542c4c76ead82d37d0c112f21eb2ac2" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89487", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: only skb_tx_error() a packet we are about to drop\n\nqueue_userspace_packet() borrows the packet skb -- it only copies it into\na private netlink message (user_skb) and does not own it; on return\ndo_execute_actions() keeps forwarding it through the flow's remaining\nactions. Its error path nevertheless calls skb_tx_error(skb), which via\nskb_zcopy_clear() does skb_shinfo(skb)->flags &= ~SKBFL_ALL_ZEROCOPY,\nstripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()'s kerneldoc\nsays \"skb must be freed afterwards\").\n\nFor a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is\nwhat makes esp_input() skb_cow_data() before in-place AEAD; once it is\nstripped a later local ESP-in-UDP delivery decrypts in place over pages\nthe sender does not own -- an unprivileged page-cache write (the\n\"Fragnesia\" primitive).\ndo_execute_actions() ignores output_userspace()'s return value, so any\naction after a failed USERSPACE upcall inherits the stripped skb.\n\nMove the skb_tx_error() to the flow-miss drop path - the \"default\"\nbranch of ovs_dp_process_packet()'s switch(error), before kfree_skb().\n\nThe call has been here since commit 36d5fe6a0007 (\"core, nfqueue,\nopenvswitch: Orphan frags in skb_zerocopy and handle errors\") but was\nharmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate\nin-place decrypt; only then did stripping it on a still-forwarded skb\nbecome a page-cache write primitive.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89487" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0dbc2398fca3bb33eda963849f865ddb1b3aa05e", "url": "https://git.kernel.org/stable/c/0dbc2398fca3bb33eda963849f865ddb1b3aa05e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4477222e2916a18e273edc139c955ade6bbb7a69", "url": "https://git.kernel.org/stable/c/4477222e2916a18e273edc139c955ade6bbb7a69" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/48db11e115d1b232edc5591604adc6eda95cd545", "url": "https://git.kernel.org/stable/c/48db11e115d1b232edc5591604adc6eda95cd545" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4d5c460ef8754be1d43b16dbf02695b008b207d6", "url": "https://git.kernel.org/stable/c/4d5c460ef8754be1d43b16dbf02695b008b207d6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5d85eef222cfd28e73deed7402c100229e8b9e6e", "url": "https://git.kernel.org/stable/c/5d85eef222cfd28e73deed7402c100229e8b9e6e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a", "url": "https://git.kernel.org/stable/c/5de5d554141a15b3f1f5c978fd9f7f4fd6d0600a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6767d70cf46f65807a6a4c4406a518e6c12e36ae", "url": "https://git.kernel.org/stable/c/6767d70cf46f65807a6a4c4406a518e6c12e36ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e41a59fc056f63a7a1f42788913c53cc48d744aa", "url": "https://git.kernel.org/stable/c/e41a59fc056f63a7a1f42788913c53cc48d744aa" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-80947", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop\n\nrtl8xxxu arms rx_urb_wq from the RX completion path:\nrtl8xxxu_rx_complete() hands the URB to rtl8xxxu_queue_rx_urb(), which\nqueues it on rx_urb_pending_list and, once the list grows past\nRTL8XXXU_RX_URB_PENDING_WATER, schedules rx_urb_wq. The worker\nrtl8xxxu_rx_urb_work() drains rx_urb_pending_list, recovers priv through\ncontainer_of, and resubmits each URB through rtl8xxxu_submit_rx_urb(),\nwhich anchors it on rx_anchor and dereferences priv->udev.\n\nrtl8xxxu_stop() cancels the sibling work items (c2hcmd_work, ra_watchdog,\nupdate_beacon_work) but never cancels rx_urb_wq, so a worker armed during\nthe last burst of RX traffic can run rtl8xxxu_rx_urb_work() after\nrtl8xxxu_disconnect() has called ieee80211_free_hw(), which frees priv,\nproducing a use-after-free. The window opens under active RX traffic\n(pending count above the watermark) followed by a disconnect.\n\nThere are two teardown races to close:\n\n * rtl8xxxu_queue_rx_urb() decided whether to enqueue under rx_urb_lock\n but called schedule_work() after dropping the lock. A completion\n that observed shutdown == false and released the lock could then call\n schedule_work() after rtl8xxxu_stop() had set shutdown and\n cancel_work_sync() had already returned, arming the worker to run\n after the teardown. Move schedule_work() under the same !shutdown\n branch so the arming decision is atomic with the shutdown check.\n\n * rtl8xxxu_rx_urb_work() anchors every URB it drained back onto\n rx_anchor through rtl8xxxu_submit_rx_urb(). A worker still running\n when usb_kill_anchored_urbs(&priv->rx_anchor) returned would submit a\n URB that escaped the kill. In rtl8xxxu_stop(), call\n cancel_work_sync(&priv->rx_urb_wq) before the kill so the worker is\n drained first.\n\nAfter priv->shutdown is set under rx_urb_lock, completions can no longer\nqueue rx_urb_wq. cancel_work_sync() then drains the last queued or running\nworker, and the following usb_kill_anchored_urbs() kills the URBs it may\nhave submitted.\n\nrtl8xxxu_disconnect() is covered because ieee80211_unregister_hw()\nguarantees .stop() runs for a live interface before ieee80211_free_hw()\nfrees priv. The probe error path needs no cancel: rx_urb_wq is\nINIT_WORK()'d there but cannot have been scheduled, since no URB is\nsubmitted before ieee80211_register_hw() succeeds.\n\nThis bug was found by static analysis.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80947" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/17d5ae58973122eea7625a87cd3d80a8beb23b47", "url": "https://git.kernel.org/stable/c/17d5ae58973122eea7625a87cd3d80a8beb23b47" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/620acb1e8037b73a457dc8ef20fc23fc7adcb405", "url": "https://git.kernel.org/stable/c/620acb1e8037b73a457dc8ef20fc23fc7adcb405" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818", "url": "https://git.kernel.org/stable/c/6c080026ecc17eecb103f8927c64ea73a74bb818" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/800d2b490a9af1e7132a3564c2ad5a81292e5b40", "url": "https://git.kernel.org/stable/c/800d2b490a9af1e7132a3564c2ad5a81292e5b40" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/972ab8b9c08f3eb3fa535082de2950dd93604dfd", "url": "https://git.kernel.org/stable/c/972ab8b9c08f3eb3fa535082de2950dd93604dfd" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68143", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: slip: serialize receive against buffer reallocation\n\nsl_realloc_bufs() replaces rbuff and updates buffsize while holding\nsl->lock. slip_receive_buf() reads those fields and writes through rbuff\nwithout holding the lock.\n\nAn MTU change can therefore race with receive processing. An MTU shrink\ncan expose the new smaller rbuff with the old larger bound, causing an\nout-of-bounds write. A receive callback which already loaded the old\nrbuff can instead continue writing after that buffer has been freed.\n\nSerialize receive processing with sl_realloc_bufs() by holding sl->lock\nwhile consuming each receive batch.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68143" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e37bbd6d617eb52bace49390e99eaedc1af73ce", "url": "https://git.kernel.org/stable/c/0e37bbd6d617eb52bace49390e99eaedc1af73ce" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/189a550eb7e1dc10018718ddfc46d003ffe58653", "url": "https://git.kernel.org/stable/c/189a550eb7e1dc10018718ddfc46d003ffe58653" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1be09d175b627fad7f6bec7ad27b8a4a99863912", "url": "https://git.kernel.org/stable/c/1be09d175b627fad7f6bec7ad27b8a4a99863912" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/44401f7dd9940ced7098930ef64f5a332f279fc2", "url": "https://git.kernel.org/stable/c/44401f7dd9940ced7098930ef64f5a332f279fc2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5d07b178bef511d69558cfc89fe1129258dc39f8", "url": "https://git.kernel.org/stable/c/5d07b178bef511d69558cfc89fe1129258dc39f8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8180daf2b66155f84ec4f9e3f95488c8a3421716", "url": "https://git.kernel.org/stable/c/8180daf2b66155f84ec4f9e3f95488c8a3421716" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eb3836eab47487823f362e6985e170a1e15f20fd", "url": "https://git.kernel.org/stable/c/eb3836eab47487823f362e6985e170a1e15f20fd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d", "url": "https://git.kernel.org/stable/c/ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-72083", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE\n\ncore_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT\nparameter list with transport_kmap_data_sg() and parses the destination\nTransportID with target_parse_pr_out_transport_id(). For an iSCSI\nTransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns\nthe ISID in iport_ptr as a raw pointer into that mapped buffer.\n\nThe function then unmaps the buffer with transport_kunmap_data_sg() before\ndereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and\ncore_scsi3_alloc_registration(). When the parameter list spans more than\none page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses\nvmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual\naddress backing iport_ptr is torn down and every subsequent dereference is\na use-after-free read of the unmapped region.\n\nKeep the parameter list mapped until iport_ptr is no longer needed: drop\nthe early transport_kunmap_data_sg() and unmap once on the success path,\nright before returning. The error paths already unmap through the existing\n\"if (buf) transport_kunmap_data_sg(cmd)\" at the out: label, which now runs\non every post-map error exit because buf is no longer cleared early. Only\nreads of the mapping happen while spinlocks are held; the map and unmap\ncalls remain outside any lock. The sibling caller\ncore_scsi3_decode_spec_i_port() already uses the buffer before unmapping it\nand is left unchanged.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72083" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab", "url": "https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd", "url": "https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63", "url": "https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169", "url": "https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4", "url": "https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb", "url": "https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66", "url": "https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc", "url": "https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-90335", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: skip cdev_del() when no cdev is registered\n\nTTY device registration can fail before a cdev is allocated.\nSerial core keeps the port so setserial can still use it, and later\nremoval passes the NULL cdev slot to cdev_del(), causing a NULL-pointer\ndereference.\n\nOnly delete the cdev when the slot is not NULL.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90335" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/21031bd0d662549412378110c989b164feb6e4be", "url": "https://git.kernel.org/stable/c/21031bd0d662549412378110c989b164feb6e4be" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2af4c46b429907edc8cb069c78fca1d950120b98", "url": "https://git.kernel.org/stable/c/2af4c46b429907edc8cb069c78fca1d950120b98" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3dbf85ef40b6366ba15e882f7536cdc98bea579a", "url": "https://git.kernel.org/stable/c/3dbf85ef40b6366ba15e882f7536cdc98bea579a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c3b5623fd97648f2747444aa8932ae604662df93", "url": "https://git.kernel.org/stable/c/c3b5623fd97648f2747444aa8932ae604662df93" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ea3d2fae7c1d6492145976553817d22e8ef69a0e", "url": "https://git.kernel.org/stable/c/ea3d2fae7c1d6492145976553817d22e8ef69a0e" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98175", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: cancel reconnect work in clean_demultiplex_info()\n\nclean_demultiplex_info() cancels server->echo delayed work but not\nserver->reconnect, which can cause a use-after-free when the\ndemultiplex thread exits while a reconnect work is still queued:\n\n cifs_demultiplex_thread()\n cifs_readv_from_socket()\n cifs_reconnect()\n __cifs_reconnect()\n cifs_queue_server_reconn()\n mod_delayed_work(cifsiod_wq, &server->reconnect, 0)\n clean_demultiplex_info()\n cancel_delayed_work_sync(&server->echo) // echo canceled\n // reconnect NOT canceled\n kfree_sensitive(server) // server freed\n\n ...later, on cifsiod_wq:\n\n smb2_reconnect_server()\n server->srv_count // UAF read of freed server\n\nFix this by canceling server->reconnect delayed work in\nclean_demultiplex_info() before the server is freed, the same way\ncifs_put_tcp_session() already does.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98175" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/180380272f116dbd2b0354c5c7872e112e519149", "url": "https://git.kernel.org/stable/c/180380272f116dbd2b0354c5c7872e112e519149" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2e5103e11a17c274715dd56cf185eeedccf686b8", "url": "https://git.kernel.org/stable/c/2e5103e11a17c274715dd56cf185eeedccf686b8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7ab9ceedd860216fb97f2d8574cbe58b8906f42a", "url": "https://git.kernel.org/stable/c/7ab9ceedd860216fb97f2d8574cbe58b8906f42a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1", "url": "https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3f6a779433d13aafb5edab59e4f9313051e8a52", "url": "https://git.kernel.org/stable/c/e3f6a779433d13aafb5edab59e4f9313051e8a52" } ], "release_date": "2026-10-06T09:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-93054", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio: Fix stale info pointer in failed registration path\n\nAfter device_add(), the UIO device is visible to userspace and /dev/uioX\ncan be opened. If a later setup step fails, __uio_register_device()\nunwinds the device but leaves idev->info pointing at the caller-owned\nstruct uio_info.\n\nThat is unsafe when an opener races with the failed registration path.\nThe open file keeps a reference to the uio_device, while the caller sees\nregistration failure and may free its struct uio_info. Later file\noperations can then follow idev->info and dereference freed memory.\n\nHandle post-device_add() failures like unregister: remove UIO attributes\nwhile the info pointer is still valid, then clear idev->info under\ninfo_lock and wake existing waiters/async users before removing the\ndevice and minor. This makes already-open file descriptors observe the\nsame \"device gone\" state as normal uio_unregister_device().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-93054" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/15340b00e665af805523b08515294a1aa1778151", "url": "https://git.kernel.org/stable/c/15340b00e665af805523b08515294a1aa1778151" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/16695e9059d80ea6661e8399064b0c01f641dd8c", "url": "https://git.kernel.org/stable/c/16695e9059d80ea6661e8399064b0c01f641dd8c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/234156f6c6d9ec35dc47abbcc3adc3c79fc6a5ac", "url": "https://git.kernel.org/stable/c/234156f6c6d9ec35dc47abbcc3adc3c79fc6a5ac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/506b43dde5f9ac0068b1360e6b5dbee07fda59fb", "url": "https://git.kernel.org/stable/c/506b43dde5f9ac0068b1360e6b5dbee07fda59fb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/63eaa7663335d482a8825c231213e312cacea567", "url": "https://git.kernel.org/stable/c/63eaa7663335d482a8825c231213e312cacea567" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/67b6fc084b034a91c3ec7907a3fed89a2450f30b", "url": "https://git.kernel.org/stable/c/67b6fc084b034a91c3ec7907a3fed89a2450f30b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/df4faf65194ec6c315a59be4c6749eaeb3009243", "url": "https://git.kernel.org/stable/c/df4faf65194ec6c315a59be4c6749eaeb3009243" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ec5bd6731183eb6f619140c9bef2ee11ed818c20", "url": "https://git.kernel.org/stable/c/ec5bd6731183eb6f619140c9bef2ee11ed818c20" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2022-48791", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Fix use-after-free for aborted TMF sas_task\n\nCurrently a use-after-free may occur if a TMF sas_task is aborted before we\nhandle the IO completion in mpi_ssp_completion(). The abort occurs due to\ntimeout.\n\nWhen the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the\nsas_task is freed in pm8001_exec_internal_tmf_task().\n\nHowever, if the I/O completion occurs later, the I/O completion still\nthinks that the sas_task is available. Fix this by clearing the ccb->task\nif the TMF times out - the I/O completion handler does nothing if this\npointer is cleared.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-48791" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3c334cdfd94945b8edb94022a0371a8665b17366", "url": "https://git.kernel.org/stable/c/3c334cdfd94945b8edb94022a0371a8665b17366" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/510b21442c3a2e3ecc071ba3e666b320e7acdd61", "url": "https://git.kernel.org/stable/c/510b21442c3a2e3ecc071ba3e666b320e7acdd61" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/61f162aa4381845acbdc7f2be4dfb694d027c018", "url": "https://git.kernel.org/stable/c/61f162aa4381845acbdc7f2be4dfb694d027c018" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d872e7b5fe38f325f5206b6872746fa02c2b4819", "url": "https://git.kernel.org/stable/c/d872e7b5fe38f325f5206b6872746fa02c2b4819" } ], "release_date": "2024-07-16T11:43:47Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-74688", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: clear control chunk transport if it is being removed\n\nsctp_make_heartbeat_ack() caches the destination transport in\nchunk->transport without taking a reference. When src_out_of_asoc_ok is\nenabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead\nof being transmitted immediately.\n\nIf the peer transport is removed while the chunk is still queued,\nsctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing,\nbut only clears cached transport pointers in out_chunk_list. The queued\ncontrol chunk therefore retains a dangling transport pointer.\n\nOnce an ASCONF_ACK clears the suppression and the queued control chunk is\ntransmitted, SCTP dereferences the stale transport pointer, leading to a\nuse-after-free.\n\nFix this by also clearing chunk->transport for queued control chunks in\ncontrol_chunk_list when removing the transport.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74688" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/18d704bdd809377dfd81a3c2f42426763b5da227", "url": "https://git.kernel.org/stable/c/18d704bdd809377dfd81a3c2f42426763b5da227" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7", "url": "https://git.kernel.org/stable/c/4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6160e756db81d6cb63e3e2952efcf6c5134be385", "url": "https://git.kernel.org/stable/c/6160e756db81d6cb63e3e2952efcf6c5134be385" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8de65194a04d2552cd39b6c67d942d490f22d174", "url": "https://git.kernel.org/stable/c/8de65194a04d2552cd39b6c67d942d490f22d174" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/936658ec41c28c397ef390140e02d4c91ade92f0", "url": "https://git.kernel.org/stable/c/936658ec41c28c397ef390140e02d4c91ade92f0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c9158ceaf27780ef64534ad72f44ffde3f8ccc49", "url": "https://git.kernel.org/stable/c/c9158ceaf27780ef64534ad72f44ffde3f8ccc49" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886", "url": "https://git.kernel.org/stable/c/dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fad4766a74220fe579c6fcaa10ba01c23529814f", "url": "https://git.kernel.org/stable/c/fad4766a74220fe579c6fcaa10ba01c23529814f" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89478", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: drop a chunk if its transport was removed\n\nsctp_rcv() resolves the transport once per packet and leaves it in\nchunk->transport. The lookup reference, or the one sctp_add_backlog() takes\nif the socket is owned by userspace, keeps it around until the chunk has\nbeen processed.\n\nAn authenticated ASCONF DEL-IP can remove it in the meantime.\nsctp_assoc_rm_peer() takes the transport out of the association and calls\nsctp_transport_free(), which tags it dead and drops the reference the\nassociation held. There is a window on both paths: the packet can sit on\nthe socket backlog, and on the direct path the lookup completes before\nbh_lock_sock().\n\nThe DATA chunk in that packet puts the removed transport back into\nasoc->peer.last_data_from. Once the packet is done that reference goes\naway and the transport is freed by RCU, so the next delayed SACK carries\nthe pointer into the SACK chunk and sctp_outq_select_transport() reads the\nfreed transport's state.\n\nDrop the chunk in sctp_inq_push(), next to the existing rcvr->dead check.\nBoth paths reach it with the association's socket lock held. The peer\nretransmits it.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89478" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/03a9d10ecf71f54b2af8020935f2033d4a132be5", "url": "https://git.kernel.org/stable/c/03a9d10ecf71f54b2af8020935f2033d4a132be5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0422b092a3d43ca462932ff9f747731ca078d1d4", "url": "https://git.kernel.org/stable/c/0422b092a3d43ca462932ff9f747731ca078d1d4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1035bdef1efb9b1076d1a57b81e08c637ff08ecc", "url": "https://git.kernel.org/stable/c/1035bdef1efb9b1076d1a57b81e08c637ff08ecc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3537961df2163258bddc230db0e18dc14e925ea6", "url": "https://git.kernel.org/stable/c/3537961df2163258bddc230db0e18dc14e925ea6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3fc072e7cb4a0ff251d13cfc2d24f62489cd9386", "url": "https://git.kernel.org/stable/c/3fc072e7cb4a0ff251d13cfc2d24f62489cd9386" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/928fd7920ba37cc5637a211b9be979083413a2fa", "url": "https://git.kernel.org/stable/c/928fd7920ba37cc5637a211b9be979083413a2fa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c6c86a5e62a4fec36692ddd64b9144b660f71f96", "url": "https://git.kernel.org/stable/c/c6c86a5e62a4fec36692ddd64b9144b660f71f96" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d7cb5ad832095dc4becfdb2a36007ffd50e49fb0", "url": "https://git.kernel.org/stable/c/d7cb5ad832095dc4becfdb2a36007ffd50e49fb0" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89699", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: validate symlink target length in NFSv4 CREATE\n\nnfsd4_decode_create() accepts an unbounded cr_datalen from the wire for\nNF4LNK symlink targets, allowing a client to force a kmalloc of up to\nthe maximum RPC payload size (several MiB) per COMPOUND op that persists\nuntil compound teardown. The VFS rejects oversized targets with\nENAMETOOLONG, but the allocation has already occurred.\n\nReject cr_datalen == 0 early with nfserr_inval and cr_datalen greater\nthan NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the\nallocation.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89699" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/041f57056e5fb9c80adc088269322d2c61074406", "url": "https://git.kernel.org/stable/c/041f57056e5fb9c80adc088269322d2c61074406" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/36011308b3f01ce7dc9954f3cefcbb5291af9f95", "url": "https://git.kernel.org/stable/c/36011308b3f01ce7dc9954f3cefcbb5291af9f95" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3ef5e7a01a4d74995a65496bc9166d1e980a4355", "url": "https://git.kernel.org/stable/c/3ef5e7a01a4d74995a65496bc9166d1e980a4355" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/45ec115cbfecb4b3cfab7fca6f73d1b60696a25a", "url": "https://git.kernel.org/stable/c/45ec115cbfecb4b3cfab7fca6f73d1b60696a25a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8661d3cb38fd148947e57dbc0871fd4d3fa33bbf", "url": "https://git.kernel.org/stable/c/8661d3cb38fd148947e57dbc0871fd4d3fa33bbf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/888dad4b557352cf85be31613407b5ba51ad07d1", "url": "https://git.kernel.org/stable/c/888dad4b557352cf85be31613407b5ba51ad07d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/895a485cd3758031ef9993c0d53cf19ce8fb4ccc", "url": "https://git.kernel.org/stable/c/895a485cd3758031ef9993c0d53cf19ce8fb4ccc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b24843ea3de1676b29902457b38507c95a80649b", "url": "https://git.kernel.org/stable/c/b24843ea3de1676b29902457b38507c95a80649b" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68153", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: remove debugfs files before client teardown\n\nceph_destroy_client() tears down the monitor client before removing\nthe per-client debugfs files. A concurrent read of the monmap debugfs\nfile can enter monmap_show() after ceph_monc_stop() has freed\nmonc->monmap, triggering a use-after-free.\n\nRemove the debugfs files before stopping the OSD and monitor clients.\ndebugfs_remove() drains active handlers and prevents new accesses, so\nthe debugfs callbacks can no longer race the rest of client teardown.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68153" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/463a264e9094384112a5c8b46f0a9ddaf8566904", "url": "https://git.kernel.org/stable/c/463a264e9094384112a5c8b46f0a9ddaf8566904" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f5a3abc54ba24dbceb14cc3a719908c4f688091", "url": "https://git.kernel.org/stable/c/8f5a3abc54ba24dbceb14cc3a719908c4f688091" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ac78549d186090ee7125d28c3a8c376573b36194", "url": "https://git.kernel.org/stable/c/ac78549d186090ee7125d28c3a8c376573b36194" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b9fedda2f628e030384228de0dafc574b7fb0c2f", "url": "https://git.kernel.org/stable/c/b9fedda2f628e030384228de0dafc574b7fb0c2f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d3dc8889d39a676bf840132bd5c5c48cb0daba23", "url": "https://git.kernel.org/stable/c/d3dc8889d39a676bf840132bd5c5c48cb0daba23" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e4c804726c4afce3ba648b982d564f6af2cfa328", "url": "https://git.kernel.org/stable/c/e4c804726c4afce3ba648b982d564f6af2cfa328" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fc1010e7e0204ece6cc0f9af4f473e9553535eab", "url": "https://git.kernel.org/stable/c/fc1010e7e0204ece6cc0f9af4f473e9553535eab" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fe46b7e06f14f6f94766832df309b249cb689d27", "url": "https://git.kernel.org/stable/c/fe46b7e06f14f6f94766832df309b249cb689d27" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53129", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/mbcache: cancel shrink work before destroying the cache\n\nmb_cache_destroy() calls shrinker_free() and then frees all cache\nentries and the cache itself, but it does not cancel the pending\nc_shrink_work work item first.\n\nIf mb_cache_entry_create() schedules c_shrink_work via schedule_work()\nand the work item is still pending or running when mb_cache_destroy()\nruns, mb_cache_shrink_worker() will access the cache after its memory\nhas been freed, causing a use-after-free.\n\nThis is only reachable by a privileged user (root or CAP_SYS_ADMIN)\nwho can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem.\n\nCancel the work item with cancel_work_sync() before calling\nshrinker_free(), ensuring the worker has finished and will not be\nrescheduled before the cache is torn down.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53129" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e4eff315d799f5842b95872199b0f0fb8ef5f51", "url": "https://git.kernel.org/stable/c/0e4eff315d799f5842b95872199b0f0fb8ef5f51" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a88d39a74a208e197c03bffaa2df34de732af19f", "url": "https://git.kernel.org/stable/c/a88d39a74a208e197c03bffaa2df34de732af19f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b25fd3523bef88fb7ffd4c5b63bbe9c08f73bb4c", "url": "https://git.kernel.org/stable/c/b25fd3523bef88fb7ffd4c5b63bbe9c08f73bb4c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cbdd6f0fb19a0ce8a013acd80ac87a62f57fa20d", "url": "https://git.kernel.org/stable/c/cbdd6f0fb19a0ce8a013acd80ac87a62f57fa20d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d227786ab1119669df4dc333a61510c52047cce4", "url": "https://git.kernel.org/stable/c/d227786ab1119669df4dc333a61510c52047cce4" } ], "release_date": "2026-06-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-97408", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: validate connectionless PSM length\n\nConnectionless L2CAP frames carry a two-byte PSM at the start of the\npayload. l2cap_recv_frame() currently reads that PSM unconditionally\nafter validating only the outer L2CAP length.\n\nA malformed connectionless frame with a zero- or one-byte payload can\ntherefore make the parser read beyond the advertised skb payload and use\ntailroom bytes as part of the PSM. A VHCI-backed QEMU reproducer\ninjected a one-byte connectionless payload and reached the unchecked\nread.\n\nReject connectionless frames that cannot contain the PSM before reading\nor pulling it. This preserves all valid connectionless frames while\ndropping only structurally incomplete packets.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97408" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/22fc1ce4e37c81d4e7aac01566ebdc232214540d", "url": "https://git.kernel.org/stable/c/22fc1ce4e37c81d4e7aac01566ebdc232214540d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3502ede8aed3c3ee1786d952a11054ac737d1a38", "url": "https://git.kernel.org/stable/c/3502ede8aed3c3ee1786d952a11054ac737d1a38" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/72e26293a231f63a856340d3a1f0f5fc29bf87e5", "url": "https://git.kernel.org/stable/c/72e26293a231f63a856340d3a1f0f5fc29bf87e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8104cd9859b6de0826cffa68adf2c1461185823b", "url": "https://git.kernel.org/stable/c/8104cd9859b6de0826cffa68adf2c1461185823b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9448e6f693fcf1f0ac4ee648a9b2cc83bfe4a982", "url": "https://git.kernel.org/stable/c/9448e6f693fcf1f0ac4ee648a9b2cc83bfe4a982" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a40a5f922546b3bd7c094d882b29177db4f2abe0", "url": "https://git.kernel.org/stable/c/a40a5f922546b3bd7c094d882b29177db4f2abe0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae69dca122f6d6046a68cf40153e6e827c77ff5c", "url": "https://git.kernel.org/stable/c/ae69dca122f6d6046a68cf40153e6e827c77ff5c" } ], "release_date": "2026-09-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74630", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent in6_dev_get() from resurrecting inet6_dev\n\nin6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally\nincrements its refcount. Device teardown can clear the pointer and drop\nthe last reference between these operations. The increment then\nresurrects an object whose RCU free has already been queued, so callers\ncan use it after it is freed.\n\nUse refcount_inc_not_zero() and return NULL when the object has already\nreached zero. RCU keeps the memory accessible through the attempted\nreference acquisition, and a successful increment pins the object for\nthe caller.\n\nAn independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)\nkernel reproduced the invalid reference acquisition as UID 1000:\n\n refcount_t: addition on 0; use-after-free.\n ip6_mc_source+0xef4/0x17e0\n\nIt was followed by the corresponding reference underflow in\nip6_mc_source(). The supplied trace from the same unpatched revision\nadditionally shows the access after the RCU read-side section ends:\n\n BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0\n Write of size 8 at addr ffff888015b50240 by task poc/1219\n\nBug found and triaged by OpenAI Security Research and\nvalidated by Trail of Bits.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74630" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e243671bc7b8eaf00f83dd2f4367436dc0cff98", "url": "https://git.kernel.org/stable/c/0e243671bc7b8eaf00f83dd2f4367436dc0cff98" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/145812b678de9f3b59780173be3c0d22ed60dd93", "url": "https://git.kernel.org/stable/c/145812b678de9f3b59780173be3c0d22ed60dd93" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14e812ab41df0cac033479da835ec9a5de633404", "url": "https://git.kernel.org/stable/c/14e812ab41df0cac033479da835ec9a5de633404" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1c206d461c680c3151daa3c89fc26eaf5bf98a7f", "url": "https://git.kernel.org/stable/c/1c206d461c680c3151daa3c89fc26eaf5bf98a7f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/680fbd7942185448eadb990a3d10a53eb946b702", "url": "https://git.kernel.org/stable/c/680fbd7942185448eadb990a3d10a53eb946b702" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/785d908f8d21c8bc78b6fb2c2932ab662bf6918a", "url": "https://git.kernel.org/stable/c/785d908f8d21c8bc78b6fb2c2932ab662bf6918a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8", "url": "https://git.kernel.org/stable/c/aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cc5bd568f9b7683e60841b6fd02c10d64535bd6e", "url": "https://git.kernel.org/stable/c/cc5bd568f9b7683e60841b6fd02c10d64535bd6e" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68414", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel sched scan results work on unregister\n\ncfg80211_sched_scan_results() can queue rdev->sched_scan_res_wk from a\ndriver result notification while a scheduled scan request is present. The\nwork callback recovers the containing cfg80211_registered_device and then\nlocks the wiphy and walks the scheduled-scan request list.\n\nwiphy_unregister() already makes the wiphy unreachable and drains rdev work\nitems before cfg80211_dev_free() can release the object, but it does not\ndrain sched_scan_res_wk. A queued or running result work item can therefore\ncross the unregister/free boundary and access freed rdev state.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nscheduled-scan result path: unregister/free path:\n1. cfg80211_sched_scan_results() 1. interface teardown stops and\n queues rdev->sched_scan_res_wk. removes the scheduled scan request.\n2. cfg80211_wq starts the work 2. wiphy_unregister() drains other\n item and recovers rdev. rdev work items.\n3. The worker locks rdev->wiphy 3. cfg80211_dev_free() destroys and\n and walks rdev state. frees rdev.\n\nCancel sched_scan_res_wk in wiphy_unregister() alongside the other rdev\nwork items. cancel_work_sync() removes a pending result notification and\nwaits for an already running callback, so cfg80211_dev_free() cannot free\nrdev while this work item is still active.\n\nValidation reproduced this kernel report:\nBUG: KASAN: use-after-free in cfg80211_sched_scan_results_wk+0x4a6/0x530\nWorkqueue: cfg80211 cfg80211_sched_scan_results_wk [cfg80211]\nRead of size 8\nCall trace:\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x630\n cfg80211_sched_scan_results_wk+0x4a6/0x530\n srso_alias_return_thunk+0x5/0xfbef5\n __virt_addr_valid+0x224/0x430\n kasan_report+0xac/0xe0\n lockdep_hardirqs_on_prepare+0xea/0x1a0\n process_one_work+0x8d0/0x18f0 (kernel/workqueue.c:3212)\n lock_is_held_type+0x8f/0x100\n worker_thread+0x5ad/0xfd0\n __kthread_parkme+0xc6/0x200\n kthread+0x31e/0x410\n trace_hardirqs_on+0x1a/0x170\n ret_from_fork+0x576/0x810\n __switch_to+0x57e/0xe20\n __switch_to_asm+0x33/0x70\n ret_from_fork_asm+0x1a/0x30", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68414" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/308ffdf575560d7e7b8b21f1e3ca6276630f73bf", "url": "https://git.kernel.org/stable/c/308ffdf575560d7e7b8b21f1e3ca6276630f73bf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3368457b4871ae8f0f88d19c9a3e6270e850ede6", "url": "https://git.kernel.org/stable/c/3368457b4871ae8f0f88d19c9a3e6270e850ede6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9293574ac208d18c11073538851fb69355beb3b5", "url": "https://git.kernel.org/stable/c/9293574ac208d18c11073538851fb69355beb3b5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b119c70b24776c8ab2a2c0515397b3b0ad4e66cd", "url": "https://git.kernel.org/stable/c/b119c70b24776c8ab2a2c0515397b3b0ad4e66cd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b51b42b974461fd0f688baad85f10e2b8ab215c5", "url": "https://git.kernel.org/stable/c/b51b42b974461fd0f688baad85f10e2b8ab215c5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c0fa1f3a4b021a5c6373169fd6c9bb4261d676a0", "url": "https://git.kernel.org/stable/c/c0fa1f3a4b021a5c6373169fd6c9bb4261d676a0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/edf0730be33696a1bd142792830d392129e495cc", "url": "https://git.kernel.org/stable/c/edf0730be33696a1bd142792830d392129e495cc" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89448", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Force requesting ACS when tboot is enabled\n\nCurrently the conditions of requesting ACS in detect_intel_iommu()\ndon't include tboot, leading to a possible misconfiguration with ACS\ndisabled (e.g. due to user opts) while iommu is later forced on by\ntboot_force_iommu().\n\nFix it by checking tboot in detect_intel_iommu().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89448" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/45705a6bfdb283f7b3b509010fd617b72f942537", "url": "https://git.kernel.org/stable/c/45705a6bfdb283f7b3b509010fd617b72f942537" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/579eb867d3da63f3b5e32f235925e1daa7ec70d0", "url": "https://git.kernel.org/stable/c/579eb867d3da63f3b5e32f235925e1daa7ec70d0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/607432b2618b61df81134be0ef2562b8300c1216", "url": "https://git.kernel.org/stable/c/607432b2618b61df81134be0ef2562b8300c1216" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/87bc611c6c98a41c00feb7b06b0c297dd141a2ae", "url": "https://git.kernel.org/stable/c/87bc611c6c98a41c00feb7b06b0c297dd141a2ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aaeb81241e802c86be69394f72d49fde3f861fbb", "url": "https://git.kernel.org/stable/c/aaeb81241e802c86be69394f72d49fde3f861fbb" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74705", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: fix potential use-after-free in tunnel segmentation\n\n__skb_udp_tunnel_segment() gets the UDP header before ensuring the\ntunnel header is in the skb head. If the pull reallocates skb->head,\nthe saved UDP header pointer is no longer valid.\n\nGet the UDP header after the pull to avoid a potential use-after-free.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74705" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f", "url": "https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55", "url": "https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b", "url": "https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d", "url": "https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe", "url": "https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87", "url": "https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442", "url": "https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0f86fb36eb260abd10007b62c9dcc1028e03e61", "url": "https://git.kernel.org/stable/c/d0f86fb36eb260abd10007b62c9dcc1028e03e61" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68093", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug\n\nIf a vCPU stays scheduled out (or blocked) while the last pCPU it ran\non goes through a hotplug cycle (online->offline->online), and the vCPU\nthen resumes execution on the same pCPU, then it is possible for it to\nrun with an ASID that has now been assigned to a different vCPU,\nresulting in stale TLB translations being used.\n\nsvm_enable_virtualization_cpu() resets asid_generation to 1 and sets\nnext_asid to max_asid + 1 on every CPU online event, including hotplug\ncycles. Because next_asid starts beyond the pool boundary, the first\ncall to new_asid() after an online event always wraps the pool,\nincrementing asid_generation to 2 and assigning ASIDs starting from\nmin_asid.\n\nConsider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding\nasid_generation=2 and ASID=N from before the hotplug event:\n\n 1. CPU-X goes offline and back online: asid_generation resets to 1,\n next_asid = max_asid + 1.\n\n 2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping\n the pool and consuming ASIDs starting from min_asid. Eventually\n vCPU-B from a different VM is assigned asid_generation=2, ASID=N\n — the same ASID that vCPU-A held before the hotplug.\n\n 3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb->cpu is\n unchanged so the migration branch is skipped. Its saved\n asid_generation=2 matches sd->asid_generation=2, so the generation\n check silently passes and vCPU-A continues running with ASID=N —\n the same ASID just freshly assigned to vCPU-B.\n\nBoth vCPUs from different VMs now run on CPU-X with the same ASID,\ncausing them to share NPT TLB entries and producing stale translations.\n\nThe collision manifests as a KVM internal error (Suberror: 1, emulation\nfailure). The NPT page fault reports a faulting GPA far outside the\nVM's physical memory range — a sign of stale TLB translations being\nused. KVM falls back to instruction emulation, which fails on\nFPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not\nimplement.\n\nFix this by incrementing asid_generation instead of resetting it to 1\nin svm_enable_virtualization_cpu(). On module load, asid_generation\nstarts at 0 (memset) and the increment produces 1, identical to the\nold behaviour. On subsequent hotplug cycles the generation advances\nbeyond any value a vCPU previously observed on this CPU, so the\ngeneration check in pre_svm_run() reliably forces new_asid() on every\nvCPU after every hotplug cycle.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68093" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0f33b1c457c2199ed130b92cc2ff363a3f7b9415", "url": "https://git.kernel.org/stable/c/0f33b1c457c2199ed130b92cc2ff363a3f7b9415" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2028b81321dc757b6875b99c10d908e349c141e2", "url": "https://git.kernel.org/stable/c/2028b81321dc757b6875b99c10d908e349c141e2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/25f744ffa0c8e799e06250ce2e618367b166b0d4", "url": "https://git.kernel.org/stable/c/25f744ffa0c8e799e06250ce2e618367b166b0d4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/60283726f2845bd78b95efbd0e50b93944780477", "url": "https://git.kernel.org/stable/c/60283726f2845bd78b95efbd0e50b93944780477" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b542d116acecb83a1ca34e8eace304cff6a4ec9", "url": "https://git.kernel.org/stable/c/6b542d116acecb83a1ca34e8eace304cff6a4ec9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7508916b4b55d6f5ecc68cd09774dabd3a6b4440", "url": "https://git.kernel.org/stable/c/7508916b4b55d6f5ecc68cd09774dabd3a6b4440" } ], "release_date": "2026-08-10T13:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89893", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx23885: cancel NetUP CI work before teardown\n\nnetup_ci_exit() frees a netup_ci_state while its work item,\nnetup_read_ci_status(), may still be pending or running on the system\nworkqueue. The worker obtains the state with container_of() and\ndereferences it, so it must not outlive the state.\n\nnetup_ci_init() queues the initial status read, and CI GPIO interrupts\nsubsequently queue the same work from netup_ci_slot_status(). During\nremove, cx23885_finidev() calls free_irq() before the CI device is\nunregistered. free_irq() prevents further IRQ handlers from running,\nbut does not drain work queued previously, so the worker can run after\nnetup_ci_exit() frees the state.\n\nCall cancel_work_sync() before dvb_ca_en50221_release() and kfree().\n\nThis issue was found by an in-house static analysis tool.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89893" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/140ecbcbf978fbe60f83f8d4f8b1199029a5c763", "url": "https://git.kernel.org/stable/c/140ecbcbf978fbe60f83f8d4f8b1199029a5c763" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4e143d662ca94888b494b2427fc9e34494eb933a", "url": "https://git.kernel.org/stable/c/4e143d662ca94888b494b2427fc9e34494eb933a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5deec890ecfa04d21cfa9bb9a2fe5e9dc98db5c5", "url": "https://git.kernel.org/stable/c/5deec890ecfa04d21cfa9bb9a2fe5e9dc98db5c5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/99cd62b9b1c818d6d01a87be9a8e5796314150a2", "url": "https://git.kernel.org/stable/c/99cd62b9b1c818d6d01a87be9a8e5796314150a2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aaf76794b870b0f391eff339252a2e2e22f33a4a", "url": "https://git.kernel.org/stable/c/aaf76794b870b0f391eff339252a2e2e22f33a4a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bf3f49273d5bf6acbdad18ff44c01ffcf7a7a146", "url": "https://git.kernel.org/stable/c/bf3f49273d5bf6acbdad18ff44c01ffcf7a7a146" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ec82b0cf7f75fd95802592dcc9560fc7f529bba4", "url": "https://git.kernel.org/stable/c/ec82b0cf7f75fd95802592dcc9560fc7f529bba4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f7ff5adb63c1b277565afa54ccc0924d841b4a52", "url": "https://git.kernel.org/stable/c/f7ff5adb63c1b277565afa54ccc0924d841b4a52" } ], "release_date": "2026-09-16T11:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74700", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers\n\nAnother challenge with unlocked filters.\nThere is a short window in tc_new_tfilter where a tcf_proto can be found\nand briefly referenced by a totally unrelated, unlocked classifier's request\nand cause a race.\n\nFeng created a poc which created this race with two threads, one creating a\nu32 filter and other a flower filter in the same chain/prio:\n\n1. Both threads enter tc_new_tfilter, both find the chain empty, both\n drop filter_chain_lock\n2. u32 finishes tcf_proto_create(\"u32\") first, calls\n tcf_chain_tp_insert_unique() -> inserts u32_tp into the chain\n3. flower finishes tcf_proto_create(\"flower\") later, calls\n tcf_chain_tp_insert_unique() -> tcf_chain_tp_find() now sees u32_tp\n already there, takes a reference on it, destroys flower's own tp_new\n and returns u32_tp to the caller.\n\nFlower then hits the kind mismatch check (because it requested for kind\n\"flower\" but tp->ops->kind is \"u32\") and goes through the errout path\nwhich calls tcf_proto_put() on u32_tp. If the u32 thread has already\ngone through its own errout (its change() call failed on the PoC's empty\noptions) and dropped its create and insert refs, flower's put is the\nlast one and drops u32_tp's refcnt to zero.\n\nAt this point tp->ops->destroy() runs in a context that never took\nrtnl_lock. When that happens, it might cause a UAF like the following\n(illustrated by the PoC):\n\n[ +0.000710] BUG: KASAN: slab-use-after-free in u32_init (net/sched/cls_u32.c:393)\n[ +0.000281] Read of size 8 at addr ffff888120022f00 by task poc_feng_xue/524\n\n Call Trace:\n u32_init (net/sched/cls_u32.c:393)\n tc_new_tfilter (net/sched/cls_api.c:2378)\n\n Allocated by task 526:\n u32_init (net/sched/cls_u32.c:378)\n tc_new_tfilter (net/sched/cls_api.c:2378)\n\n Freed by task 522:\n kfree\n u32_destroy (net/sched/cls_u32.c:662)\n tcf_proto_destroy (net/sched/cls_api.c:446)\n tcf_proto_put (net/sched/cls_api.c:459)\n tc_new_tfilter (net/sched/cls_api.c:2459)\n\nFix this by having tcf_proto_destroy() take rtnl_lock around\ntp->ops->destroy() for locked classifiers whenever rtnl is not held.\n\nTo explain why I used a temp variable \"not_lockless\" I'd like to point to a\nsemi-related note on rtnl_held vs TCF_PROTO_OPS_DOIT_UNLOCKED (adding here\nfor future cleanup if deemed necessary):\nThe rtnl_held parameter and the TCF_PROTO_OPS_DOIT_UNLOCKED flag are\nredundant sources of truth for whether rtnl_lock is held. Among the nine\nclassifier destroy(..rtnl_held..) callbacks, only flower consults the\nrtnl_held parameter which it propagates to tc_setup_cb_destroy()\nand tc_setup_cb_call(). The other eight (u32, flow, bpf, cgroup, route, basic,\nfw, mall) ignore it entirely;-> those that call tc_setup_cb_destroy()\n(u32, bpf, mall) hardcode true always instead of forwarding the parameter.\n\nA future cleanup should remove the rtnl_held parameter from the destroy callback\nsignature entirely and have callers rely solely on their knowledge whether\nthey are running in an unlocked context.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74700" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/34e77d8e3570f9df3952496ddb402833695662fd", "url": "https://git.kernel.org/stable/c/34e77d8e3570f9df3952496ddb402833695662fd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a347304b2ca1a5377d5bd2d8a72e4b4f12afe648", "url": "https://git.kernel.org/stable/c/a347304b2ca1a5377d5bd2d8a72e4b4f12afe648" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a81f9c44d87fb59d99fce72e29e02cab3a49a1c3", "url": "https://git.kernel.org/stable/c/a81f9c44d87fb59d99fce72e29e02cab3a49a1c3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b648c8a56531aeabd1c14f6b5cf1891e269b3756", "url": "https://git.kernel.org/stable/c/b648c8a56531aeabd1c14f6b5cf1891e269b3756" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d6222af7274f08e7a1848131dc30319993d8f377", "url": "https://git.kernel.org/stable/c/d6222af7274f08e7a1848131dc30319993d8f377" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74609", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: read le->link under the node lock in tipc_node_link_down()\n\ntipc_node_link_down() caches the link pointer before taking n->lock:\n\n\tstruct tipc_link *l = le->link;\t\t/* unlocked */\n\n\tif (!l)\n\t\treturn;\n\ttipc_node_write_lock(n);\n\tif (!tipc_link_is_establishing(l)) {\t/* deref l */\n\t...\n\t\ttipc_link_reset(l);\t\t/* write into l */\n\tif (delete) {\n\t\tkfree(l);\n\t\tle->link = NULL;\n\nThe delete=true caller frees that very object under n->lock, so the lock\ndoes not protect the cached pointer against it:\n\n - CPU A, delete=false: tipc_rcv() on TIPC_LINK_DOWN_EVT, or the link\n supervision timer via tipc_node_timeout(), reads l unlocked and then\n dereferences it under n->lock;\n - CPU B, delete=true: netlink TIPC_NL_BEARER_DISABLE -> bearer_disable()\n -> tipc_node_delete_links() -> tipc_node_link_down(n, bearer_id, true)\n -> kfree(l).\n\nThe link is freed with plain kfree(), not kfree_rcu(), and for UDP bearers\ndisable_media() only schedules the asynchronous cleanup_bearer() work, so\nits synchronize_net() runs after the links are already gone. An in-flight\nCPU A that has read l therefore dereferences freed memory once B frees it:\na use-after-free read in tipc_link_is_establishing(), and a use-after-free\nwrite via tipc_link_reset() on the establishing branch.\n\nThe following trace was captured on 7.2.0-rc5-00284-gaf39eb111ce6:\n\n BUG: KASAN: slab-use-after-free in tipc_link_is_establishing (net/tipc/link.c:285)\n Read of size 4 at addr ffff88802e2aa068 by task swapper/2/0\n tipc_link_is_establishing (net/tipc/link.c:285)\n tipc_node_link_down (net/tipc/node.c:1076)\n tipc_node_timeout (net/tipc/node.c:843)\n Allocated by task 9549:\n tipc_link_create (net/tipc/link.c:490)\n tipc_node_check_dest (net/tipc/node.c:1279)\n tipc_disc_rcv (net/tipc/discover.c:252)\n tipc_udp_recv (net/tipc/udp_media.c:389)\n Freed by task 9549:\n tipc_node_link_down (net/tipc/node.c:1084)\n tipc_node_delete_links (net/tipc/node.c:1320)\n bearer_disable (net/tipc/bearer.c:414)\n __tipc_nl_bearer_disable (net/tipc/bearer.c:992)\n\nMove the le->link read inside tipc_node_write_lock(), so it is serialised\nagainst the kfree() in the delete path. A racing teardown now either has\nnot run yet, and we see a valid link, or has already run, and we see NULL.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74609" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2be741ad565c610871a6a95062c12c39da7168fd", "url": "https://git.kernel.org/stable/c/2be741ad565c610871a6a95062c12c39da7168fd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/47ba70891b10b2feb52462086b7fcd2ad75d3ce3", "url": "https://git.kernel.org/stable/c/47ba70891b10b2feb52462086b7fcd2ad75d3ce3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5558a8312452ddb21eff22b1cbd84302ad951944", "url": "https://git.kernel.org/stable/c/5558a8312452ddb21eff22b1cbd84302ad951944" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/69d209461c110388710e483a130caf051e4fd09a", "url": "https://git.kernel.org/stable/c/69d209461c110388710e483a130caf051e4fd09a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a714d62513befef37f71f4ae89bb1fe173b65f2e", "url": "https://git.kernel.org/stable/c/a714d62513befef37f71f4ae89bb1fe173b65f2e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c3f2347a47754eac690967cfd82cb6d559817b07", "url": "https://git.kernel.org/stable/c/c3f2347a47754eac690967cfd82cb6d559817b07" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cba9ccb47e9fa4cc77692fb896cc5ab57a667882", "url": "https://git.kernel.org/stable/c/cba9ccb47e9fa4cc77692fb896cc5ab57a667882" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/de017c22135f545ca4e65d1eada22887b64958eb", "url": "https://git.kernel.org/stable/c/de017c22135f545ca4e65d1eada22887b64958eb" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-26961", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix llsec key resources release in mac802154_llsec_key_del\n\nmac802154_llsec_key_del() can free resources of a key directly without\nfollowing the RCU rules for waiting before the end of a grace period. This\nmay lead to use-after-free in case llsec_lookup_key() is traversing the\nlist of keys in parallel with a key deletion:\n\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0\nModules linked in:\nCPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x162/0x2a0\nCall Trace:\n \n llsec_lookup_key.isra.0+0x890/0x9e0\n mac802154_llsec_encrypt+0x30c/0x9c0\n ieee802154_subif_start_xmit+0x24/0x1e0\n dev_hard_start_xmit+0x13e/0x690\n sch_direct_xmit+0x2ae/0xbc0\n __dev_queue_xmit+0x11dd/0x3c20\n dgram_sendmsg+0x90b/0xd60\n __sys_sendto+0x466/0x4c0\n __x64_sys_sendto+0xe0/0x1c0\n do_syscall_64+0x45/0xf0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nAlso, ieee802154_llsec_key_entry structures are not freed by\nmac802154_llsec_key_del():\n\nunreferenced object 0xffff8880613b6980 (size 64):\n comm \"iwpan\", pid 2176, jiffies 4294761134 (age 60.475s)\n hex dump (first 32 bytes):\n 78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x.......\".......\n 00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................\n backtrace:\n [] __kmem_cache_alloc_node+0x1e2/0x2d0\n [] kmalloc_trace+0x25/0xc0\n [] mac802154_llsec_key_add+0xac9/0xcf0\n [] ieee802154_add_llsec_key+0x5a/0x80\n [] nl802154_add_llsec_key+0x426/0x5b0\n [] genl_family_rcv_msg_doit+0x1fe/0x2f0\n [] genl_rcv_msg+0x531/0x7d0\n [] netlink_rcv_skb+0x169/0x440\n [] genl_rcv+0x28/0x40\n [] netlink_unicast+0x53c/0x820\n [] netlink_sendmsg+0x93b/0xe60\n [] ____sys_sendmsg+0xac5/0xca0\n [] ___sys_sendmsg+0x11d/0x1c0\n [] __sys_sendmsg+0xfa/0x1d0\n [] do_syscall_64+0x45/0xf0\n [] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nHandle the proper resource release in the RCU callback function\nmac802154_llsec_key_del_rcu().\n\nNote that if llsec_lookup_key() finds a key, it gets a refcount via\nllsec_key_get() and locally copies key id from key_entry (which is a\nlist element). So it's safe to call llsec_key_put() and free the list\nentry after the RCU grace period elapses.\n\nFound by Linux Verification Center (linuxtesting.org).", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-26961" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/068ab2759bc0b4daf0b964de61b2731449c86531", "url": "https://git.kernel.org/stable/c/068ab2759bc0b4daf0b964de61b2731449c86531" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/20d3e1c8a1847497269f04d874b2a5818ec29e2d", "url": "https://git.kernel.org/stable/c/20d3e1c8a1847497269f04d874b2a5818ec29e2d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/49c8951680d7b76fceaee89dcfbab1363fb24fd1", "url": "https://git.kernel.org/stable/c/49c8951680d7b76fceaee89dcfbab1363fb24fd1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/640297c3e897bd7e1481466a6a5cb9560f1edb88", "url": "https://git.kernel.org/stable/c/640297c3e897bd7e1481466a6a5cb9560f1edb88" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d3d858650933d44ac12c1f31337e7110c2071821", "url": "https://git.kernel.org/stable/c/d3d858650933d44ac12c1f31337e7110c2071821" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dcd51ab42b7a0431575689c5f74b8b6efd45fc2f", "url": "https://git.kernel.org/stable/c/dcd51ab42b7a0431575689c5f74b8b6efd45fc2f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e8a1e58345cf40b7b272e08ac7b32328b2543e40", "url": "https://git.kernel.org/stable/c/e8a1e58345cf40b7b272e08ac7b32328b2543e40" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "release_date": "2024-05-01T06:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53195", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()\n\nbuild_i2c_fw_hdr() allocates a fixed-size buffer of\n(16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then\ncopies le16_to_cpu(img_header->Length) bytes into it without\nvalidating that Length fits within the available space after the\nfirmware record header.\n\nimg_header->Length is a __le16 from the firmware file and can be\nup to 65535. check_fw_sanity() validates the total firmware size\nbut not img_header->Length specifically.\n\nFix by rejecting images where img_header->Length exceeds the\navailable destination space.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53195" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae", "url": "https://git.kernel.org/stable/c/0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/130d6567eb148040eed1b73e1414ad6c27d22bd5", "url": "https://git.kernel.org/stable/c/130d6567eb148040eed1b73e1414ad6c27d22bd5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/294692d3296eee3391c348d7ea6401916d27806c", "url": "https://git.kernel.org/stable/c/294692d3296eee3391c348d7ea6401916d27806c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2fd64bf0ad66ab5de0c73524591d879427ba5aba", "url": "https://git.kernel.org/stable/c/2fd64bf0ad66ab5de0c73524591d879427ba5aba" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3e187152f44d76d7633a3855ffd0099e1588b82a", "url": "https://git.kernel.org/stable/c/3e187152f44d76d7633a3855ffd0099e1588b82a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4cb722747ed25971f35cc47ce5c0e79d7f717713", "url": "https://git.kernel.org/stable/c/4cb722747ed25971f35cc47ce5c0e79d7f717713" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a79b634ee58786ca627268daefa7744f2af2e14", "url": "https://git.kernel.org/stable/c/5a79b634ee58786ca627268daefa7744f2af2e14" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b7faf660eefa2047ebc2959ff76da2b6eae2e9e3", "url": "https://git.kernel.org/stable/c/b7faf660eefa2047ebc2959ff76da2b6eae2e9e3" } ], "release_date": "2026-06-25T09:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90000", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: rmi: fix OOB access with undersized RMI reports\n\nThe hid-rmi driver sizes its writeReport/readReport buffer purely from\nthe report descriptor supplied by the device, with no minimum bound:\n\n\tdata->input_report_size = hid_report_len(input_report);\n\tdata->output_report_size = hid_report_len(output_report);\n\talloc_size = data->output_report_size + data->input_report_size;\n\tdata->writeReport = devm_kzalloc(&hdev->dev, alloc_size, GFP_KERNEL);\n\tdata->readReport = data->writeReport + data->output_report_size;\n\nbut then reads and writes fixed offsets into it. A device declaring a\n1-byte output and a 1-byte input report makes hid_report_len() return 2\nfor each, so alloc_size is 4, while rmi_set_page() -- reached\nunconditionally at probe time through rmi_input_configured() -- stores\nwriteReport[4] and rmi_hid_read_block() stores writeReport[0..5]. Since\nreadReport lives at writeReport + output_report_size, those stores also\ncorrupt the window the next reply is parsed out of.\n\nThe read path is worse: the copy length comes from readReport[1], which\nthe device fills in and can be up to 255, and the copy starts at\n&readReport[2] with no regard for input_report_size, so it runs past the\nend of the allocation into adjacent slab objects. This does not even\nneed a lying device -- rmi_f01_probe() issues a fixed 21-byte register\nread, so any device declaring an input report smaller than 23 bytes\nreads out of bounds even when it answers truthfully. Those bytes become\nthe register values the RMI core acts on: rmi_f01_probe() prints them to\nthe kernel log as the product id and exports them through the mode 0444\nsysfs attribute of the same name, and rmi_driver_set_irq_bits() sends\nthem back to the device as the interrupt mask, so an undersized report\ndescriptor leaks heap contents both to unprivileged userspace and to the\ndevice itself.\n\nThe write path has no bound either: rmi_hid_write_block() copies an\nunbounded len to &writeReport[4], and the largest caller a device can\ndrive at probe time is rmi_driver_set_irq_bits(), whose length is\nderived from the interrupt source counts the device declares in its Page\nDescription Table.\n\nFinally, the read loop cannot terminate on a zero-length reply: such a\nreply copies nothing and advances neither bytes_read nor bytes_needed,\nand because a reply did arrive the one second wait_event_timeout() does\nnot fire either, so a device answering 0 forever keeps the loop running\ninside the probe worker with page_mutex held. khungtaskd does not\nnotice, because every reply wakes the task.\n\nReject reports too small for what the driver builds -- 6 output bytes\nfor the write reports and 3 input bytes for the read handshake -- at\nprobe time, clamp the write and the read copy to the report sizes the\ndevice declared, and treat a zero-length reply as an error. A device\nrefused this way is started as an ordinary HID device, like one that\ndoes not carry the RMI report ids at all.\n\nRMI_DEVICE must not be left set in device_flags on that path, because\nrmi_input_configured() would then run the RMI setup and reach\nrmi_set_page(), which writes the writeReport buffer the refusal just\nskipped allocating. The bit can arrive set: rmi_probe() copies\nid->driver_data into device_flags before the report checks, and a bind\nthrough the new_id sysfs attribute can supply driver_data with\nRMI_DEVICE (BIT(0)) set. Strip the bit where driver_data is copied, so\nRMI_DEVICE keeps meaning exactly \"this probe validated the reports\"; the\nthree jumps to start that predate this patch are covered as well.\n\nThe error path also clears RMI_READ_DATA_PENDING on its way out, because\nthat flag is what the wait at the top of the loop tests: leaving it set\nwould make every later wait_event_timeout() return immediately on the\nstale reply and kill the read path for the rest of the device's life.\n\nClamping does not regress working hardware: the read loop already\nhandles\n---truncated---", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90000" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/056ef8e6700b8b6ca11453a9d4bfb1b868a5cd88", "url": "https://git.kernel.org/stable/c/056ef8e6700b8b6ca11453a9d4bfb1b868a5cd88" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/183da103022ec11af55ba9951d2cc171fb6c836b", "url": "https://git.kernel.org/stable/c/183da103022ec11af55ba9951d2cc171fb6c836b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/48934c2927414a37a7fadeb6091113177c0b2038", "url": "https://git.kernel.org/stable/c/48934c2927414a37a7fadeb6091113177c0b2038" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4956993bb3befdf791d71a4952d8d13bcfd44c7b", "url": "https://git.kernel.org/stable/c/4956993bb3befdf791d71a4952d8d13bcfd44c7b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a8be8bbf0952bb7ff46636ead1896769c381fe55", "url": "https://git.kernel.org/stable/c/a8be8bbf0952bb7ff46636ead1896769c381fe55" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ab2958e0c94edd63315dd14dc548874cc63a4043", "url": "https://git.kernel.org/stable/c/ab2958e0c94edd63315dd14dc548874cc63a4043" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f4cb9c4556dcb593e66dbb855179dbd351dbb053", "url": "https://git.kernel.org/stable/c/f4cb9c4556dcb593e66dbb855179dbd351dbb053" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fba600d824597b2a894ecae72fc422c2b8c08f8c", "url": "https://git.kernel.org/stable/c/fba600d824597b2a894ecae72fc422c2b8c08f8c" } ], "release_date": "2026-09-16T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-97564", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject userspace cifs.idmap descriptions\n\ncifs.idmap key descriptions carry authority-bearing fields (owner and\ngroup SIDs and uid/gid values in \"os:\"/\"gs:\"/\"oi:\"/\"gi:\" form) that the\ncifs.idmap upcall helper treats as kernel-originating inputs. Unlike\nits sibling cifs.spnego, the cifs.idmap key type has no vet_description\nhook, so userspace can create keys of this type through\nrequest_key(2)/add_key(2) and supply those fields without CIFS origin.\nA request_key(2) call with a non-NULL callout then drives a root\nusermodehelper upcall (/sbin/request-key -> cifs.idmap) that consumes\nthe unvetted description in root context.\n\nOnly accept cifs.idmap descriptions while CIFS is using its private\nroot_cred to request the key. id_to_sid()/sid_to_id() already run\nunder override_creds(root_cred), so the kernel-originated path is\nunaffected.\n\nThis mirrors commit 3da1fdf4efbc (\"smb: client: reject userspace\ncifs.spnego descriptions\"), which applied the same restriction to\ncifs.spnego.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97564" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/17c93bcd17755523c21abb22cbf2a41a6eb0caaf", "url": "https://git.kernel.org/stable/c/17c93bcd17755523c21abb22cbf2a41a6eb0caaf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1d3b24b16a0b013792e8f1e3ed060f0b46f537d1", "url": "https://git.kernel.org/stable/c/1d3b24b16a0b013792e8f1e3ed060f0b46f537d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/96751028c0d4dec785709ea3eb0ab38a4f2ded96", "url": "https://git.kernel.org/stable/c/96751028c0d4dec785709ea3eb0ab38a4f2ded96" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d9d7eeb0cea5b55b82888f443622fd8d4ee064f3", "url": "https://git.kernel.org/stable/c/d9d7eeb0cea5b55b82888f443622fd8d4ee064f3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e5964064e3fbe6325893408faff08ca33de0e2c3", "url": "https://git.kernel.org/stable/c/e5964064e3fbe6325893408faff08ca33de0e2c3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6a", "url": "https://git.kernel.org/stable/c/f29c1ec0e7d8c887a91df3f93bb4617c0ac95c6a" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98015", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put\n\nIn mlx5_eswitch_termtbl_put(), the zero-ref cleanup check reads\ntt->ref_count after termtbl_mutex has been released. Two concurrent\ncallers on the same mlx5_termtbl_handle race: one decrements ref_count\nto zero, removes the hash entry, and calls kfree(tt) while the other\nhas already dropped the mutex and is about to evaluate\nif (!tt->ref_count), producing a use-after-free.\n\nFix this by capturing the result of the decrement into a stack-local\nlast variable before dropping the mutex. The cleanup decision is now\nmade entirely under termtbl_mutex, and tt is not touched after\nkfree.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98015" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/18b2969073879b9cce24e1a78b118bdad54518d1", "url": "https://git.kernel.org/stable/c/18b2969073879b9cce24e1a78b118bdad54518d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/304ea40ef4561671503c36e47da44a0a31b71e36", "url": "https://git.kernel.org/stable/c/304ea40ef4561671503c36e47da44a0a31b71e36" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7ee07f601f8f507c9faf25c68a49396ab8950596", "url": "https://git.kernel.org/stable/c/7ee07f601f8f507c9faf25c68a49396ab8950596" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/92f581cac93a71723456ac79ef54d9f60a251b42", "url": "https://git.kernel.org/stable/c/92f581cac93a71723456ac79ef54d9f60a251b42" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a5833fdf53350b8b95a558fcf0056ddb1c0fe154", "url": "https://git.kernel.org/stable/c/a5833fdf53350b8b95a558fcf0056ddb1c0fe154" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797", "url": "https://git.kernel.org/stable/c/b1398c9dfb5d3d4faaf6905ff7d98110a5d2c797" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e393789e92310d7c66f57c876101779c90816a12", "url": "https://git.kernel.org/stable/c/e393789e92310d7c66f57c876101779c90816a12" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3ee194a790896fa92fea20b5385a354be2f2c12", "url": "https://git.kernel.org/stable/c/e3ee194a790896fa92fea20b5385a354be2f2c12" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89481", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-tcp: fix host memory disclosure on R2T for a read command\n\nnvme_tcp_handle_r2t() does not check the direction of the request the\nR2T refers to. A malicious controller can send an R2T for a READ and\nthe host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the\nH2CData header and nvme_tcp_try_send_data() sends the request's data\nbuffer. That buffer is the READ destination, so its contents go to the\ncontroller.\n\nThe command then completes normally and nothing is logged.\n\nAgainst a test controller that answers every READ with an R2T, a 4096\nbyte buffered read returned all 4096 bytes, split over two R2Ts. The\npages contained stale kernel data, including an array of struct page\npointers.\n\nReject an R2T for a request that is not a write.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89481" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5", "url": "https://git.kernel.org/stable/c/3a0b05145053a5fad1a2ddb4e4d87b07385e63e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c", "url": "https://git.kernel.org/stable/c/3b3d27670c0c890ba7cf1bc3614cab61bde6d25c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/49a4dcf57608ebf6432dbcb203ed25e7ed581445", "url": "https://git.kernel.org/stable/c/49a4dcf57608ebf6432dbcb203ed25e7ed581445" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8", "url": "https://git.kernel.org/stable/c/6efbc52237facda35d2d874fe1765bb4839275d8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403", "url": "https://git.kernel.org/stable/c/a4c3c7310156493797c920b10d8648c07aa05403" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bc4013c7cce58d46f792c8c87bc8c8318a70190e", "url": "https://git.kernel.org/stable/c/bc4013c7cce58d46f792c8c87bc8c8318a70190e" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68377", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_tunnel_key: Defer dst_release to RCU callback\n\nFix a race-condition use-after-free in tunnel_key_release_params().\n\nThe function releases the metadata_dst of the old params synchronously\nvia dst_release() while deferring the params struct free with\nkfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may\nstill hold the old params pointer (under rcu_read_lock_bh) and proceed\nto call dst_clone(¶ms->tcft_enc_metadata->dst) after the writer's\ndst_release has already pushed the dst's rcuref to RCUREF_DEAD.\n\nzdi-disclosures@trendmicro.com produced a poc which i (and Victor) verified\nthat KASAN reports:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112\nBUG: KASAN: slab-use-after-free in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326\nBUG: KASAN: slab-use-after-free in __rcuref_put include/linux/rcuref.h:109\nBUG: KASAN: slab-use-after-free in rcuref_put include/linux/rcuref.h:173\nBUG: KASAN: slab-use-after-free in dst_release+0x5b/0x370 net/core/dst.c:168\nWrite of size 4 at addr ffff88806158de40 by task poc/9388\n\nCPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy)\nTainted: [W]=WARN\nHardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n \n __dump_stack lib/dump_stack.c:94\n dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378\n print_report+0x139/0x4ad mm/kasan/report.c:482\n kasan_report+0xe4/0x1d0 mm/kasan/report.c:595\n check_region_inline mm/kasan/generic.c:186\n kasan_check_range+0x125/0x200 mm/kasan/generic.c:200\n instrument_atomic_read_write include/linux/instrumented.h:112\n atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326\n __rcuref_put include/linux/rcuref.h:109\n rcuref_put include/linux/rcuref.h:173\n dst_release+0x5b/0x370 net/core/dst.c:168\n refdst_drop include/net/dst.h:272\n skb_dst_drop include/net/dst.h:284\n skb_release_head_state+0x293/0x400 net/core/skbuff.c:1163\n skb_release_all net/core/skbuff.c:1187\n[..]\nAllocated by task 9391:\n kasan_save_stack+0x30/0x50 mm/kasan/common.c:57\n kasan_save_track+0x14/0x30 mm/kasan/common.c:78\n poison_kmalloc_redzone mm/kasan/common.c:398\n __kasan_kmalloc+0x9a/0xb0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263\n __do_kmalloc_node mm/slub.c:5296\n __kmalloc_noprof+0x2f1/0x830 mm/slub.c:5308\n kmalloc_noprof include/linux/slab.h:954\n kzalloc_noprof include/linux/slab.h:1188\n offload_action_alloc+0x2f/0x130 net/core/flow_offload.c:35\n tcf_action_offload_add_ex+0x1ba/0x880 net/sched/act_api.c:258\n tcf_action_offload_add net/sched/act_api.c:293\n tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547\n tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101\n[..]\nFreed by task 9391:\n kasan_save_stack+0x30/0x50 mm/kasan/common.c:57\n kasan_save_track+0x14/0x30 mm/kasan/common.c:78\n kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584\n poison_slab_object mm/kasan/common.c:253\n __kasan_slab_free+0x6b/0x90 mm/kasan/common.c:285\n kasan_slab_free include/linux/kasan.h:235\n slab_free_hook mm/slub.c:2689\n slab_free mm/slub.c:6251\n kfree+0x21f/0x6b0 mm/slub.c:6566\n tcf_action_offload_add_ex+0x4ad/0x880 net/sched/act_api.c:284\n tcf_action_offload_add net/sched/act_api.c:293\n tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547\n tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101\n\nThe buggy address belongs to the object at ffff88806158de00\n which belongs to the cache kmalloc-256 of size 256\nThe buggy address is located 64 bytes inside of\n freed 256-byte region [ffff88806158de00, ffff88806158df00)\n\nThe buggy address belongs to the physical page:\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c\nhead: order:1 mapcount:0 entire_map\n---truncated---", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68377" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2200a00ff247f70f5dcdb4e6f14b0d48ddac5467", "url": "https://git.kernel.org/stable/c/2200a00ff247f70f5dcdb4e6f14b0d48ddac5467" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2791a501da508b704a617b4dba29db54a65bc9f7", "url": "https://git.kernel.org/stable/c/2791a501da508b704a617b4dba29db54a65bc9f7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/389d03992dabb80488228e8119b9dd6d0f58e1a6", "url": "https://git.kernel.org/stable/c/389d03992dabb80488228e8119b9dd6d0f58e1a6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/531dbb5bb98e52ad26be7e90f9f8bec707c5bd0e", "url": "https://git.kernel.org/stable/c/531dbb5bb98e52ad26be7e90f9f8bec707c5bd0e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/676ad6aa7cec89a08d2a5ce3cd5959e313f29733", "url": "https://git.kernel.org/stable/c/676ad6aa7cec89a08d2a5ce3cd5959e313f29733" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b5931f020b681fdcb9378262d89b61cb3c7ebbf8", "url": "https://git.kernel.org/stable/c/b5931f020b681fdcb9378262d89b61cb3c7ebbf8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1f5c8a3955f8fda3f84ed883ac8daa1847e724c", "url": "https://git.kernel.org/stable/c/f1f5c8a3955f8fda3f84ed883ac8daa1847e724c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fed1b1ddab41a0e7a462ac690a0c8af6ff793624", "url": "https://git.kernel.org/stable/c/fed1b1ddab41a0e7a462ac690a0c8af6ff793624" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-90103", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.2: fix LAYOUTSTATS send buffer exhaustion\n\nencode_layoutstats_maxsz budgets XDR_QUADLEN(PNFS_LAYOUTSTATS_MAXSIZE),\ni.e. 256 bytes, for the layoutupdate4 body written by the layout driver.\nThe flexfiles record can exceed that.\n\nff_layout_encode_ff_layoutupdate() emits, per data server, a netaddr4,\nan nfs_fh4, two ff_io_latency4, an nfstime4 and a bool. A data server\nwhose filehandle is NFS_MAXFHSIZE bytes long already accounts for 132 of\nthose bytes, and the two ff_io_latency4 at 64 bytes each, the nfstime4\nand the bool add a further 144, so the body passes 256 bytes before the\nnetaddr4 is encoded at all. encode_layoutstats() additionally writes\nthe deviceid4 and the layoutupdate4 lou_type word, neither of which the\nmacro accounts for.\n\nThe filehandle and the address are both chosen by the server, through\nLAYOUTGET and GETDEVICEINFO, so it can drive the encoder past the\nend of the send buffer. xdr_reserve_space() returns NULL once that\nhappens, and the two ff_layout_encode_io_latency() calls run with\ndss_info->mirror->lock held, so a NULL return there leaves the lock\npermanently held.\n\nRaise PNFS_LAYOUTSTATS_MAXSIZE to 384 so that the record fits inside the\nreservation.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90103" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3815b894b922e9b4f40b8b6f6d67bf80d44141c9", "url": "https://git.kernel.org/stable/c/3815b894b922e9b4f40b8b6f6d67bf80d44141c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/397aa7000bbf6b6a0d32e66a544e978fb478c8e4", "url": "https://git.kernel.org/stable/c/397aa7000bbf6b6a0d32e66a544e978fb478c8e4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5aca000630c0fd0da102ae1abf9245dd74f2ce36", "url": "https://git.kernel.org/stable/c/5aca000630c0fd0da102ae1abf9245dd74f2ce36" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/842ac26615424577f24f0486b9d3bf97f28fad9c", "url": "https://git.kernel.org/stable/c/842ac26615424577f24f0486b9d3bf97f28fad9c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a973622da0c62c34043ddbbf382cd761b03e5136", "url": "https://git.kernel.org/stable/c/a973622da0c62c34043ddbbf382cd761b03e5136" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c75ef2137e749f2673f0617cfdaae53b2bb7195a", "url": "https://git.kernel.org/stable/c/c75ef2137e749f2673f0617cfdaae53b2bb7195a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cb11590c7ddc6883a1b1d70b1f98b2779fe626f2", "url": "https://git.kernel.org/stable/c/cb11590c7ddc6883a1b1d70b1f98b2779fe626f2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e82d7d999fe9f893f84bf332fd39cb5d9de7128f", "url": "https://git.kernel.org/stable/c/e82d7d999fe9f893f84bf332fd39cb5d9de7128f" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74580", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok() returns early on a cache hit,\ntaking the hit as proof that the region has already been validated:\n\n\tif (vhost_vq_meta_fetch(vq, addr, len, type))\n\t\treturn true;\n\nThe cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on\ndevice IOTLB (re)initialisation and on vq reset, but not when\nVHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when\nVHOST_SET_VRING_NUM changes the region sizes.\n\nWith a device IOTLB attached both ioctls are accepted while the vq is\nlive, and neither validates the addresses at ioctl time: vq_access_ok()\nand vq_log_used_access_ok() return true early because the addresses are\nGIOVAs, deferring validation to prefetch time. Once the cache has been\npopulated that deferred validation no longer runs -- vq_meta_prefetch()\nhits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps\ntranslating through the old mapping as\n\n\tmap->addr + addr - map->start\n\nfor an address the mapping no longer covers. vhost_copy_to_user() and\nvhost_copy_from_user() consume the result with __copy_to_user() and\n__copy_from_user(), which do not check it either, so a subsequent used\nring update or descriptor fetch accesses memory outside the region the\nIOTLB actually maps.\n\nReset the metadata cache whenever the vring is reconfigured, so the new\naddresses are pushed back through iotlb_access_ok()'s slow path.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74580" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af", "url": "https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95", "url": "https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a", "url": "https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b", "url": "https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85", "url": "https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7", "url": "https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5", "url": "https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6", "url": "https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/10/14/2", "url": "http://www.openwall.com/lists/oss-security/2026/10/14/2" }, { "category": "external", "summary": "https://github.com/YounesHfa/CVE-2026-74580", "url": "https://github.com/YounesHfa/CVE-2026-74580" } ], "release_date": "2026-08-21T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-45916", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: sbs-battery: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle. Keep the old behavior of\njust printing a warning in case of any failures during the IRQ request\nand finishing the probe successfully.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-45916" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14d4dee5d8fb361bfff275832087254beab66d72", "url": "https://git.kernel.org/stable/c/14d4dee5d8fb361bfff275832087254beab66d72" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2078830c32d1e49ac942c6f8c21f35c806ae5e94", "url": "https://git.kernel.org/stable/c/2078830c32d1e49ac942c6f8c21f35c806ae5e94" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8010b745b436c3e1ca5dd960aa29fa3e0f6d8841", "url": "https://git.kernel.org/stable/c/8010b745b436c3e1ca5dd960aa29fa3e0f6d8841" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/82d3eb97a976c9d56bb92b241397610e57a9c629", "url": "https://git.kernel.org/stable/c/82d3eb97a976c9d56bb92b241397610e57a9c629" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/861dda7a9074c0ff67788928165ae39d7f647491", "url": "https://git.kernel.org/stable/c/861dda7a9074c0ff67788928165ae39d7f647491" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8d59cf3887fbabacef53bfba473e33e8a8d9d07b", "url": "https://git.kernel.org/stable/c/8d59cf3887fbabacef53bfba473e33e8a8d9d07b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ca7dd71773e4e050b0fb98768b7eae60f8d1f38b", "url": "https://git.kernel.org/stable/c/ca7dd71773e4e050b0fb98768b7eae60f8d1f38b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1f472b14ad56104ba228b8fbec60d5b21829913", "url": "https://git.kernel.org/stable/c/f1f472b14ad56104ba228b8fbec60d5b21829913" } ], "release_date": "2026-05-27T14:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53228", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sit: reload inner IPv6 header after GSO offloads\n\nipip6_tunnel_xmit() caches the inner IPv6 header pointer at function\nentry and continues using it after iptunnel_handle_offloads().\n\nFor GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().\nWhen the skb header is cloned, skb_header_unclone() can call\npskb_expand_head(), which may move the skb head. The pskb_expand_head()\ncontract requires pointers into the skb header to be reloaded after the\ncall.\n\nIf the later skb_realloc_headroom() branch is not taken, SIT uses the\nstale iph6 pointer to read the inner hop limit and DS field. That can\nread from a freed skb head after the old head's remaining clone is\nreleased.\n\nReload iph6 after the offload helper succeeds and before subsequent\nreads from the inner IPv6 header. Keep the existing reload after\nskb_realloc_headroom(), since that branch can also replace the skb.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53228" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0", "url": "https://git.kernel.org/stable/c/0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1132e5edc2866c3530be17622153a597095f0e43", "url": "https://git.kernel.org/stable/c/1132e5edc2866c3530be17622153a597095f0e43" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2fa49b2715e1bad12ce3b0fa64e234d9582c8193", "url": "https://git.kernel.org/stable/c/2fa49b2715e1bad12ce3b0fa64e234d9582c8193" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/59f80c919713250fe5d25a4d9aea4e49580fa1d4", "url": "https://git.kernel.org/stable/c/59f80c919713250fe5d25a4d9aea4e49580fa1d4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9c67b44edb3598d234efae6e44649eb993c03da5", "url": "https://git.kernel.org/stable/c/9c67b44edb3598d234efae6e44649eb993c03da5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c", "url": "https://git.kernel.org/stable/c/cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f0e42f0c4337b1f220de1ddd63f47197c7dee4de", "url": "https://git.kernel.org/stable/c/f0e42f0c4337b1f220de1ddd63f47197c7dee4de" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fddd41445a0537b093e6b3f6232c9933cad1e48b", "url": "https://git.kernel.org/stable/c/fddd41445a0537b093e6b3f6232c9933cad1e48b" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" } ], "release_date": "2026-06-25T09:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-80601", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: gw: acquire ethernet header only after skb realloc\n\nThe pskb_may_pull() called by batadv_get_vid() could reallocate the buffer\nbehind the skb. Variables which were pointing to the old buffer need to be\nreassigned to avoid an use-after-free.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-80601" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2760b38222c8828b075802342fe3b91eb823d542", "url": "https://git.kernel.org/stable/c/2760b38222c8828b075802342fe3b91eb823d542" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6c37f1166549c999ccd164b0cb6462d1ae68f8f6", "url": "https://git.kernel.org/stable/c/6c37f1166549c999ccd164b0cb6462d1ae68f8f6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/77880a3be88d378d60cc1e8f8ec70430e2ed0518", "url": "https://git.kernel.org/stable/c/77880a3be88d378d60cc1e8f8ec70430e2ed0518" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/916dac5f2944f63f07f7b501acbea6737dbbed0e", "url": "https://git.kernel.org/stable/c/916dac5f2944f63f07f7b501acbea6737dbbed0e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/afac8096bde4948e3caa7e4dd733867cfbd3018e", "url": "https://git.kernel.org/stable/c/afac8096bde4948e3caa7e4dd733867cfbd3018e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b79884a5567bf788fb76c30832467cf6a56f3c0d", "url": "https://git.kernel.org/stable/c/b79884a5567bf788fb76c30832467cf6a56f3c0d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3f4325e35dd6e76b80665f3510738ce34819753", "url": "https://git.kernel.org/stable/c/e3f4325e35dd6e76b80665f3510738ce34819753" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e6b43acd34b219b807e65096ce207b087942779d", "url": "https://git.kernel.org/stable/c/e6b43acd34b219b807e65096ce207b087942779d" } ], "release_date": "2026-08-28T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74667", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: reset the MAC header on the packet-socket transmit path\n\npacket_parse_headers() resets the MAC header only for a SOCK_RAW frame\nwhose socket did not bind a protocol. A protocol-bound SOCK_RAW socket,\nany SOCK_DGRAM frame, and the legacy SOCK_PACKET path therefore leave\nskb->mac_header unset here.\n\nFor frames sent via __dev_queue_xmit() this is harmless: it resets the\nMAC header unconditionally. But the packet-socket PACKET_QDISC_BYPASS\npath uses dev_direct_xmit(), which does not, so the frame reaches\nndo_start_xmit() with the MAC header unset. A driver that reads\neth_hdr(skb) on transmit then dereferences skb->head + (u16)~0, an\nout-of-bounds access ~64 KiB past the head -- the same class fixed for\none consumer in commit f5089008f90c (\"macsec: do not read an unset MAC\nheader in macsec_encrypt()\").\n\npacket_parse_headers() runs only on the transmit path, where skb->data\npoints at the start of the L2 header for every packet-socket type\nregardless of its length: SOCK_RAW and SOCK_PACKET carry a user-supplied\nheader and SOCK_DGRAM has one built by dev_hard_header(). Reset the MAC\nheader unconditionally, mirroring __dev_queue_xmit(), so the frame is\nanchored on the bypass path too.\n\nFound by 0sec (https://0sec.ai) using automated source analysis;\nverified against source and matched to the macsec KASAN report in\nf5089008f90c. Compile-tested.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74667" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1e43a1d66615f411d427f9df1f46dd049d9e3681", "url": "https://git.kernel.org/stable/c/1e43a1d66615f411d427f9df1f46dd049d9e3681" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2610ed4e86a4590234a9d70518c469751c5af231", "url": "https://git.kernel.org/stable/c/2610ed4e86a4590234a9d70518c469751c5af231" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d", "url": "https://git.kernel.org/stable/c/284f3e7a3f1a743fdf89e304fd1f19d5ffcff46d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4057853a91fb796c4f47c7d1baf1aa085394148e", "url": "https://git.kernel.org/stable/c/4057853a91fb796c4f47c7d1baf1aa085394148e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/971aa7d99242bbf09513e27b7a243f0b29ff23ae", "url": "https://git.kernel.org/stable/c/971aa7d99242bbf09513e27b7a243f0b29ff23ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b47ba8fe6e1d2df8c92048de5afafd059447dc30", "url": "https://git.kernel.org/stable/c/b47ba8fe6e1d2df8c92048de5afafd059447dc30" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c2707480cfbf19c7619acc9c089d17f20869821f", "url": "https://git.kernel.org/stable/c/c2707480cfbf19c7619acc9c089d17f20869821f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fdd4d7d52358a58e351dd9d82530c04eba8ccd7a", "url": "https://git.kernel.org/stable/c/fdd4d7d52358a58e351dd9d82530c04eba8ccd7a" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68156", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: refresh auth->authorizer_buf{,_len} after authorizer update\n\nceph_x_create_authorizer() caches au->buf->vec.iov_base and\nau->buf->vec.iov_len in struct ceph_auth_handshake. These\ncached values are then used by the messenger connect code when\nsending the authorizer.\n\nceph_x_update_authorizer() can rebuild the authorizer when a newer\nservice ticket is available. If the rebuilt authorizer no longer\nfits in the existing buffer, ceph_x_build_authorizer() drops its\nreference to au->buf and allocates a new one. If this is the final\nreference, ceph_buffer_put() frees the old ceph_buffer and its\nvec.iov_base, but auth->authorizer_buf still points at that freed\nmemory.\n\nA subsequent msgr1 reconnect can therefore queue the stale pointer\nand trigger a KASAN slab-use-after-free in _copy_from_iter() while\ntcp_sendmsg() copies the authorizer.\n\nRefresh auth->authorizer_buf and auth->authorizer_buf_len after a\nsuccessful authorizer rebuild so the messenger sends the current\nbuffer.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68156" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0060ec912292a550198d8d18ac95b433c92a7091", "url": "https://git.kernel.org/stable/c/0060ec912292a550198d8d18ac95b433c92a7091" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2334e9997308305ee4fd508fdfe6086c4150ed60", "url": "https://git.kernel.org/stable/c/2334e9997308305ee4fd508fdfe6086c4150ed60" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26f814187abceee90dbb29a02133adb4786fbb13", "url": "https://git.kernel.org/stable/c/26f814187abceee90dbb29a02133adb4786fbb13" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5ecfcd5c05866f185357700b81b461dae4f5ebb2", "url": "https://git.kernel.org/stable/c/5ecfcd5c05866f185357700b81b461dae4f5ebb2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/75e82e8944ac1efe9fdb88bd2f14d9a031282bdf", "url": "https://git.kernel.org/stable/c/75e82e8944ac1efe9fdb88bd2f14d9a031282bdf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/79a273df64238a4ade8b709689a78589f755b8ef", "url": "https://git.kernel.org/stable/c/79a273df64238a4ade8b709689a78589f755b8ef" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/937d61f86d377a3aa578adae7a3dfcecdddf9d89", "url": "https://git.kernel.org/stable/c/937d61f86d377a3aa578adae7a3dfcecdddf9d89" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9d37aec9ffe4e743dabc3f84502e9723e17a30d4", "url": "https://git.kernel.org/stable/c/9d37aec9ffe4e743dabc3f84502e9723e17a30d4" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74496", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfou: Fix use-after-free in fou_create()\n\nfou_create() publishes struct fou through sk_user_data before adding the\nnew FOU port to the per-netns list. If fou_add_to_port_list() fails,\nthe error path frees fou while it is still reachable through\nsk_user_data. A concurrent receive can then dereference the freed\nobject in fou_from_sock().\n\nThis ordering issue was previously noted in the linked discussion.\n\nThe failure is reachable when local port 0 is requested. Each socket\nbinds to a different ephemeral port, but fou_cfg_cmp() compares the\nrequested port 0 and reports -EALREADY once an entry already exists.\n\nRelease the tunnel socket before freeing fou so sk_user_data is cleared\nfirst, and defer reclamation with kfree_rcu() to protect concurrent RCU\nreaders. This matches the lifetime handling in fou_release().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74496" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0ee628a58d83e571f36ec9f07624d6845e420c50", "url": "https://git.kernel.org/stable/c/0ee628a58d83e571f36ec9f07624d6845e420c50" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/58835985c035a8333742f829ad7e0889a082f9d3", "url": "https://git.kernel.org/stable/c/58835985c035a8333742f829ad7e0889a082f9d3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9042867d4701728f0c6527215b11471759904d8f", "url": "https://git.kernel.org/stable/c/9042867d4701728f0c6527215b11471759904d8f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/99f4d3120b244f92e5df787152041296a2860cb5", "url": "https://git.kernel.org/stable/c/99f4d3120b244f92e5df787152041296a2860cb5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a28d8903bfe76089ea4bbdbff9976965f9ef8107", "url": "https://git.kernel.org/stable/c/a28d8903bfe76089ea4bbdbff9976965f9ef8107" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a6fca682cfa2041e31aa72cc397c4a1406eb7468", "url": "https://git.kernel.org/stable/c/a6fca682cfa2041e31aa72cc397c4a1406eb7468" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b14361aca6350ff7907b0e9903c7b94dc7d5d4a0", "url": "https://git.kernel.org/stable/c/b14361aca6350ff7907b0e9903c7b94dc7d5d4a0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b3f9c3e60aa25453774f899d25b5e61dd0bec1d5", "url": "https://git.kernel.org/stable/c/b3f9c3e60aa25453774f899d25b5e61dd0bec1d5" } ], "release_date": "2026-08-15T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98217", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx4: Fix use-after-free on pkey sysfs registration failure\n\nregister_pkey_tree() ignores errors from register_one_pkey_tree() and\ncontinues registering the remaining slaves. The per-slave error path has\nalready released the pkey parent kobjects, but their pointers remain\nstored in the device. A later device cleanup therefore passes the stale\npointers to kobject_put(), causing a use-after-free.\n\nClear the parent pointers after releasing a failed slave tree and skip\nunregistered trees during device cleanup. This preserves the existing\nbest-effort registration behavior while preventing a second cleanup of\nthe failed tree.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98217" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c3482e965b18bc242e54e899d1c4d391ca8e5e3", "url": "https://git.kernel.org/stable/c/0c3482e965b18bc242e54e899d1c4d391ca8e5e3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1af874e9f4ce22ccf8b10ab5462f32c70d3be21a", "url": "https://git.kernel.org/stable/c/1af874e9f4ce22ccf8b10ab5462f32c70d3be21a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/734f066933484f6c7cedea0312763249beed5845", "url": "https://git.kernel.org/stable/c/734f066933484f6c7cedea0312763249beed5845" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/791471421d848ce13e84f4b21c9e19973d471c4e", "url": "https://git.kernel.org/stable/c/791471421d848ce13e84f4b21c9e19973d471c4e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a07bee32127d7c4cd3b1bb9a088e21d0c93634c9", "url": "https://git.kernel.org/stable/c/a07bee32127d7c4cd3b1bb9a088e21d0c93634c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ced1186fea7c77e16681c7ef4802897885989c3b", "url": "https://git.kernel.org/stable/c/ced1186fea7c77e16681c7ef4802897885989c3b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cf20d7476754c00eec04ae23d3e929de33ce0345", "url": "https://git.kernel.org/stable/c/cf20d7476754c00eec04ae23d3e929de33ce0345" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ffb80872617b5f9b3dd1536ec2909029fa66f228", "url": "https://git.kernel.org/stable/c/ffb80872617b5f9b3dd1536ec2909029fa66f228" } ], "release_date": "2026-10-06T09:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68144", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nphonet: pep: fix use-after-free in pep_get_sb()\n\npep_get_sb() doesn't consider that pskb_may_pull() might have relocated\nthe skb data, and continue to access the older pointer, causing UAF.\n\nReproduced under KASAN:\n\n BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0\n Read of size 1 at addr ff11000105510f50 by task repro/157\n pep_get_sb+0x234/0x3b0\n pipe_handler_do_rcv+0x5f7/0xa10\n pep_do_rcv+0x203/0x410\n __sk_receive_skb+0x471/0x4a0\n phonet_rcv+0x5b3/0x6c0\n __netif_receive_skb+0xcc/0x1d0\n\nRefetch the header with skb_header_pointer() after pskb_may_pull(), so\nthe possibly stale pointer is no longer dereferenced. There are better\nways to solve this, but, this is the less instrusive one.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68144" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0f71f852a96af9685858ce59fda34ecbf85c283d", "url": "https://git.kernel.org/stable/c/0f71f852a96af9685858ce59fda34ecbf85c283d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/17f78c0c0d41d738ee236eb6e841e39395188054", "url": "https://git.kernel.org/stable/c/17f78c0c0d41d738ee236eb6e841e39395188054" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1d81e19fc57a5ee55b4497d01bc0510d76fb9578", "url": "https://git.kernel.org/stable/c/1d81e19fc57a5ee55b4497d01bc0510d76fb9578" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/25e3641beb51333bfbb155af2fd2573a61113af2", "url": "https://git.kernel.org/stable/c/25e3641beb51333bfbb155af2fd2573a61113af2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8d931a75a38b9bb584a4071f5ebbd52755fc35ee", "url": "https://git.kernel.org/stable/c/8d931a75a38b9bb584a4071f5ebbd52755fc35ee" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a48a889b60f73edb0399a8b08284a2ab0bd0295f", "url": "https://git.kernel.org/stable/c/a48a889b60f73edb0399a8b08284a2ab0bd0295f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c4a52cb4da8d57d060b1d52085d25147a238dac2", "url": "https://git.kernel.org/stable/c/c4a52cb4da8d57d060b1d52085d25147a238dac2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/df198743859fefba2f824115f8151dd62d7ad6d8", "url": "https://git.kernel.org/stable/c/df198743859fefba2f824115f8151dd62d7ad6d8" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-97448", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Add validation for node in acpi_ns_build_normalized_path()\n\nAdd validation for node in acpi_ns_build_normalized_path()\nto prevent use-after-free vulnerabilities.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97448" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/087eed8b347e14864f8806fa1f5976c7dc2c6792", "url": "https://git.kernel.org/stable/c/087eed8b347e14864f8806fa1f5976c7dc2c6792" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/21a73528579fcbd673b668bd27a05b658123bc1b", "url": "https://git.kernel.org/stable/c/21a73528579fcbd673b668bd27a05b658123bc1b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/26dd27000e9540fcb594f15010b0696b03b0d240", "url": "https://git.kernel.org/stable/c/26dd27000e9540fcb594f15010b0696b03b0d240" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/90ebe7f8bb6ca1c6eadb16bed141ab8bb3dbab70", "url": "https://git.kernel.org/stable/c/90ebe7f8bb6ca1c6eadb16bed141ab8bb3dbab70" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/96b2b616870e46e2bc04efec03879683a0036e66", "url": "https://git.kernel.org/stable/c/96b2b616870e46e2bc04efec03879683a0036e66" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b06bb9b82c8f9a522dde213b1e0ddd535f22e3a2", "url": "https://git.kernel.org/stable/c/b06bb9b82c8f9a522dde213b1e0ddd535f22e3a2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/babb146ceb79e71f328788f1e2c8c7c224026e61", "url": "https://git.kernel.org/stable/c/babb146ceb79e71f328788f1e2c8c7c224026e61" } ], "release_date": "2026-09-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-93262", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5-ppl: fix use-after-free in ppl_do_flush()\n\nThe loop in ppl_do_flush() continues iterating after calling\nppl_io_unit_finished(), touching io->pending_flushes and leading to a\nuse-after-free.\n\nAdd a break statement to stop the loop once io is freed.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-93262" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/371f7a1b392edc8b7cf449cc7713179b588f2d0e", "url": "https://git.kernel.org/stable/c/371f7a1b392edc8b7cf449cc7713179b588f2d0e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/455b56209f9615c3902dcc398dd867abb5ade3ab", "url": "https://git.kernel.org/stable/c/455b56209f9615c3902dcc398dd867abb5ade3ab" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8914c3d40870f16429a326e97e4016bedc6ede4c", "url": "https://git.kernel.org/stable/c/8914c3d40870f16429a326e97e4016bedc6ede4c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b5123bf667ac29ddd8106f9ca7cc01316513ae66", "url": "https://git.kernel.org/stable/c/b5123bf667ac29ddd8106f9ca7cc01316513ae66" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cf01f9413565e86673baf927291a088b6975692b", "url": "https://git.kernel.org/stable/c/cf01f9413565e86673baf927291a088b6975692b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e7505842f1329ece90cb9ea0db87772aeca44052", "url": "https://git.kernel.org/stable/c/e7505842f1329ece90cb9ea0db87772aeca44052" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e77c80670f2c2bf491da9b173931e1da4677c23a", "url": "https://git.kernel.org/stable/c/e77c80670f2c2bf491da9b173931e1da4677c23a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fcf21df7d3c50c8ebeb0757df5d21b02dcae4218", "url": "https://git.kernel.org/stable/c/fcf21df7d3c50c8ebeb0757df5d21b02dcae4218" } ], "release_date": "2026-09-24T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89542", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: harden gss_krb5_unwrap_v2 against short tokens\n\ngss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and\nptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN\n(16) bytes long, and its rotate_left() helper passes buf->len - base\nto xdr_buf_subsegment() without verifying that base <= buf->len. When\na caller hands in a sub-16-byte token, or a token whose declared len\nleaves base past the end of the buffer, three distinct failures follow:\n\n gss_krb5_unwrap_v2(offset, len, buf)\n ptr = buf->head[0].iov_base + offset\n ec = *(ptr + 4) /* OOB read on short head */\n rrc = *(ptr + 6) /* OOB read on short head */\n rotate_left(offset + 16, buf, rrc)\n xdr_buf_subsegment(buf, &subbuf,\n base, buf->len - base) /* u32 wrap when base > len */\n _rotate_left(&subbuf, shift)\n shift %= buf->len /* divide-by-zero when base == len */\n\nAfter decryption, the cleanup arithmetic has the same shape:\n\n movelen = min_t(unsigned int, buf->head[0].iov_len, len);\n movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;\n BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >\n buf->head[0].iov_len);\n\nThe BUG_ON re-adds the value just subtracted, so it reduces to\nmin(A, B) > A and is permanently false; it cannot catch the unsigned\nunderflow of movelen, which then drives a ~UINT_MAX-byte memmove().\n\nAdd four defense-in-depth guards inside the unwrap core so it is safe\nregardless of what its callers validate:\n\n - reject tokens with len - offset < GSS_KRB5_TOK_HDR_LEN before\n touching ptr+4/ptr+6;\n - bail from rotate_left() when buf->len <= base, covering both the\n underflow and zero-length cases;\n - return early from _rotate_left() when buf->len is zero, so the\n shift %= buf->len modulo cannot fault;\n - replace the dead BUG_ON with a live check that returns\n GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89542" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/075d7cfc4df8c54cb202ba8b28420370c03ba9b6", "url": "https://git.kernel.org/stable/c/075d7cfc4df8c54cb202ba8b28420370c03ba9b6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/299d281c7225ded15b28cb861a98d818d82787fc", "url": "https://git.kernel.org/stable/c/299d281c7225ded15b28cb861a98d818d82787fc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6959297aaa9572783d620a226d73c3fb94494888", "url": "https://git.kernel.org/stable/c/6959297aaa9572783d620a226d73c3fb94494888" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/806584a4b67a7233870c33e5b8f872e76dd02988", "url": "https://git.kernel.org/stable/c/806584a4b67a7233870c33e5b8f872e76dd02988" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/84ddbc8d084c0251d534f14f5d1a7da05be56404", "url": "https://git.kernel.org/stable/c/84ddbc8d084c0251d534f14f5d1a7da05be56404" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a7894e10572d53eb10109b8d07459cc8d3435811", "url": "https://git.kernel.org/stable/c/a7894e10572d53eb10109b8d07459cc8d3435811" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087", "url": "https://git.kernel.org/stable/c/dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f2591660e0eb263c9415bf0d0bb1b111e62df7a4", "url": "https://git.kernel.org/stable/c/f2591660e0eb263c9415bf0d0bb1b111e62df7a4" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53255", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate advertising TLV before type checks\n\ntlv_data_is_valid() reads each advertising data field length from\ndata[i], then inspects data[i + 1] for managed EIR types before\nchecking that the current field still fits inside the supplied buffer.\n\nA malformed field whose length byte is the last byte of the buffer can\ntherefore make the parser read one byte past the advertising data.\n\nKASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING\nrequest reached that path:\n\n BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid()\n Read of size 1\n Call trace:\n tlv_data_is_valid()\n add_advertising()\n hci_mgmt_cmd()\n hci_sock_sendmsg()\n\nMove the existing element-length check before any type-octet inspection\nso each non-empty element is proven to contain its type byte before the\nparser looks at data[i + 1].", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53255" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/06fcbd79c3c360a50f9be9d370769bbd738d0976", "url": "https://git.kernel.org/stable/c/06fcbd79c3c360a50f9be9d370769bbd738d0976" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/13ad995071a06570668dd8daab3616c247c72080", "url": "https://git.kernel.org/stable/c/13ad995071a06570668dd8daab3616c247c72080" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/18fea1cb0c2599752e908c8217490f73ddd33e00", "url": "https://git.kernel.org/stable/c/18fea1cb0c2599752e908c8217490f73ddd33e00" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1a3c8ffbb469859b076445af44bdfa6a711d483e", "url": "https://git.kernel.org/stable/c/1a3c8ffbb469859b076445af44bdfa6a711d483e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2a3f3ed9e198ae23c15859ace2f9ca6cfdc35b57", "url": "https://git.kernel.org/stable/c/2a3f3ed9e198ae23c15859ace2f9ca6cfdc35b57" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/74c08e4db35a476c3462aeb65846f955be732626", "url": "https://git.kernel.org/stable/c/74c08e4db35a476c3462aeb65846f955be732626" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/de23fb62259aa01d294f77238ae3b835eb674413", "url": "https://git.kernel.org/stable/c/de23fb62259aa01d294f77238ae3b835eb674413" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f7093ac233c1e7f51d125534f46067772a113175", "url": "https://git.kernel.org/stable/c/f7093ac233c1e7f51d125534f46067772a113175" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" } ], "release_date": "2026-06-25T09:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-72351", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ngue: validate REMCSUM private option length\n\nGUE private flags can indicate that remote checksum offload metadata is\npresent. The private flags field itself is accounted for by\nguehdr_flags_len(), but guehdr_priv_flags_len() currently returns 0 even\nwhen GUE_PFLAG_REMCSUM is set.\n\nThis lets a packet with only the private flags field pass\nvalidate_gue_flags(), after which gue_remcsum() and gue_gro_remcsum()\nread the missing REMCSUM start/offset fields from the following bytes.\n\nAccount for GUE_PLEN_REMCSUM when GUE_PFLAG_REMCSUM is present so that\nmalformed packets are rejected during option validation.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72351" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/158b9995d3c87f3b93f5c22df54a12e12a3438b3", "url": "https://git.kernel.org/stable/c/158b9995d3c87f3b93f5c22df54a12e12a3438b3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2a99224c120823987e4d829726f4ecb33e03fc1e", "url": "https://git.kernel.org/stable/c/2a99224c120823987e4d829726f4ecb33e03fc1e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c4de9988e9ddc760b750d6b6e701c35ff60ad14", "url": "https://git.kernel.org/stable/c/2c4de9988e9ddc760b750d6b6e701c35ff60ad14" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4a4a1d41c6e901e773bcf795f562a47fa71f692a", "url": "https://git.kernel.org/stable/c/4a4a1d41c6e901e773bcf795f562a47fa71f692a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/61e78679c7c9ca685bff58e4b6348304dc60aafd", "url": "https://git.kernel.org/stable/c/61e78679c7c9ca685bff58e4b6348304dc60aafd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c6876ec1b227261b51803f784c7be1b2242a1a0", "url": "https://git.kernel.org/stable/c/7c6876ec1b227261b51803f784c7be1b2242a1a0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d335dcc6f521571d57117b8deeebc940836e5450", "url": "https://git.kernel.org/stable/c/d335dcc6f521571d57117b8deeebc940836e5450" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f618cbe9b24cd0202004d2db781d5f80ab77037f", "url": "https://git.kernel.org/stable/c/f618cbe9b24cd0202004d2db781d5f80ab77037f" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-63924", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()\n\nipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers.\nLet's recompute nh pointer to make sure any change won't mess things up.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-63924" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b56bbd928c030894c270cd33d60286326919458", "url": "https://git.kernel.org/stable/c/2b56bbd928c030894c270cd33d60286326919458" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/645b99b1a185c91a79bdac4c5de0f91b212d64f0", "url": "https://git.kernel.org/stable/c/645b99b1a185c91a79bdac4c5de0f91b212d64f0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/72af7beae774e46ed543f3f2f267bf0a141bfcdd", "url": "https://git.kernel.org/stable/c/72af7beae774e46ed543f3f2f267bf0a141bfcdd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9e883eaa878f4337b5873c706efb5a192364ed18", "url": "https://git.kernel.org/stable/c/9e883eaa878f4337b5873c706efb5a192364ed18" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f", "url": "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bddaa4dfc7f36e1ee343a0622f69288af2b9ace9", "url": "https://git.kernel.org/stable/c/bddaa4dfc7f36e1ee343a0622f69288af2b9ace9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c512e1c819dfbf6ae95ee7a44b65b9ad98979157", "url": "https://git.kernel.org/stable/c/c512e1c819dfbf6ae95ee7a44b65b9ad98979157" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d47548a36639095939f4747d4c43f2271366f565", "url": "https://git.kernel.org/stable/c/d47548a36639095939f4747d4c43f2271366f565" } ], "release_date": "2026-07-19T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98794", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: filter some flags received in the backup server\n\nWhile the IPVS SYNC protocol is not secure by design\nwe can still protect the backup server from messages that\ncan wreak havoc.\n\nThis commit addresses problems from received connection flags\nor their combinations. We now drop messages as follows:\n\n1. the NO_CPORT+TEMPLATE combination allows lookups for normal\nconnections to hit template which can break in many ways.\nWhile the master does not sync connections with NO_CPORT flag,\ni.e. before they are established, we still accept NO_CPORT\nwithout TEMPLATE.\n\n2. ONE_PACKET: it is not sent by master, so we do not\nexpect it in backup. Before now it was ignored by\nIP_VS_CONN_F_BACKUP_MASK for protocol v1 while protocol\nv0 created connections that are not hashed and dropped\nimmediately. Better to apply the IP_VS_CONN_F_BACKUP_MASK\nalso to the flags from v0 messages for consistency with v1.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98794" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/45a93111835ccfea7d969ec73588e33745fd9834", "url": "https://git.kernel.org/stable/c/45a93111835ccfea7d969ec73588e33745fd9834" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/55d033324f67a15ff56be6d38d6e87f644e0ed62", "url": "https://git.kernel.org/stable/c/55d033324f67a15ff56be6d38d6e87f644e0ed62" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d7d33c9efa9d1a2f244a1a64ec9b540b0f8975a0", "url": "https://git.kernel.org/stable/c/d7d33c9efa9d1a2f244a1a64ec9b540b0f8975a0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f4cd1db7d421e82945713a36084bb0c35b75b27e", "url": "https://git.kernel.org/stable/c/f4cd1db7d421e82945713a36084bb0c35b75b27e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f96e91748f6304668fe647e686d199d7207d36f1", "url": "https://git.kernel.org/stable/c/f96e91748f6304668fe647e686d199d7207d36f1" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74589", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix sk_redir use-after-free in send verdict\n\nsk_psock_msg_verdict() takes a socket reference for psock->sk_redir.\ntcp_bpf_send_verdict() copies that pointer while holding the source socket\nlock, but does not take a reference for the local copy before dropping the\nlock around tcp_bpf_sendmsg_redir().\n\nWhen apply_bytes keeps the cached verdict active, another sendmsg() on the\nsame source socket can consume the remaining bytes and release the cached\nreference while the first thread still holds only the raw local pointer:\n\n CPU 0 CPU 1\n sk_redir = psock->sk_redir\n apply_bytes remains nonzero\n release_sock(sk)\n lock_sock(sk)\n apply_bytes reaches zero\n psock->sk_redir = NULL\n release_sock(sk)\n tcp_bpf_sendmsg_redir(sk_redir)\n sock_put(sk_redir)\n tcp_bpf_sendmsg_redir(sk_redir)\n\nThe final sock_put() can free sk_redir before CPU 0 dereferences it.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020\n Read of size 8 at addr ffff888108537090 by task poc/87\n Call Trace:\n tcp_bpf_sendmsg_redir+0xf39/0x1020\n tcp_bpf_sendmsg+0x977/0x1a50\n __sys_sendto+0x32c/0x3a0\n __x64_sys_sendto+0xdb/0x1b0\n Allocated by task 85:\n sk_prot_alloc+0x56/0x210\n sk_clone+0x6f/0x14b0\n inet_csk_clone_lock+0x24/0x740\n tcp_create_openreq_child+0x25/0x2710\n tcp_v4_syn_recv_sock+0x10a/0xe00\n Freed by task 0:\n __kasan_slab_free+0x43/0x70\n slab_free_after_rcu_debug+0xa6/0x1e0\n rcu_core+0x50a/0x1850\n Last potentially related work creation:\n __sk_destruct+0x3da/0x540\n sk_psock_destroy+0x81e/0xab0\n process_one_work+0x63a/0x1070\n\nTake a temporary socket reference while the source socket lock still\nprotects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir()\nreturns. This keeps each unlocked use independent of cached-verdict\nownership.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74589" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1cec526cf0a2227395f2c2f4b671cb052ff0b00e", "url": "https://git.kernel.org/stable/c/1cec526cf0a2227395f2c2f4b671cb052ff0b00e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf", "url": "https://git.kernel.org/stable/c/41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf", "url": "https://git.kernel.org/stable/c/4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/90a19b0894ba79a699b48cf44421b36fbd566e99", "url": "https://git.kernel.org/stable/c/90a19b0894ba79a699b48cf44421b36fbd566e99" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3", "url": "https://git.kernel.org/stable/c/9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10", "url": "https://git.kernel.org/stable/c/a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a76624733730e541e4955fdecf506af2f6b20558", "url": "https://git.kernel.org/stable/c/a76624733730e541e4955fdecf506af2f6b20558" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d192cff2a37d59206dabe6ec2e60ceac6271f274", "url": "https://git.kernel.org/stable/c/d192cff2a37d59206dabe6ec2e60ceac6271f274" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74720", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer state for commuted arithmetic\n\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\ndestination register inherits the pointer state from the source pointer.\nCopying only selected fields is fragile because pointer provenance is\ntracked by several bpf_reg_state fields.\n\nUse the caller's temporary offset register to preserve the scalar operand\nwhile replacing the destination with the full pointer state. This preserves\nthe frame number for PTR_TO_STACK registers and keeps parent identity\nfields consistent.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74720" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b", "url": "https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e", "url": "https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472", "url": "https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf", "url": "https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86", "url": "https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c", "url": "https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829", "url": "https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a", "url": "https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98269", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort transaction on failure to update inode for hole punching and reflinking\n\nIf we fail to update the inode we error out without aborting the\ntransaction, which can result in a persistent inconsistency if after\nthe failure the transaction is committed, as we have dropped file\nextent items from a range and either punched a hole or insert a new file\nextent item for that range (for reflinks).\n\nSo add the missing transaction abort.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98269" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067d", "url": "https://git.kernel.org/stable/c/2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/36c68dc909845c049e0286d229bc502947239452", "url": "https://git.kernel.org/stable/c/36c68dc909845c049e0286d229bc502947239452" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6", "url": "https://git.kernel.org/stable/c/834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9588850bfa75c78ce73c2f6f72544d19d2e9beb6", "url": "https://git.kernel.org/stable/c/9588850bfa75c78ce73c2f6f72544d19d2e9beb6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f", "url": "https://git.kernel.org/stable/c/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f" } ], "release_date": "2026-10-06T09:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98863", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails\n\nRe-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the\nnested pages fails in the KVM_RUN path. If userspace re-runs the vCPU, and\nvmcs02 holds valid PFNs from the *previous* run of L2, then KVM could\nre-enter L2 with stale, unpinned PFNs mapped into e.g. the vAPIC page.\n\nNote, both SVM and VMX (as of commit 11722439fb20 (\"KVM: nVMX: Ensure\nKVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit\") ensure the request\nis cleared on VM-Exit (including the \"forced\" case), i.e. there is no risk\nof double-mapping due to emulated VMLAUNCH/VMRESUME/VMRUN *and* the request\ntrying to map the nested pages.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98863" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/10180a277549339020b08000206092c07e0bff5a", "url": "https://git.kernel.org/stable/c/10180a277549339020b08000206092c07e0bff5a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/525694a6021ec6c8f7ce1f38acdf2dd77698fec1", "url": "https://git.kernel.org/stable/c/525694a6021ec6c8f7ce1f38acdf2dd77698fec1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/942192dbcd3a06695ef6b31cf10a41a21cf014d8", "url": "https://git.kernel.org/stable/c/942192dbcd3a06695ef6b31cf10a41a21cf014d8" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2025-22121", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()\n\nThere's issue as follows:\nBUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790\nRead of size 4 at addr ffff88807b003000 by task syz-executor.0/15172\n\nCPU: 3 PID: 15172 Comm: syz-executor.0\nCall Trace:\n __dump_stack lib/dump_stack.c:82 [inline]\n dump_stack+0xbe/0xfd lib/dump_stack.c:123\n print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400\n __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560\n kasan_report+0x3a/0x50 mm/kasan/report.c:585\n ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137\n ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896\n ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323\n evict+0x39f/0x880 fs/inode.c:622\n iput_final fs/inode.c:1746 [inline]\n iput fs/inode.c:1772 [inline]\n iput+0x525/0x6c0 fs/inode.c:1758\n ext4_orphan_cleanup fs/ext4/super.c:3298 [inline]\n ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300\n mount_bdev+0x355/0x410 fs/super.c:1446\n legacy_get_tree+0xfe/0x220 fs/fs_context.c:611\n vfs_get_tree+0x8d/0x2f0 fs/super.c:1576\n do_new_mount fs/namespace.c:2983 [inline]\n path_mount+0x119a/0x1ad0 fs/namespace.c:3316\n do_mount+0xfc/0x110 fs/namespace.c:3329\n __do_sys_mount fs/namespace.c:3540 [inline]\n __se_sys_mount+0x219/0x2e0 fs/namespace.c:3514\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nMemory state around the buggy address:\n ffff88807b002f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff88807b002f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n>ffff88807b003000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ^\n ffff88807b003080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff88807b003100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n\nAbove issue happens as ext4_xattr_delete_inode() isn't check xattr\nis valid if xattr is in inode.\nTo solve above issue call xattr_check_inode() check if xattr if valid\nin inode. In fact, we can directly verify in ext4_iget_extra_inode(),\nso that there is no divergent verification.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-22121" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/098927a13fd918bd7c64c2de905350a1ad7b4a3a", "url": "https://git.kernel.org/stable/c/098927a13fd918bd7c64c2de905350a1ad7b4a3a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c8fbb6ffb3c8f5164572ca88e4ccb6cd6a41ca8", "url": "https://git.kernel.org/stable/c/0c8fbb6ffb3c8f5164572ca88e4ccb6cd6a41ca8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/27202452b0bc942fdc3db72a44c4dcdab96d5b56", "url": "https://git.kernel.org/stable/c/27202452b0bc942fdc3db72a44c4dcdab96d5b56" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3c591353956ffcace2cc74d09930774afed60619", "url": "https://git.kernel.org/stable/c/3c591353956ffcace2cc74d09930774afed60619" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5701875f9609b000d91351eaa6bfd97fe2f157f4", "url": "https://git.kernel.org/stable/c/5701875f9609b000d91351eaa6bfd97fe2f157f4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b374e9ecc92aaa7fb2ab221ee3ff5451118ab566", "url": "https://git.kernel.org/stable/c/b374e9ecc92aaa7fb2ab221ee3ff5451118ab566" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c000a8a9b5343a5ef867df173c6349672dacbd0f", "url": "https://git.kernel.org/stable/c/c000a8a9b5343a5ef867df173c6349672dacbd0f" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" } ], "release_date": "2025-04-16T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89553", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau/gem: reserve the bo in the info ioctl around the vma lookup\n\nIn the non-uvmm path, there could be a race between the info lookup\nfinding the vma, and the gem close path closing the vma leading\nto a use-after-free.\n\nSpotted with the help of Opus 4.6.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89553" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/208867763843aa82efcbe3b771f1b8e6c7aa820a", "url": "https://git.kernel.org/stable/c/208867763843aa82efcbe3b771f1b8e6c7aa820a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5e17160d41d92823f3379c1982e1369680c5ce4d", "url": "https://git.kernel.org/stable/c/5e17160d41d92823f3379c1982e1369680c5ce4d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e05c28bd6043d0fd0bea9c3fc49300a8871a1a81", "url": "https://git.kernel.org/stable/c/e05c28bd6043d0fd0bea9c3fc49300a8871a1a81" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e60466011ac3a6b8045e6cc3c2cbb30d58039d2e", "url": "https://git.kernel.org/stable/c/e60466011ac3a6b8045e6cc3c2cbb30d58039d2e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff110e85837d7ecd83f36078107be240ff5ae409", "url": "https://git.kernel.org/stable/c/ff110e85837d7ecd83f36078107be240ff5ae409" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68402", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: bound element ID read when checking non-inheritance\n\ncfg80211_is_element_inherited() reads the first data octet of the\ncandidate element (id = elem->data[0]) to look it up in an extension\nnon-inheritance list. It does so after testing elem->id, but without\nverifying that the element actually has a data octet. A zero-length\nextension element (WLAN_EID_EXTENSION with length 0) therefore makes it\nread one octet past the end of the element.\n\n_ieee802_11_parse_elems_full() runs this check for every element of a\nframe once a non-inheritance context exists -- e.g. while parsing a\nper-STA profile of a Multi-Link element in a (re)association response,\nor a non-transmitted BSS profile -- so a crafted frame from an AP can\ntrigger a one-octet slab-out-of-bounds read during element parsing:\n\n BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited\n Read of size 1 ... in net/wireless/scan.c\n\nReturn early (treat the element as inherited) when an extension element\ncarries no data, mirroring the existing handling of empty ID lists.\n\nThe bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68402" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11ac7a5e75f5132f1778e0c60981d30dc29fb869", "url": "https://git.kernel.org/stable/c/11ac7a5e75f5132f1778e0c60981d30dc29fb869" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/20c308d9a57722801961f816395bf825f7bde6bc", "url": "https://git.kernel.org/stable/c/20c308d9a57722801961f816395bf825f7bde6bc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/24154c172246ae3f0e69bb17c9111095685ceedc", "url": "https://git.kernel.org/stable/c/24154c172246ae3f0e69bb17c9111095685ceedc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2d31ebb26a14f103c9cdc5287fb20cb2d4bde901", "url": "https://git.kernel.org/stable/c/2d31ebb26a14f103c9cdc5287fb20cb2d4bde901" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/521dd5fe6d12b0d3c275f919738dc3a07117f4a5", "url": "https://git.kernel.org/stable/c/521dd5fe6d12b0d3c275f919738dc3a07117f4a5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/84bd907361c56fbd5523eceb2682cb39da059bd5", "url": "https://git.kernel.org/stable/c/84bd907361c56fbd5523eceb2682cb39da059bd5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cb8afea4655ff004fa7feee825d5c79783525383", "url": "https://git.kernel.org/stable/c/cb8afea4655ff004fa7feee825d5c79783525383" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ddf2773bcc8e49a43c561f22ec1e7924215d7947", "url": "https://git.kernel.org/stable/c/ddf2773bcc8e49a43c561f22ec1e7924215d7947" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89969", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: fix out-of-bounds write when receiving an over-long PDU\n\nnvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte\nqueue->pdu union, then computes the remaining payload length as\n\n\tqueue->left = hdr->hlen - queue->offset + hdgst;\n\nand reads that many more bytes into &queue->pdu + queue->offset, without\never bounding the result against sizeof(queue->pdu).\n\nA struct nvme_tcp_icreq_pdu is itself 128 bytes, exactly the size of the\nunion. Once a header digest has been negotiated (hdgst = 4), a second\nICReq passes the hlen == nvmet_tcp_pdu_size() check but yields\nqueue->left = 128 - 8 + 4 = 124, so bytes 8..132 are written into the\n128-byte buffer -- 4 bytes past its end, over queue->hdr_digest and\nqueue->data_digest. Those bytes are attacker-controlled (an ICReq\ncarries no digest), and the duplicate ICReq is only rejected later,\nafter the overflow. A remote unauthenticated host can thus corrupt\nkernel memory adjacent to the receive buffer.\n\nReject any PDU whose declared length would read past the end of\nqueue->pdu before the second recv.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89969" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14cc5a7e77731497d5bea70f3bb05df7eda982e4", "url": "https://git.kernel.org/stable/c/14cc5a7e77731497d5bea70f3bb05df7eda982e4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3a385e0c39efbe34db8edd95900c123113ae3450", "url": "https://git.kernel.org/stable/c/3a385e0c39efbe34db8edd95900c123113ae3450" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4f84d42c53c49557fb1ef285c683b0a81b576c74", "url": "https://git.kernel.org/stable/c/4f84d42c53c49557fb1ef285c683b0a81b576c74" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/58dc6035b79c4c73c0cbf9ec9f68a7f117b2b3e6", "url": "https://git.kernel.org/stable/c/58dc6035b79c4c73c0cbf9ec9f68a7f117b2b3e6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a3f0bcfbaf3312a5754d1ce020a07d394669eb25", "url": "https://git.kernel.org/stable/c/a3f0bcfbaf3312a5754d1ce020a07d394669eb25" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cf5f39d2b58f97e0cd1829c4a6aeef17f1607cca", "url": "https://git.kernel.org/stable/c/cf5f39d2b58f97e0cd1829c4a6aeef17f1607cca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d95d342bc0ea82dc79e6362b2f1f997431750e4c", "url": "https://git.kernel.org/stable/c/d95d342bc0ea82dc79e6362b2f1f997431750e4c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dbc4acbdb3ca8c81441368ad7409b8f77d4de8f6", "url": "https://git.kernel.org/stable/c/dbc4acbdb3ca8c81441368ad7409b8f77d4de8f6" } ], "release_date": "2026-09-16T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98457", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: validate frame length before control and FCS access\n\nl2cap_data_rcv() unpacks either a two-byte or four-byte control field\nwithout first ensuring that it is present. A short ERTM or streaming-mode\nframe can therefore cause an out-of-bounds read.\n\nThere is a second short-frame case when CRC16 is enabled. After the\ncontrol field is pulled, l2cap_check_fcs() subtracts two from skb->len\nwithout checking it. If fewer than two bytes remain, the subtraction\nwraps; skb_trim() leaves the buffer unchanged and the subsequent FCS\nload reads past the logical end of the frame.\n\nValidate that the frame contains both its control field and, when\nenabled, its FCS before either field is accessed.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98457" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1fdbb2a712a9a162ee817c959740face80b3d929", "url": "https://git.kernel.org/stable/c/1fdbb2a712a9a162ee817c959740face80b3d929" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3acf6a0038ec0d4e8f4dcbfc2a557dff5f61cb70", "url": "https://git.kernel.org/stable/c/3acf6a0038ec0d4e8f4dcbfc2a557dff5f61cb70" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4373ba79a267947e771c438507f7b103e30bdb21", "url": "https://git.kernel.org/stable/c/4373ba79a267947e771c438507f7b103e30bdb21" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6c78a213d9070b610c7f418af2c25b66180b7e37", "url": "https://git.kernel.org/stable/c/6c78a213d9070b610c7f418af2c25b66180b7e37" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c7556c7cd17e073bbefdc4a9a4694a207544c37", "url": "https://git.kernel.org/stable/c/8c7556c7cd17e073bbefdc4a9a4694a207544c37" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/965bd88ed4b4763cb765dd65885adcfa588c6b14", "url": "https://git.kernel.org/stable/c/965bd88ed4b4763cb765dd65885adcfa588c6b14" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c6a288e6001bcce16553c3853e0f5a45eaaf85c7", "url": "https://git.kernel.org/stable/c/c6a288e6001bcce16553c3853e0f5a45eaaf85c7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f557274af7b94b6134692e6f26b880f1e34c15bf", "url": "https://git.kernel.org/stable/c/f557274af7b94b6134692e6f26b880f1e34c15bf" } ], "release_date": "2026-10-18T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68214", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rtl2832: fix use-after-free in rtl2832_remove()\n\ncancel_delayed_work_sync() is called before i2c_mux_del_adapters()\nin rtl2832_remove(). While the cancel waits for any running instance\nof i2c_gate_work to finish, it does not prevent the timer from being\nrescheduled by a concurrent thread.\n\nDuring probe, the r820t_attach() call attempts I2C transfers through\nthe mux adapter. These transfers go through i2c_mux_master_xfer(),\nwhich calls rtl2832_deselect() after the transfer completes,\nrescheduling i2c_gate_work via schedule_delayed_work(). If this\ntransfer is still in flight when rtl2832_remove() runs,\nrtl2832_deselect() can reschedule i2c_gate_work after it has been\ncancelled, causing a use-after-free when kfree(dev) is called.\n\nFix this by calling i2c_mux_del_adapters() before\ncancel_delayed_work_sync(). Once the mux adapter is unregistered, no\nnew I2C transfers can go through it, so rtl2832_deselect() can no\nlonger reschedule i2c_gate_work. The subsequent\ncancel_delayed_work_sync() is then guaranteed to be final.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68214" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/13c06056699e66ff7109ba68658cc6ea4a23f516", "url": "https://git.kernel.org/stable/c/13c06056699e66ff7109ba68658cc6ea4a23f516" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1e8a6bc19403661661fed5ae82f6eca6c9cdfad2", "url": "https://git.kernel.org/stable/c/1e8a6bc19403661661fed5ae82f6eca6c9cdfad2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/24bef237eef8dd1ebcffb129ba21891ddad0d309", "url": "https://git.kernel.org/stable/c/24bef237eef8dd1ebcffb129ba21891ddad0d309" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c71bda6edc630a1f8c3c45d8df5fc22d234e042", "url": "https://git.kernel.org/stable/c/2c71bda6edc630a1f8c3c45d8df5fc22d234e042" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/680daf40a82d483949f87f0d8f98639dc47e610c", "url": "https://git.kernel.org/stable/c/680daf40a82d483949f87f0d8f98639dc47e610c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/68a9c0290897c1436ddceb8cea604c93377a0299", "url": "https://git.kernel.org/stable/c/68a9c0290897c1436ddceb8cea604c93377a0299" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/90d781711418881f8c836c2a859cc2886625d750", "url": "https://git.kernel.org/stable/c/90d781711418881f8c836c2a859cc2886625d750" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9acd5bbbe1df8e487e49488692c224496d4c9e16", "url": "https://git.kernel.org/stable/c/9acd5bbbe1df8e487e49488692c224496d4c9e16" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2022-49892", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix use-after-free for dynamic ftrace_ops\n\nKASAN reported a use-after-free with ftrace ops [1]. It was found from\nvmcore that perf had registered two ops with the same content\nsuccessively, both dynamic. After unregistering the second ops, a\nuse-after-free occurred.\n\nIn ftrace_shutdown(), when the second ops is unregistered, the\nFTRACE_UPDATE_CALLS command is not set because there is another enabled\nops with the same content. Also, both ops are dynamic and the ftrace\ncallback function is ftrace_ops_list_func, so the\nFTRACE_UPDATE_TRACE_FUNC command will not be set. Eventually the value\nof 'command' will be 0 and ftrace_shutdown() will skip the rcu\nsynchronization.\n\nHowever, ftrace may be activated. When the ops is released, another CPU\nmay be accessing the ops. Add the missing synchronization to fix this\nproblem.\n\n[1]\nBUG: KASAN: use-after-free in __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline]\nBUG: KASAN: use-after-free in ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049\nRead of size 8 at addr ffff56551965bbc8 by task syz-executor.2/14468\n\nCPU: 1 PID: 14468 Comm: syz-executor.2 Not tainted 5.10.0 #7\nHardware name: linux,dummy-virt (DT)\nCall trace:\n dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132\n show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1b4/0x248 lib/dump_stack.c:118\n print_address_description.constprop.0+0x28/0x48c mm/kasan/report.c:387\n __kasan_report mm/kasan/report.c:547 [inline]\n kasan_report+0x118/0x210 mm/kasan/report.c:564\n check_memory_region_inline mm/kasan/generic.c:187 [inline]\n __asan_load8+0x98/0xc0 mm/kasan/generic.c:253\n __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline]\n ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049\n ftrace_graph_call+0x0/0x4\n __might_sleep+0x8/0x100 include/linux/perf_event.h:1170\n __might_fault mm/memory.c:5183 [inline]\n __might_fault+0x58/0x70 mm/memory.c:5171\n do_strncpy_from_user lib/strncpy_from_user.c:41 [inline]\n strncpy_from_user+0x1f4/0x4b0 lib/strncpy_from_user.c:139\n getname_flags+0xb0/0x31c fs/namei.c:149\n getname+0x2c/0x40 fs/namei.c:209\n [...]\n\nAllocated by task 14445:\n kasan_save_stack+0x24/0x50 mm/kasan/common.c:48\n kasan_set_track mm/kasan/common.c:56 [inline]\n __kasan_kmalloc mm/kasan/common.c:479 [inline]\n __kasan_kmalloc.constprop.0+0x110/0x13c mm/kasan/common.c:449\n kasan_kmalloc+0xc/0x14 mm/kasan/common.c:493\n kmem_cache_alloc_trace+0x440/0x924 mm/slub.c:2950\n kmalloc include/linux/slab.h:563 [inline]\n kzalloc include/linux/slab.h:675 [inline]\n perf_event_alloc.part.0+0xb4/0x1350 kernel/events/core.c:11230\n perf_event_alloc kernel/events/core.c:11733 [inline]\n __do_sys_perf_event_open kernel/events/core.c:11831 [inline]\n __se_sys_perf_event_open+0x550/0x15f4 kernel/events/core.c:11723\n __arm64_sys_perf_event_open+0x6c/0x80 kernel/events/core.c:11723\n [...]\n\nFreed by task 14445:\n kasan_save_stack+0x24/0x50 mm/kasan/common.c:48\n kasan_set_track+0x24/0x34 mm/kasan/common.c:56\n kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:358\n __kasan_slab_free.part.0+0x11c/0x1b0 mm/kasan/common.c:437\n __kasan_slab_free mm/kasan/common.c:445 [inline]\n kasan_slab_free+0x2c/0x40 mm/kasan/common.c:446\n slab_free_hook mm/slub.c:1569 [inline]\n slab_free_freelist_hook mm/slub.c:1608 [inline]\n slab_free mm/slub.c:3179 [inline]\n kfree+0x12c/0xc10 mm/slub.c:4176\n perf_event_alloc.part.0+0xa0c/0x1350 kernel/events/core.c:11434\n perf_event_alloc kernel/events/core.c:11733 [inline]\n __do_sys_perf_event_open kernel/events/core.c:11831 [inline]\n __se_sys_perf_event_open+0x550/0x15f4 kernel/events/core.c:11723\n [...]", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-49892" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0e792b89e6800cd9cb4757a76a96f7ef3e8b6294", "url": "https://git.kernel.org/stable/c/0e792b89e6800cd9cb4757a76a96f7ef3e8b6294" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/88561a66777e7a2fe06638c6dcb22a9fae0b6733", "url": "https://git.kernel.org/stable/c/88561a66777e7a2fe06638c6dcb22a9fae0b6733" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cc1b9961a0ceb70f6ca4e2f4b8bb71c87c7a495c", "url": "https://git.kernel.org/stable/c/cc1b9961a0ceb70f6ca4e2f4b8bb71c87c7a495c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ea5f2fd4640ecbb9df969bf8bb27733ae2183169", "url": "https://git.kernel.org/stable/c/ea5f2fd4640ecbb9df969bf8bb27733ae2183169" } ], "release_date": "2025-05-01T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90204", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate DIO orphan slot during inode read\n\n[BUG]\nA corrupted append-DIO dinode (high byte at offset 0xa1\ncorrupted from 0 to 1) can carry an i_dio_orphaned_slot\noutside the mounted filesystem slot range and trigger a\nuse-after-free error:\n\nBUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102\nRead of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85\nCall Trace:\n ...\n ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102\n ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840\n ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline]\n ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295\n evict+0x38e/0x8f0 fs/inode.c:810\n iput_final fs/inode.c:1914 [inline]\n iput fs/inode.c:1966 [inline]\n iput+0x55b/0x8b0 fs/inode.c:1926\n ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374\n ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373\n ...\n\n[CAUSE]\nocfs2_del_inode_from_orphan() uses i_dio_orphaned_slot to index the\nslot-local system inode cache. The dinode validator does not check\nthis active slot, so an out-of-range value produces an invalid cache\nentry pointer that is dereferenced as an inode pointer.\n\n[FIX]\nReject an active i_dio_orphaned_slot outside the slot range during\ndinode validation, before DIO orphan recovery can consume it.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90204" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/418e0ae42fa769d354b15e62c01a00413024755b", "url": "https://git.kernel.org/stable/c/418e0ae42fa769d354b15e62c01a00413024755b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8f7a2c5cf23d437acab7f3e739bfcad0f443c554", "url": "https://git.kernel.org/stable/c/8f7a2c5cf23d437acab7f3e739bfcad0f443c554" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bb88131c9831075b8dc08cdd375743e5d44c7ca2", "url": "https://git.kernel.org/stable/c/bb88131c9831075b8dc08cdd375743e5d44c7ca2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e35fa6eb4d2a39f8049f62361a4b44930882b5f8", "url": "https://git.kernel.org/stable/c/e35fa6eb4d2a39f8049f62361a4b44930882b5f8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eacdd27ca829747d4372fbae8617151072a4d1e5", "url": "https://git.kernel.org/stable/c/eacdd27ca829747d4372fbae8617151072a4d1e5" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74255", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix UAF in tipc_l2_send_msg()\n\nSyzbot reported a slab-use-after-free in ipvlan_hard_header() when\ncalled from tipc_l2_send_msg().\n\nThe root cause is that tipc_disable_l2_media() calls synchronize_net()\nwhile b->media_ptr is still valid. This allows concurrent RCU readers\nto obtain the device pointer after synchronize_net() has finished.\nThe pointer is cleared later in bearer_disable(), but without any\nsubsequent synchronization, allowing the device to be freed while\nstill in use by readers.\n\nFix this by clearing b->media_ptr in tipc_disable_l2_media() before\ncalling synchronize_net().\n\nThis is safe to do now because the call order in bearer_disable()\nwas reversed in 0d051bf93c06 (\"tipc: make bearer packet filtering generic\")\nto call tipc_node_delete_links() (which needs the pointer) before\ndisable_media().\n\nhttps: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74255" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0d8a12d7143126afdf9fbe2e3d438650dd6603ed", "url": "https://git.kernel.org/stable/c/0d8a12d7143126afdf9fbe2e3d438650dd6603ed" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/35e0297a93c3c34a3924eeef816c03504e3ab5c5", "url": "https://git.kernel.org/stable/c/35e0297a93c3c34a3924eeef816c03504e3ab5c5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/50ff092633b06382e5091dd5b093ce943d4ac2f9", "url": "https://git.kernel.org/stable/c/50ff092633b06382e5091dd5b093ce943d4ac2f9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/609ced2301be1df7e7ed2ef47d1d916674e6ba3b", "url": "https://git.kernel.org/stable/c/609ced2301be1df7e7ed2ef47d1d916674e6ba3b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/71aafa16d79b107b33837f60b6cbc7d0cb8c5708", "url": "https://git.kernel.org/stable/c/71aafa16d79b107b33837f60b6cbc7d0cb8c5708" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aef12b5ce793dea6b3a97a58fd0f946000ae8945", "url": "https://git.kernel.org/stable/c/aef12b5ce793dea6b3a97a58fd0f946000ae8945" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f4002f1c669cc02e3763f479fc25ff1dfa9e2420", "url": "https://git.kernel.org/stable/c/f4002f1c669cc02e3763f479fc25ff1dfa9e2420" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6", "url": "https://git.kernel.org/stable/c/f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-99053", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: hold a reference to nodes found by link name\n\ntipc_node_find_by_name() returns a node after dropping its RCU read lock\nwithout taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS\nhandlers then lock and access the node, racing with timer-driven cleanup of\na down peer. Generic netlink serialization does not exclude the node\ntimer.\n\nThe following interleaving can leave a handler using a freed node:\n\n CPU 0: find the node under RCU and release the node read lock\n CPU 1: tipc_node_timeout() clears the links and unlinks the down node\n CPU 1: drop the list and timer references, queuing tipc_node_free()\n CPU 0: leave the RCU read-side critical section\n CPU 1: complete the grace period and free the node\n CPU 0: acquire the node lock through the stale pointer\n\nLINK_SET also uses the node's media address after releasing the node lock,\nwhen passing queued packets to tipc_bearer_xmit().\n\nKASAN on v7.3-rc5 reported:\n\n BUG: KASAN: slab-use-after-free in _raw_read_lock_bh\n Write of size 4 at addr ffff88807e06f008 by task poc/92\n Call Trace:\n _raw_read_lock_bh kernel/locking/spinlock.c:287\n tipc_nl_node_set_link net/tipc/node.c:2475\n genl_family_rcv_msg_doit net/netlink/genetlink.c:1114\n genl_rcv_msg net/netlink/genetlink.c:1209\n netlink_rcv_skb net/netlink/af_netlink.c:2575\n\n Allocated by task 0:\n tipc_node_create net/tipc/node.c:539\n tipc_node_check_dest net/tipc/node.c:1196\n tipc_disc_rcv net/tipc/discover.c:252\n\n Freed by task 92:\n kfree mm/slub.c:6801\n rcu_core kernel/rcu/tree.c:2919\n\n Last potentially related work creation:\n __call_rcu_common.constprop.0 kernel/rcu/tree.c:3181\n tipc_node_timeout net/tipc/node.c:814\n\nAcquire a reference to the selected node with kref_get_unless_zero() before\nleaving RCU, returning NULL if the node has already been released. Release\nthat reference on every caller exit after the last node access, including\ntransmission in LINK_SET. Keep the existing link lookup order and locking\nso concurrent link removal still takes the existing error paths.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-99053" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1428c5f1d346a2e1ac9156713975a72246957009", "url": "https://git.kernel.org/stable/c/1428c5f1d346a2e1ac9156713975a72246957009" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/17e73bae400f6a434dc006e3bee92c94cf781954", "url": "https://git.kernel.org/stable/c/17e73bae400f6a434dc006e3bee92c94cf781954" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3c3b308ee6e25729a6cf09b69cdd0e093220d40b", "url": "https://git.kernel.org/stable/c/3c3b308ee6e25729a6cf09b69cdd0e093220d40b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b60259d4047fbb735476c729dcf9306a038b6110", "url": "https://git.kernel.org/stable/c/b60259d4047fbb735476c729dcf9306a038b6110" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f17e70206a1e763fcca2578a8db3c4eed0f843a9", "url": "https://git.kernel.org/stable/c/f17e70206a1e763fcca2578a8db3c4eed0f843a9" } ], "release_date": "2026-10-23T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98185", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: validate scan response extents\n\nmwifiex_ret_802_11_scan() subtracts the fixed response fields and the\nfirmware-provided BSS length from resp->size without first proving that\neither extent fits. A short response or oversized BSS length can\ntherefore underflow tlv_buf_size and make the TLV parser walk beyond the\ncommand response.\n\nCompute the fixed extent from the selected normal or background scan\nresponse. Validate that the fixed fields and BSS data fit before deriving\nthe TLV extent and entering the parser.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98185" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/25217c5f6ce0bf3004f80c129464cd35fe9a420f", "url": "https://git.kernel.org/stable/c/25217c5f6ce0bf3004f80c129464cd35fe9a420f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3687d7d48070838cc2953431b3a27717cab0aaf6", "url": "https://git.kernel.org/stable/c/3687d7d48070838cc2953431b3a27717cab0aaf6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/48312f0085aa1577d6d41af2a079b34de17c1a57", "url": "https://git.kernel.org/stable/c/48312f0085aa1577d6d41af2a079b34de17c1a57" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7106ad8b74f50cca1ef36131f327d2c78f556daa", "url": "https://git.kernel.org/stable/c/7106ad8b74f50cca1ef36131f327d2c78f556daa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9cff2f39ed38a32070b08364c4c9346e85b8f9ec", "url": "https://git.kernel.org/stable/c/9cff2f39ed38a32070b08364c4c9346e85b8f9ec" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c4943323fda22ef27bb6479b9d328ae48c63f64c", "url": "https://git.kernel.org/stable/c/c4943323fda22ef27bb6479b9d328ae48c63f64c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417", "url": "https://git.kernel.org/stable/c/cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dccf5ecaad4d8d43c545921f20328e8f91af8698", "url": "https://git.kernel.org/stable/c/dccf5ecaad4d8d43c545921f20328e8f91af8698" } ], "release_date": "2026-10-06T09:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-90330", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-hidpp: Fix FF device cleanup on init failure\n\nhidpp_ff_init() creates the input force-feedback device with\ninput_ff_create(), then allocates the HID++ FF private data,\neffect ID array, and workqueue.\n\nIf any of those allocations fail after input_ff_create() succeeds,\nthe function returns an error without destroying the FF device.\nAdd an unwind path that frees the private allocations made by\nhidpp_ff_init() and calls input_ff_destroy() for failures after\ninput_ff_create() succeeds.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90330" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/13378c9ac0a1bcdf49ba158e4199594aafb589cd", "url": "https://git.kernel.org/stable/c/13378c9ac0a1bcdf49ba158e4199594aafb589cd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2fd9c8112907c14efefe6a90d20b774737052db3", "url": "https://git.kernel.org/stable/c/2fd9c8112907c14efefe6a90d20b774737052db3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/360a49fc53acdfe2dbb80c23cfa606ed7e13a85d", "url": "https://git.kernel.org/stable/c/360a49fc53acdfe2dbb80c23cfa606ed7e13a85d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6bb216586a3cb4ce327511a7c0445fa88e85b3cb", "url": "https://git.kernel.org/stable/c/6bb216586a3cb4ce327511a7c0445fa88e85b3cb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dd5be4d9ce2dfc4d4a4527ef7d31d21a78e3cdac", "url": "https://git.kernel.org/stable/c/dd5be4d9ce2dfc4d4a4527ef7d31d21a78e3cdac" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-52962", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix a buffer leak in __ceph_setxattr()\n\nThe old_blob in __ceph_setxattr() can store\nci->i_xattrs.prealloc_blob value during the retry.\nHowever, it is never called the ceph_buffer_put()\nfor the old_blob object. This patch fixes the issue of\nthe buffer leak.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-52962" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3fa13ceefbc5f36131110342743994cb3de80637", "url": "https://git.kernel.org/stable/c/3fa13ceefbc5f36131110342743994cb3de80637" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4bfdcefdaa6092a06cacd59389c7756b36e6de8c", "url": "https://git.kernel.org/stable/c/4bfdcefdaa6092a06cacd59389c7756b36e6de8c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/521e5aba857fd267624892c8dd6295f22ce0267e", "url": "https://git.kernel.org/stable/c/521e5aba857fd267624892c8dd6295f22ce0267e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e", "url": "https://git.kernel.org/stable/c/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7d3e8d2d648d5f0df29b4710246680f47695fe94", "url": "https://git.kernel.org/stable/c/7d3e8d2d648d5f0df29b4710246680f47695fe94" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bc7abce4460e490dcb579eec770f175b150b685f", "url": "https://git.kernel.org/stable/c/bc7abce4460e490dcb579eec770f175b150b685f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0cb994605c84a159c1d00d72cdc8583c321ef95", "url": "https://git.kernel.org/stable/c/d0cb994605c84a159c1d00d72cdc8583c321ef95" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ecf94823c5c6a20790bb76ed2816822b0beb0c22", "url": "https://git.kernel.org/stable/c/ecf94823c5c6a20790bb76ed2816822b0beb0c22" } ], "release_date": "2026-06-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-53148", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Clamp XDomain response data copy to allocation size\n\ntb_xdp_properties_request() derives the per-packet copy length from\nthe response header without checking that it fits in the previously\nallocated data buffer. A malicious peer can set its length field\nlarger than the declared data_length, causing memcpy to write past\nthe kcalloc allocation.\n\nClamp the per-packet copy length so that the cumulative offset\nnever exceeds data_len.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53148" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d", "url": "https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa", "url": "https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141", "url": "https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505", "url": "https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1", "url": "https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d", "url": "https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5", "url": "https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fcbd0cdab92838854a5818be7ed8a097164ef6d5", "url": "https://git.kernel.org/stable/c/fcbd0cdab92838854a5818be7ed8a097164ef6d5" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-53148", "url": "https://access.redhat.com/security/cve/CVE-2026-53148" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2492756", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492756" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53148.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53148.json" } ], "release_date": "2026-06-25T09:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-3625", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211929 was assigned to this vulnerability.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-3625" }, { "category": "external", "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=6b4db2e528f650c7fb712961aac36455468d5902", "url": "https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=6b4db2e528f650c7fb712961aac36455468d5902" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html", "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html" }, { "category": "external", "summary": "https://vuldb.com/?id.211929", "url": "https://vuldb.com/?id.211929" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html" } ], "release_date": "2022-10-21T06:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-46122", "cwe": { "id": "CWE-129", "name": "Improper Validation of Array Index" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: b43: enforce bounds check on firmware key index in b43_rx()\n\nThe firmware-controlled key index in b43_rx() can exceed the dev->key[]\narray size (58 entries). The existing B43_WARN_ON is non-enforcing in\nproduction builds, allowing an out-of-bounds read.\n\nMake the B43_WARN_ON check enforcing by dropping the frame when the\nfirmware returns an invalid key index.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46122" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/135cb49c9a42a02cceeac7b49ec03e267f7ed6d6", "url": "https://git.kernel.org/stable/c/135cb49c9a42a02cceeac7b49ec03e267f7ed6d6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1e9e55cf66f0fa4799f4d86ef3aaba8e606b5c14", "url": "https://git.kernel.org/stable/c/1e9e55cf66f0fa4799f4d86ef3aaba8e606b5c14" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1f4f78bf8549e6ac4f04fba4176854f3a6e0c332", "url": "https://git.kernel.org/stable/c/1f4f78bf8549e6ac4f04fba4176854f3a6e0c332" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/219ba67e69e49681e48c822d6eaafb5def032f34", "url": "https://git.kernel.org/stable/c/219ba67e69e49681e48c822d6eaafb5def032f34" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3157ad40b084a8f3932da2641749ab45e99b933e", "url": "https://git.kernel.org/stable/c/3157ad40b084a8f3932da2641749ab45e99b933e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/765709720e6af9a178abc40244a8d1aa39ac4e71", "url": "https://git.kernel.org/stable/c/765709720e6af9a178abc40244a8d1aa39ac4e71" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c3d7b90dc95020cd9282c4630e402fe224f7644e", "url": "https://git.kernel.org/stable/c/c3d7b90dc95020cd9282c4630e402fe224f7644e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d7029879bafdac2006c67553807d122283dc6cbf", "url": "https://git.kernel.org/stable/c/d7029879bafdac2006c67553807d122283dc6cbf" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" } ], "release_date": "2026-05-28T10:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98573", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()\n\nskb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max\nargument and passes the result to __pskb_pull_tail() as a signed int. The\nfunction does not ensure that max is at least skb_headlen(skb).\n\nThis can happen while parsing IPv6 extension headers when an skb already\nhas a linear area larger than MAX_IPV6_HDR_LEN. Once the parser needs data\nbeyond the linear area, max - skb_headlen(skb) wraps and is converted to a\nnegative delta. __pskb_pull_tail() then passes that negative length to\nskb_copy_bits(), where it can become a very large copy length.\n\nPass the requested length itself as the pull bound at the three\nextension-header call sites, so the delta can no longer go negative.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98573" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b4e0b0c008a8c1b474730248cd5b873026c74bd", "url": "https://git.kernel.org/stable/c/3b4e0b0c008a8c1b474730248cd5b873026c74bd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b", "url": "https://git.kernel.org/stable/c/6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/718747afa5463d9cc5fd9a09f03b2a492edd9b78", "url": "https://git.kernel.org/stable/c/718747afa5463d9cc5fd9a09f03b2a492edd9b78" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9c4e432132a97b82edf28fa172c39f743e6bfb26", "url": "https://git.kernel.org/stable/c/9c4e432132a97b82edf28fa172c39f743e6bfb26" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a0ad0473c09d2e947aecac5c82e637ec85924b12", "url": "https://git.kernel.org/stable/c/a0ad0473c09d2e947aecac5c82e637ec85924b12" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b2da5ed3d8c75e1b729a21b6d3beaed415e263f6", "url": "https://git.kernel.org/stable/c/b2da5ed3d8c75e1b729a21b6d3beaed415e263f6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962", "url": "https://git.kernel.org/stable/c/cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d7f474226809471dc7877435e9c492cc914df0bf", "url": "https://git.kernel.org/stable/c/d7f474226809471dc7877435e9c492cc914df0bf" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-72226", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tt: prevent TVLV OOB check overflow\n\nA TT unicast TVLV contains the number of VLANs stored in it. This number is\nan u16 and gets multiplied by the size of the struct\nbatadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16\nused to store the tt_vlan_len. All additional safety checks to prevent\nout-of-bounds access of the TVLV buffer are invalid due to this overflow.\n\nUsing size_t prevents this overflow and ensures that the safety checks\ncompare against the actual buffer requirements.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72226" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0de12a4c4847f571d82a9cd96bc633eded41d7c6", "url": "https://git.kernel.org/stable/c/0de12a4c4847f571d82a9cd96bc633eded41d7c6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1898273c5dc8148267ef9f97cd2517a2822350e7", "url": "https://git.kernel.org/stable/c/1898273c5dc8148267ef9f97cd2517a2822350e7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3256c05d5a9db34346eaf20f52dddde984852d77", "url": "https://git.kernel.org/stable/c/3256c05d5a9db34346eaf20f52dddde984852d77" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/604bd5042fbcd1ab9f7cd98fd847ec017aeede8a", "url": "https://git.kernel.org/stable/c/604bd5042fbcd1ab9f7cd98fd847ec017aeede8a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6222b443686525cb5a9b6a9cecf23b2e2ab23e2a", "url": "https://git.kernel.org/stable/c/6222b443686525cb5a9b6a9cecf23b2e2ab23e2a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7319c0794f91be2734aac695794e7203606b49f8", "url": "https://git.kernel.org/stable/c/7319c0794f91be2734aac695794e7203606b49f8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a581d9aaba8c82bd6177fa36b2588eea77f6e2b", "url": "https://git.kernel.org/stable/c/7a581d9aaba8c82bd6177fa36b2588eea77f6e2b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d6ff4764ff784ede25f5c83a6f5883a74c93a5ea", "url": "https://git.kernel.org/stable/c/d6ff4764ff784ede25f5c83a6f5883a74c93a5ea" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74682", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write on Type II inbound URBs\n\ndata_ep_set_params() sizes each URB transfer buffer before it adds the\nFormat Type II transfer delimiter:\n\n\tu->packets = urb_packs;\n\tu->buffer_size = maxsize * u->packets;\n\n\tif (fmt->fmt_type == UAC_FORMAT_TYPE_II)\n\t\tu->packets++; /* for transfer delimiter */\n\tu->urb = usb_alloc_urb(u->packets, GFP_KERNEL);\n\nbuffer_size is computed from the pre-increment packet count and never\nrecomputed, so for a Type II endpoint the buffer is one packet short of\nthe packet count the URB is built with.\n\nprepare_inbound_urb() then lays out one iso frame per packet and never\nconsults buffer_size:\n\n\toffs = 0;\n\tfor (i = 0; i < urb_ctx->packets; i++) {\n\t\turb->iso_frame_desc[i].offset = offs;\n\t\turb->iso_frame_desc[i].length = ep->curpacksize;\n\t\toffs += ep->curpacksize;\n\t}\n\n\turb->transfer_buffer_length = offs;\n\turb->number_of_packets = urb_ctx->packets;\n\nThe last descriptor therefore points one packet past the end of the\ntransfer buffer, where the host controller writes device data on every\ninbound transfer. prepare_silent_urb() and prepare_playback_urb() bound\ntheir fill loops by ctx->buffer_size, so only capture is affected.\n\nfmt_type comes from the device's audio streaming descriptors, so any\ndevice advertising a Type II capture format hits this once userspace sets\nhw_params on the stream.\n\nKASAN on 7.2.0-rc5 (arm64) with a dummy_hcd/raw-gadget device, one report\nper inbound transfer:\n\n BUG: KASAN: slab-out-of-bounds in dummy_timer\n Write of size 64 at addr ffff0000186171c0 by task cons02/166\n __asan_memcpy\n dummy_timer\n hrtimer_run_softirq\n Allocated by task 166:\n usb_alloc_coherent\n snd_usb_endpoint_set_params\n The buggy address is located 0 bytes to the right of\n allocated 64-byte region [ffff000018617180, ffff0000186171c0)\n\nCompute buffer_size after the delimiter packet has been accounted for,\nand bound the fill loop by buffer_size, as prepare_silent_urb() already\ndoes on the outbound side. This grows every Type II URB allocation by\none maxsize packet.\n\nDiscovered by XBOW, triaged by Baul Lee ", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74682" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0a235379825e1a6194e43861ee6658e5fc35686d", "url": "https://git.kernel.org/stable/c/0a235379825e1a6194e43861ee6658e5fc35686d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/137bf034740e5a2734794908d0aff1e0bd7cee6e", "url": "https://git.kernel.org/stable/c/137bf034740e5a2734794908d0aff1e0bd7cee6e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6607f85242577f33d4540a0d1f4a6137f5367058", "url": "https://git.kernel.org/stable/c/6607f85242577f33d4540a0d1f4a6137f5367058" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/69ee44e1a23be62318189dc4b37fa4ad94053269", "url": "https://git.kernel.org/stable/c/69ee44e1a23be62318189dc4b37fa4ad94053269" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6af5f29af7711233ae68d3b25c15d67478468900", "url": "https://git.kernel.org/stable/c/6af5f29af7711233ae68d3b25c15d67478468900" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a", "url": "https://git.kernel.org/stable/c/ca22c94bdfc22c564ca2e11c87ba4d17ebeaaa9a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d3ed4e6321bb453757044cb9e5ecb30a33f04903", "url": "https://git.kernel.org/stable/c/d3ed4e6321bb453757044cb9e5ecb30a33f04903" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1fbb50b99311b35c2e85cc70341d62082dca4b5", "url": "https://git.kernel.org/stable/c/f1fbb50b99311b35c2e85cc70341d62082dca4b5" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2022-49799", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix wild-memory-access in register_synth_event()\n\nIn register_synth_event(), if set_synth_event_print_fmt() failed, then\nboth trace_remove_event_call() and unregister_trace_event() will be\ncalled, which means the trace_event_call will call\n__unregister_trace_event() twice. As the result, the second unregister\nwill causes the wild-memory-access.\n\nregister_synth_event\n set_synth_event_print_fmt failed\n trace_remove_event_call\n event_remove\n if call->event.funcs then\n __unregister_trace_event (first call)\n unregister_trace_event\n __unregister_trace_event (second call)\n\nFix the bug by avoiding to call the second __unregister_trace_event() by\nchecking if the first one is called.\n\ngeneral protection fault, probably for non-canonical address\n\t0xfbd59c0000000024: 0000 [#1] SMP KASAN PTI\nKASAN: maybe wild-memory-access in range\n[0xdead000000000120-0xdead000000000127]\nCPU: 0 PID: 3807 Comm: modprobe Not tainted\n6.1.0-rc1-00186-g76f33a7eedb4 #299\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014\nRIP: 0010:unregister_trace_event+0x6e/0x280\nCode: 00 fc ff df 4c 89 ea 48 c1 ea 03 80 3c 02 00 0f 85 0e 02 00 00 48\nb8 00 00 00 00 00 fc ff df 4c 8b 63 08 4c 89 e2 48 c1 ea 03 <80> 3c 02\n00 0f 85 e2 01 00 00 49 89 2c 24 48 85 ed 74 28 e8 7a 9b\nRSP: 0018:ffff88810413f370 EFLAGS: 00010a06\nRAX: dffffc0000000000 RBX: ffff888105d050b0 RCX: 0000000000000000\nRDX: 1bd5a00000000024 RSI: ffff888119e276e0 RDI: ffffffff835a8b20\nRBP: dead000000000100 R08: 0000000000000000 R09: fffffbfff0913481\nR10: ffffffff8489a407 R11: fffffbfff0913480 R12: dead000000000122\nR13: ffff888105d050b8 R14: 0000000000000000 R15: ffff888105d05028\nFS: 00007f7823e8d540(0000) GS:ffff888119e00000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7823e7ebec CR3: 000000010a058002 CR4: 0000000000330ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n __create_synth_event+0x1e37/0x1eb0\n create_or_delete_synth_event+0x110/0x250\n synth_event_run_command+0x2f/0x110\n test_gen_synth_cmd+0x170/0x2eb [synth_event_gen_test]\n synth_event_gen_test_init+0x76/0x9bc [synth_event_gen_test]\n do_one_initcall+0xdb/0x480\n do_init_module+0x1cf/0x680\n load_module+0x6a50/0x70a0\n __do_sys_finit_module+0x12f/0x1c0\n do_syscall_64+0x3f/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-49799" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1b5f1c34d3f5a664a57a5a7557a50e4e3cc2505c", "url": "https://git.kernel.org/stable/c/1b5f1c34d3f5a664a57a5a7557a50e4e3cc2505c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/315b149f08229a233d47532eb5da1707b28f764c", "url": "https://git.kernel.org/stable/c/315b149f08229a233d47532eb5da1707b28f764c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6517b97134f724d12f673f9fb4f456d75c7a905f", "url": "https://git.kernel.org/stable/c/6517b97134f724d12f673f9fb4f456d75c7a905f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a5bfa53e5036b3e7a80be902dd3719a930accabd", "url": "https://git.kernel.org/stable/c/a5bfa53e5036b3e7a80be902dd3719a930accabd" } ], "release_date": "2025-05-01T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-93826", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hidpp: fix potential UAF in hidpp_connect_event()\n\nIf input_register_device() fails, we call input_free_device(), but keep\nstale pointer to the old device in hidpp->input, which could potentially\nlead to UAF. Fix that by resetting it to NULL before returning from\nhidpp_connect_event().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-93826" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3303398cc2aa255ba251650a30024e11d48ea6c3", "url": "https://git.kernel.org/stable/c/3303398cc2aa255ba251650a30024e11d48ea6c3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3b8b2e58b078cd30e121401535541bb8a6d57133", "url": "https://git.kernel.org/stable/c/3b8b2e58b078cd30e121401535541bb8a6d57133" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5d7637f4d050d105177217e64b869f56f9825060", "url": "https://git.kernel.org/stable/c/5d7637f4d050d105177217e64b869f56f9825060" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6df6b1f2c49678211f65647c300bc51dda02893b", "url": "https://git.kernel.org/stable/c/6df6b1f2c49678211f65647c300bc51dda02893b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e03fd646adad7f97fa4429ec5f38cee9bde5276e", "url": "https://git.kernel.org/stable/c/e03fd646adad7f97fa4429ec5f38cee9bde5276e" } ], "release_date": "2026-09-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74498", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set\n\nWhen a USB audio endpoint requests full packet transfers via the fill_max\ndescriptor flag, data_ep_set_params() promotes ep->curpacksize to\nep->maxpacksize. However, maxsize is left at the original sample-rate\nderived value.\n\nSince u->buffer_size is allocated as maxsize * packets, the resulting\nDMA buffer is far too small for the requested transfer length. When the\nUSB host controller streams up to curpacksize bytes per packet, it writes\npast the end of the buffer via DMA, corrupting kernel heap memory.\n\nUpdate maxsize to curpacksize when fill_max is set so that the allocated\nDMA buffer size matches the actual transfer request size.\n\n[ changed to reassign maxsize only when ep->fill_max is set -- tiwai ]", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74498" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/04595233e5606d452f9f47e6989fc7ae7440fd40", "url": "https://git.kernel.org/stable/c/04595233e5606d452f9f47e6989fc7ae7440fd40" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/10c24e6fddf4bdff0b6b05a47a4347b38e6960e8", "url": "https://git.kernel.org/stable/c/10c24e6fddf4bdff0b6b05a47a4347b38e6960e8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3852974608f53e530e27c21d0c6c7d79c17b3f5a", "url": "https://git.kernel.org/stable/c/3852974608f53e530e27c21d0c6c7d79c17b3f5a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6cbdd11f9b05b92f4aa29f09a66e19ed0e25e66c", "url": "https://git.kernel.org/stable/c/6cbdd11f9b05b92f4aa29f09a66e19ed0e25e66c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b1770f9ac35c0ffc34914d52347c65dcd5ac049b", "url": "https://git.kernel.org/stable/c/b1770f9ac35c0ffc34914d52347c65dcd5ac049b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bd65b7191683bebd9923904f0558b9211b9129da", "url": "https://git.kernel.org/stable/c/bd65b7191683bebd9923904f0558b9211b9129da" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0199ae1666ff9ae2d1d568d64c3430d4c47f0e5", "url": "https://git.kernel.org/stable/c/d0199ae1666ff9ae2d1d568d64c3430d4c47f0e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f9b6c9576568169139ac151f7881474f384659fd", "url": "https://git.kernel.org/stable/c/f9b6c9576568169139ac151f7881474f384659fd" } ], "release_date": "2026-08-15T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98687", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Reject oversized XDomain properties responses\n\ntb_xdp_properties_request() allocates room for 45 data dwords in its\n252-byte response buffer. The XDomain length field is six bits wide,\nhowever, and a malicious peer can set it to 63. After the fixed response\nfields are subtracted, the driver treats this as 48 data dwords.\n\nCommit 322e93448d90 (\"thunderbolt: Clamp XDomain response data copy to\nallocation size\") only bounds the copy against data_len. If data_len is\nat least 48, memcpy() reads 192 bytes from the 180-byte res->data array,\ncausing a 12-byte heap out-of-bounds read. Commit 4db2bd2ed478\n(\"thunderbolt: Limit XDomain response copy to actual frame size\") limits\nthe earlier copy but does not constrain this header-derived length.\n\nReject response data lengths that exceed the allocated source buffer\nbefore copying them into the assembled property block.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98687" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2f97f929dad9eb3e1f63b721d2dd49bf9bc68efa", "url": "https://git.kernel.org/stable/c/2f97f929dad9eb3e1f63b721d2dd49bf9bc68efa" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/737a1d2e9642d5f718bd29aa4a98b9eef3832f0a", "url": "https://git.kernel.org/stable/c/737a1d2e9642d5f718bd29aa4a98b9eef3832f0a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/80756e263846ab694984e749e8c626897331438f", "url": "https://git.kernel.org/stable/c/80756e263846ab694984e749e8c626897331438f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a766a86ff48acee76aeb8e2575771040749e509d", "url": "https://git.kernel.org/stable/c/a766a86ff48acee76aeb8e2575771040749e509d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b270c1074860de74da0d6b5250fb06b359b9d509", "url": "https://git.kernel.org/stable/c/b270c1074860de74da0d6b5250fb06b359b9d509" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53239", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n\nFix the race by pruning the bin while still holding xfrm_policy_lock,\nbefore dropping it. Use __xfrm_policy_inexact_prune_bin() directly since\nthe lock is already held. The wrapper xfrm_policy_inexact_prune_bin()\nbecomes unused and is removed.\n\nRace:\n\n CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO)\n ========================== ==========================\n xfrm_policy_bysel_ctx():\n spin_lock_bh(xfrm_policy_lock)\n bin = xfrm_policy_inexact_lookup()\n __xfrm_policy_unlink(pol)\n spin_unlock_bh(xfrm_policy_lock)\n xfrm_policy_kill(ret)\n // wide window, lock not held\n xfrm_hash_rebuild():\n spin_lock_bh(xfrm_policy_lock)\n __xfrm_policy_inexact_flush():\n kfree_rcu(bin) // bin freed\n spin_unlock_bh(xfrm_policy_lock)\n xfrm_policy_inexact_prune_bin(bin)\n // UAF: bin is freed", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53239" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/25c8c7fb3b0b9668c7d05e209f58c158d2b020c7", "url": "https://git.kernel.org/stable/c/25c8c7fb3b0b9668c7d05e209f58c158d2b020c7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/42827d03f8009a6a218bacab153e21f39d6a121c", "url": "https://git.kernel.org/stable/c/42827d03f8009a6a218bacab153e21f39d6a121c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7f2d76c9c03257c0782afef9d95321fa04096f60", "url": "https://git.kernel.org/stable/c/7f2d76c9c03257c0782afef9d95321fa04096f60" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/88697cf980222d5906a37bf47662dac0732e2a0f", "url": "https://git.kernel.org/stable/c/88697cf980222d5906a37bf47662dac0732e2a0f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8fc536e9f6856230f19c7d13e71af064b6a77b22", "url": "https://git.kernel.org/stable/c/8fc536e9f6856230f19c7d13e71af064b6a77b22" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b5316e2b8614a87d8736941972441cb47bfd4491", "url": "https://git.kernel.org/stable/c/b5316e2b8614a87d8736941972441cb47bfd4491" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c4c1ea36d83bf3c4569468ca5b8b614fda1bf821", "url": "https://git.kernel.org/stable/c/c4c1ea36d83bf3c4569468ca5b8b614fda1bf821" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ec82ea4eb220164d854f8734ca5a35e23e577b94", "url": "https://git.kernel.org/stable/c/ec82ea4eb220164d854f8734ca5a35e23e577b94" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" } ], "release_date": "2026-06-25T09:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53270", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear the svc scheduler ptr early on edit\n\nip_vs_edit_service() while unbinding the old scheduler clears\nthe svc->scheduler ptr after the scheduler module initiates\nRCU callbacks. This can cause packets to use the old\nscheduler at the time when svc->sched_data is already freed\nafter RCU grace period.\n\nFix it by clearing the ptr early in ip_vs_unbind_scheduler(),\nbefore the done_service method schedules any RCU callbacks.\n\nAlso, if the new scheduler fails to initialize when replacing\nthe old scheduler, try to restore the old scheduler while still\nreturning the error code.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53270" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14e4689c113b4c06af1069364ade24fdd7055f33", "url": "https://git.kernel.org/stable/c/14e4689c113b4c06af1069364ade24fdd7055f33" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/193989cc6d80dd8e0460fb3992e69fa03bf0ff9b", "url": "https://git.kernel.org/stable/c/193989cc6d80dd8e0460fb3992e69fa03bf0ff9b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03", "url": "https://git.kernel.org/stable/c/19a9493faa4bf3c7bd0a386f30b60b1bb4a3da03" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/25918720ba97f974a4f8d433b5a0132c5b43f6f3", "url": "https://git.kernel.org/stable/c/25918720ba97f974a4f8d433b5a0132c5b43f6f3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7d4f5004511757e3984901ffb412fcf858d80ed5", "url": "https://git.kernel.org/stable/c/7d4f5004511757e3984901ffb412fcf858d80ed5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c6376b9b1b4d2bad638256b1b3588e073344ae69", "url": "https://git.kernel.org/stable/c/c6376b9b1b4d2bad638256b1b3588e073344ae69" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d10730a1f2caf08088e0db1b19b242f3e6fa5f06", "url": "https://git.kernel.org/stable/c/d10730a1f2caf08088e0db1b19b242f3e6fa5f06" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e4feec3174036ba772006be74beee0efa09a9eb8", "url": "https://git.kernel.org/stable/c/e4feec3174036ba772006be74beee0efa09a9eb8" } ], "release_date": "2026-06-25T09:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-68320", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid\n\nsctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the\ncapacity limit for ep->auth_chunk_list, allowing it to hold up to\n20 chunk entries (param_hdr.length up to 24). However, the copy\ndestination asoc->c.auth_chunks in struct sctp_cookie is only\nSCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16\nchunks are added, sctp_association_init() memcpy overflows the\ndestination by up to 4 bytes.\n\nFix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching\nthe destination capacity.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68320" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/11092d79eb2b7c0068382f72fc2416d1786bb2e0", "url": "https://git.kernel.org/stable/c/11092d79eb2b7c0068382f72fc2416d1786bb2e0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3d22a7da2e264f407c729f33a0a346ff76108bc6", "url": "https://git.kernel.org/stable/c/3d22a7da2e264f407c729f33a0a346ff76108bc6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/54bb4c03fa17cdcb157c26c33e60a78cf32960f5", "url": "https://git.kernel.org/stable/c/54bb4c03fa17cdcb157c26c33e60a78cf32960f5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5a365f1e423444c5da7eb689a8661633dad43e48", "url": "https://git.kernel.org/stable/c/5a365f1e423444c5da7eb689a8661633dad43e48" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6837c1c19a259518974cbc5a52017646e3906564", "url": "https://git.kernel.org/stable/c/6837c1c19a259518974cbc5a52017646e3906564" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/886e28e14ab655012779016d251fef53d103aa12", "url": "https://git.kernel.org/stable/c/886e28e14ab655012779016d251fef53d103aa12" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b6ea3dda09eb4d5caf7bbc00f857688cf9e98255", "url": "https://git.kernel.org/stable/c/b6ea3dda09eb4d5caf7bbc00f857688cf9e98255" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff04b26794a16a8a879eb4fd2c02c2d6b03850e9", "url": "https://git.kernel.org/stable/c/ff04b26794a16a8a879eb4fd2c02c2d6b03850e9" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89555", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmpls: reload header after pskb_may_pull()\n\nmpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop\nwhen an MPLS route has multiple nexthops. While walking the MPLS label\nstack, the hash routine caches hdr for the current label. After finding\nthe bottom-of-stack label, it calls pskb_may_pull() before reading the\ninner IP header.\n\nIf an skb is constructed with the inner IP header in nonlinear data and\ninsufficient tailroom in the linear head, pskb_may_pull() calls\npskb_expand_head() to replace the skb head and free the old one. This\nleaves hdr pointing to freed memory. The IPv6 path can invalidate hdr\nagain when it performs a second pull for the larger header.\n\nThe issue was found through static analysis. A reproducer sending a legal\nGeneve packet through a bareudp/MPLS multipath setup triggered the same\nKASAN report in 2 of 2 unpatched runs:\n\n BUG: KASAN: slab-use-after-free in mpls_select_multipath\n Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23\n\n Call Trace:\n mpls_select_multipath\n mpls_forward\n __netif_receive_skb_list_core\n netif_receive_skb_list_internal\n napi_complete_done\n gro_cell_poll\n __napi_poll\n net_rx_action\n\n Freed by task 23:\n kfree\n pskb_expand_head\n __pskb_pull_tail\n mpls_select_multipath\n\nReload hdr from the current skb head after each successful pull before\nderiving the inner IPv4 or IPv6 header pointer.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89555" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/29e63b8d9fc150cc191b1c6eb7e16e1247e1b650", "url": "https://git.kernel.org/stable/c/29e63b8d9fc150cc191b1c6eb7e16e1247e1b650" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/49d38c1b4390412f8950d33dfaee0ccbd17beb81", "url": "https://git.kernel.org/stable/c/49d38c1b4390412f8950d33dfaee0ccbd17beb81" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aa4fe0b450a461aa1162fe8375f5d28f4c957df8", "url": "https://git.kernel.org/stable/c/aa4fe0b450a461aa1162fe8375f5d28f4c957df8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b1c0783b2facc398437ad8f8b86c636d7a78f8db", "url": "https://git.kernel.org/stable/c/b1c0783b2facc398437ad8f8b86c636d7a78f8db" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bfaaff99238326166694354a63a76c02563f98b1", "url": "https://git.kernel.org/stable/c/bfaaff99238326166694354a63a76c02563f98b1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d82b90a38c2ca8a0694428eab0e9551c23f2447d", "url": "https://git.kernel.org/stable/c/d82b90a38c2ca8a0694428eab0e9551c23f2447d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d9640239827d6d0cb84263b590f7a4f1596c17eb", "url": "https://git.kernel.org/stable/c/d9640239827d6d0cb84263b590f7a4f1596c17eb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fed638a248116b8a249bd4202d28e5934bdc65ad", "url": "https://git.kernel.org/stable/c/fed638a248116b8a249bd4202d28e5934bdc65ad" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74499", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()\n\nsnd_usbmidi_akai_output() computes its fill-loop bound\n\n\tbuf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1;\n\nas a signed int, so a small device-advertised bulk-OUT max_transfer\nmakes buf_end negative. The loop guard then compares the u32\nurb->transfer_buffer_length against that negative int: the usual\narithmetic conversion turns buf_end into a large unsigned value, so the\nguard stays true and each iteration keeps appending SysEx framing and\npayload bytes past the end of the URB transfer buffer, which is only\nmax_transfer bytes long.\n\nA USB device that advertises a tiny bulk-OUT endpoint can therefore\ntrigger an attacker-length- and content-controlled heap out-of-bounds\nwrite when a process writes to the created /dev/snd/midiC*D* node.\n\nReturn early when there is no room for even one SysEx, so the loop is\nnever entered with a bound that would wrap. The loop is the last\nstatement of the function, so bailing out is equivalent to it not\nrunning.\n\nDiscovered by XBOW, triaged by Baul Lee ", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74499" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/00cc659a42ac4e94ec880fae2c9bf22fce69c2e8", "url": "https://git.kernel.org/stable/c/00cc659a42ac4e94ec880fae2c9bf22fce69c2e8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0970274613fb463d376211450cab066d34ebfe6a", "url": "https://git.kernel.org/stable/c/0970274613fb463d376211450cab066d34ebfe6a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/29a4c29943631301e85f5e9d10f25741bd78e7ba", "url": "https://git.kernel.org/stable/c/29a4c29943631301e85f5e9d10f25741bd78e7ba" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b7a0f330dd90dd1a7657cec0db019ee1efa4372", "url": "https://git.kernel.org/stable/c/2b7a0f330dd90dd1a7657cec0db019ee1efa4372" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/78dfdeb8d2065524ed5928d6470bf3d3244d1009", "url": "https://git.kernel.org/stable/c/78dfdeb8d2065524ed5928d6470bf3d3244d1009" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9b22a5c8310b0d55d04f5f0159b913a2fb8b444f", "url": "https://git.kernel.org/stable/c/9b22a5c8310b0d55d04f5f0159b913a2fb8b444f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081", "url": "https://git.kernel.org/stable/c/b5305a0d0bb8e90a6fc9f88270d5f6c9b8c40081" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ce949d66607cfb000b8d8d84f80f35a886e72683", "url": "https://git.kernel.org/stable/c/ce949d66607cfb000b8d8d84f80f35a886e72683" } ], "release_date": "2026-08-15T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-64548", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()\n\nWhen the scatterlist ring is full or nearly full, bpf_msg_push_data()\nenters a copy fallback path and computes copy + len for the page\nallocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING\nand both are u32, a crafted len can wrap the sum to a small value,\ncausing an undersized allocation followed by an out-of-bounds memcpy.\n\n BUG: unable to handle page fault for address: ffffed104089a402\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n Call Trace:\n __asan_memcpy (mm/kasan/shadow.c:105)\n bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788)\n bpf_prog_9ed8b5711920a7d7+0x2e/0x36\n sk_psock_msg_verdict (net/core/skmsg.c:934)\n tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584)\n __sys_sendto (net/socket.c:2206)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd an overflow check before the allocation.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64548" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c0a8ed85349dae298712d79cb276acfeb794d82", "url": "https://git.kernel.org/stable/c/0c0a8ed85349dae298712d79cb276acfeb794d82" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4e40056bb5c829f0423f0a6694a0477726d2147e", "url": "https://git.kernel.org/stable/c/4e40056bb5c829f0423f0a6694a0477726d2147e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/888706a76286c547bd035432602571e8024b5305", "url": "https://git.kernel.org/stable/c/888706a76286c547bd035432602571e8024b5305" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a12b1575f9feabd91695a9e9d004862f7195fa25", "url": "https://git.kernel.org/stable/c/a12b1575f9feabd91695a9e9d004862f7195fa25" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bd004716ba75fed6d185795c85cdc92540ebeaab", "url": "https://git.kernel.org/stable/c/bd004716ba75fed6d185795c85cdc92540ebeaab" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/db77b6bb6e6edb79b10b4efcce346eec5582d588", "url": "https://git.kernel.org/stable/c/db77b6bb6e6edb79b10b4efcce346eec5582d588" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5", "url": "https://git.kernel.org/stable/c/f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d", "url": "https://git.kernel.org/stable/c/ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d" } ], "release_date": "2026-07-27T21:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74669", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)->opt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74669" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5", "url": "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50", "url": "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b", "url": "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00", "url": "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff", "url": "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28", "url": "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9", "url": "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006", "url": "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-0565", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "description", "text": "An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-0565" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:1188", "url": "https://access.redhat.com/errata/RHSA-2024:1188" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:1404", "url": "https://access.redhat.com/errata/RHSA-2024:1404" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:1532", "url": "https://access.redhat.com/errata/RHSA-2024:1532" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:1533", "url": "https://access.redhat.com/errata/RHSA-2024:1533" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:1607", "url": "https://access.redhat.com/errata/RHSA-2024:1607" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:1614", "url": "https://access.redhat.com/errata/RHSA-2024:1614" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:2093", "url": "https://access.redhat.com/errata/RHSA-2024:2093" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2024:2394", "url": "https://access.redhat.com/errata/RHSA-2024:2394" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2024-0565", "url": "https://access.redhat.com/security/cve/CVE-2024-0565" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2258518", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258518" }, { "category": "external", "summary": "https://www.spinics.net/lists/stable-commits/msg328851.html", "url": "https://www.spinics.net/lists/stable-commits/msg328851.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240223-0002/", "url": "https://security.netapp.com/advisory/ntap-20240223-0002/" } ], "release_date": "2024-01-15T20:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-64002", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()\n\nipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports\ntoo soon.\n\nOnly after unregister_net_sysctl_table() we can be sure no threads can possibly\nuse the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64002" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/155f90be5ee8be5b110ebc0b7da33c54c83b0208", "url": "https://git.kernel.org/stable/c/155f90be5ee8be5b110ebc0b7da33c54c83b0208" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5b23a2ff379e70b6b9ff744a972b63e1f8f4d996", "url": "https://git.kernel.org/stable/c/5b23a2ff379e70b6b9ff744a972b63e1f8f4d996" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6512c57c4638ddec113bf42439361ba85a12048d", "url": "https://git.kernel.org/stable/c/6512c57c4638ddec113bf42439361ba85a12048d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/87a1e0fe7776da7ab411be332b4be58ac8840d10", "url": "https://git.kernel.org/stable/c/87a1e0fe7776da7ab411be332b4be58ac8840d10" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57", "url": "https://git.kernel.org/stable/c/8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c", "url": "https://git.kernel.org/stable/c/a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a7f4eefb6e1458431eef9fa20fb363320d185f76", "url": "https://git.kernel.org/stable/c/a7f4eefb6e1458431eef9fa20fb363320d185f76" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ecf45080a4d3f4526cacb8b14060fe3b49a6913b", "url": "https://git.kernel.org/stable/c/ecf45080a4d3f4526cacb8b14060fe3b49a6913b" } ], "release_date": "2026-07-19T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89531", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject connection when transport allocation fails\n\nhandle_connect_req() returns without action when\nsvc_rdma_create_xprt() fails to allocate the new transport.\nThe CM core returns 0 for CONNECT_REQUEST events, so it does\nnot destroy the new rdma_cm_id. Each allocation failure under\nmemory pressure leaks one rdma_cm_id, and a remote peer driving\nconnection attempts can amplify this.\n\nReject the connection by returning a non-zero status from the\nCM event handler, which tells the CM core to destroy the\norphaned cm_id.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89531" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0944462247dcb7de7622cdaaadf5f05c52707dab", "url": "https://git.kernel.org/stable/c/0944462247dcb7de7622cdaaadf5f05c52707dab" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1f6a14c142fee4778c32709d1d54595c2e2b7991", "url": "https://git.kernel.org/stable/c/1f6a14c142fee4778c32709d1d54595c2e2b7991" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3cf372cec7ab2cd8c6002bf775cc14d90ccb098b", "url": "https://git.kernel.org/stable/c/3cf372cec7ab2cd8c6002bf775cc14d90ccb098b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5bf47bbea3c22c0af2293b6c393ab04d5420f7ab", "url": "https://git.kernel.org/stable/c/5bf47bbea3c22c0af2293b6c393ab04d5420f7ab" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6e21754bbf75075f3fee1cebc79f3417364235ec", "url": "https://git.kernel.org/stable/c/6e21754bbf75075f3fee1cebc79f3417364235ec" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-63916", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: Fix OOB write in wacom_hid_set_device_mode()\n\nwacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE\nusage is always located in the first field (field[0]) of the feature report.\nHowever, a device can specify HID_DG_INPUTMODE in a different field.\n\nIf HID_DG_INPUTMODE is in a field other than the first one and the first\nfield has a report_count smaller than the usage_index of HID_DG_INPUTMODE,\nthis leads to an out-of-bounds write to r->field[0]->value.\n\nFix this by storing the field index of HID_DG_INPUTMODE in 'struct\nhid_data' during feature mapping. In wacom_hid_set_device_mode(), use\nthis stored field index to access the correct field and add bounds\nchecks to ensure both the field index and the value index are within\nvalid ranges before writing.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-63916" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2add311d99646c9d235b2c44f9c169ba30f5db3a", "url": "https://git.kernel.org/stable/c/2add311d99646c9d235b2c44f9c169ba30f5db3a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/43e7c02d6090a82fd60d63491f6871aec906345e", "url": "https://git.kernel.org/stable/c/43e7c02d6090a82fd60d63491f6871aec906345e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5716a293fb19d382ca2336e08fd28a619a5f3c25", "url": "https://git.kernel.org/stable/c/5716a293fb19d382ca2336e08fd28a619a5f3c25" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5db3fca0cec7b33bc5379411d0a60d792c9f9bc0", "url": "https://git.kernel.org/stable/c/5db3fca0cec7b33bc5379411d0a60d792c9f9bc0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/83bd8a5756a3c4a413ed8f6253f9eb2821e1ccaf", "url": "https://git.kernel.org/stable/c/83bd8a5756a3c4a413ed8f6253f9eb2821e1ccaf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b8338111e14183972359009c12d0dbd81d2e1e16", "url": "https://git.kernel.org/stable/c/b8338111e14183972359009c12d0dbd81d2e1e16" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c0a8899e02ddebd51e2589835182c239c2e224ae", "url": "https://git.kernel.org/stable/c/c0a8899e02ddebd51e2589835182c239c2e224ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ed598de9f61582902406d352d99f2073d8e00298", "url": "https://git.kernel.org/stable/c/ed598de9f61582902406d352d99f2073d8e00298" } ], "release_date": "2026-07-19T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2025-71091", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix check for port enabled in team_queue_override_port_prio_changed()\n\nThere has been a syzkaller bug reported recently with the following\ntrace:\n\nlist_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122)\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:59!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nCPU: 3 UID: 0 PID: 21246 Comm: syz.0.2928 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:__list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59\nCode: 48 c7 c7 e0 71 f0 8b e8 30 08 ef fc 90 0f 0b 48 89 ef e8 a5 02 55 fd 48 89 ea 48 89 de 48 c7 c7 40 72 f0 8b e8 13 08 ef fc 90 <0f> 0b 48 89 ef e8 88 02 55 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff\nRSP: 0018:ffffc9000d49f370 EFLAGS: 00010286\nRAX: 000000000000004e RBX: ffff888058bea080 RCX: ffffc9002817d000\nRDX: 0000000000000000 RSI: ffffffff819becc6 RDI: 0000000000000005\nRBP: dead000000000122 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000080000000 R11: 0000000000000001 R12: ffff888039e9c230\nR13: ffff888058bea088 R14: ffff888058bea080 R15: ffff888055461480\nFS: 00007fbbcfe6f6c0(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000110c3afcb0 CR3: 00000000382c7000 CR4: 0000000000352ef0\nCall Trace:\n \n __list_del_entry_valid include/linux/list.h:132 [inline]\n __list_del_entry include/linux/list.h:223 [inline]\n list_del_rcu include/linux/rculist.h:178 [inline]\n __team_queue_override_port_del drivers/net/team/team_core.c:826 [inline]\n __team_queue_override_port_del drivers/net/team/team_core.c:821 [inline]\n team_queue_override_port_prio_changed drivers/net/team/team_core.c:883 [inline]\n team_priority_option_set+0x171/0x2f0 drivers/net/team/team_core.c:1534\n team_option_set drivers/net/team/team_core.c:376 [inline]\n team_nl_options_set_doit+0x8ae/0xe60 drivers/net/team/team_core.c:2653\n genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]\n netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346\n netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n ____sys_sendmsg+0xa98/0xc70 net/socket.c:2630\n ___sys_sendmsg+0x134/0x1d0 net/socket.c:2684\n __sys_sendmsg+0x16d/0x220 net/socket.c:2716\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe problem is in this flow:\n1) Port is enabled, queue_id != 0, in qom_list\n2) Port gets disabled\n -> team_port_disable()\n -> team_queue_override_port_del()\n -> del (removed from list)\n3) Port is disabled, queue_id != 0, not in any list\n4) Priority changes\n -> team_queue_override_port_prio_changed()\n -> checks: port disabled && queue_id != 0\n -> calls del - hits the BUG as it is removed already\n\nTo fix this, change the check in team_queue_override_port_prio_changed()\nso it returns early if port is not enabled.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-71091" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/107d245f84cb4f55f597d31eda34b42a2b7d6952", "url": "https://git.kernel.org/stable/c/107d245f84cb4f55f597d31eda34b42a2b7d6952" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/25029e813c4aae5fcf7118e8dd5c56e382b9a1a3", "url": "https://git.kernel.org/stable/c/25029e813c4aae5fcf7118e8dd5c56e382b9a1a3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/53a727a8bfd78c739e130a781192d0f6f8e03d39", "url": "https://git.kernel.org/stable/c/53a727a8bfd78c739e130a781192d0f6f8e03d39" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6bfb62b6010a16112dcae52f490e5e0e6abe12a3", "url": "https://git.kernel.org/stable/c/6bfb62b6010a16112dcae52f490e5e0e6abe12a3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/932ac51d9953eaf77a1252f79b656d4ca86163c6", "url": "https://git.kernel.org/stable/c/932ac51d9953eaf77a1252f79b656d4ca86163c6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b71187648ef2349254673d0523fdf96d1fe3d758", "url": "https://git.kernel.org/stable/c/b71187648ef2349254673d0523fdf96d1fe3d758" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f820e438b8ec2a8354e70e75145f05fe45500d97", "url": "https://git.kernel.org/stable/c/f820e438b8ec2a8354e70e75145f05fe45500d97" } ], "release_date": "2026-01-13T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89575", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm raid1: reserve space for NUL-terminator in build_constructor_string()\n\nReserve space for the termination NUL after the maximum 20 decimal\ndigits of a long long value to avoid buffer overflow in sprintf().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89575" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/01a0276706c7b6fb758a8e2ff9cf221a3dfcae97", "url": "https://git.kernel.org/stable/c/01a0276706c7b6fb758a8e2ff9cf221a3dfcae97" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0a3657ebd6b517b60cdc5123894047616974e25b", "url": "https://git.kernel.org/stable/c/0a3657ebd6b517b60cdc5123894047616974e25b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1fcc9f9f35653c5ee1a8b144ec96ff3fc48532f7", "url": "https://git.kernel.org/stable/c/1fcc9f9f35653c5ee1a8b144ec96ff3fc48532f7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/35ba81c93fe7392c973af9881640180490e76f34", "url": "https://git.kernel.org/stable/c/35ba81c93fe7392c973af9881640180490e76f34" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/644140527ae494cedf3b5c0ecd16287deaea7a66", "url": "https://git.kernel.org/stable/c/644140527ae494cedf3b5c0ecd16287deaea7a66" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/73c37fe54cd056d07461b142ab0b8b81e1ef6ad8", "url": "https://git.kernel.org/stable/c/73c37fe54cd056d07461b142ab0b8b81e1ef6ad8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7b035983b895db3ae01d9855963d42541db42125", "url": "https://git.kernel.org/stable/c/7b035983b895db3ae01d9855963d42541db42125" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f79b53ca3a68a46c6fc3b30b148d1dfb1b33ea8b", "url": "https://git.kernel.org/stable/c/f79b53ca3a68a46c6fc3b30b148d1dfb1b33ea8b" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-97509", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Keep XDomain reference during the lifetime of a service\n\nThis is needed because we release the service ID in tb_service_release()\nand the ID array is owned by the parent XDomain.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97509" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f", "url": "https://git.kernel.org/stable/c/57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8ab12d015884b8aa85ea7ed58c5a0bae4264fe60", "url": "https://git.kernel.org/stable/c/8ab12d015884b8aa85ea7ed58c5a0bae4264fe60" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8b4060998637f06975fceee9b73845d8672d411e", "url": "https://git.kernel.org/stable/c/8b4060998637f06975fceee9b73845d8672d411e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a4567e5380e4e46d0ea9a28d2d675e5c6f013d54", "url": "https://git.kernel.org/stable/c/a4567e5380e4e46d0ea9a28d2d675e5c6f013d54" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cca72fe513f3d6b1279fe83483f8a8990adbe0c6", "url": "https://git.kernel.org/stable/c/cca72fe513f3d6b1279fe83483f8a8990adbe0c6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/daeaa6c7211d03ed061b0dd22a875fad9372b090", "url": "https://git.kernel.org/stable/c/daeaa6c7211d03ed061b0dd22a875fad9372b090" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7", "url": "https://git.kernel.org/stable/c/ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7" } ], "release_date": "2026-09-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-72157", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: thunderbolt: Fix frags[] overflow by bounding frame_count\n\ntbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The\nfirst frame goes into the skb linear area and every further frame is added as\na page fragment.\n\n\tskb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,\n\t\t\tpage, hdr_size, frame_size,\n\t\t\tTBNET_RX_PAGE_SIZE - hdr_size);\n\nA packet of frame_count frames therefore ends up with frame_count - 1\nfragments. tbnet_check_frame() only bounds the peer supplied frame_count to\nTBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A\npeer that sends a packet of 19 or more small frames pushes nr_frags past\nMAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and\ncorrupts memory after the shared info.\n\nTighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never\nproduce more fragments than frags[] can hold. This matches the recent skb\nfrags overflow fixes in other receive paths, for example f0813bcd2d9d (\"net:\nwwan: t7xx: fix potential skb->frags overflow in RX path\") and 600dc40554dc\n(\"net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()\").", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72157" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b3b4e5ff5a58ad32817824b0310e63908b12052", "url": "https://git.kernel.org/stable/c/2b3b4e5ff5a58ad32817824b0310e63908b12052" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/55d9895f89970501fe126d1026b586b04a224c27", "url": "https://git.kernel.org/stable/c/55d9895f89970501fe126d1026b586b04a224c27" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/569ba39b2d12995a29dc158e5b4de6e449278f30", "url": "https://git.kernel.org/stable/c/569ba39b2d12995a29dc158e5b4de6e449278f30" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6262f51e09d8dc8b07599a9e4f03bd3989d13fff", "url": "https://git.kernel.org/stable/c/6262f51e09d8dc8b07599a9e4f03bd3989d13fff" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e27beb4536cbf1d59e2d8c2840e87d972aba906f", "url": "https://git.kernel.org/stable/c/e27beb4536cbf1d59e2d8c2840e87d972aba906f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e5824d5b841d99a2bcdd4e2c256643293bbc22c1", "url": "https://git.kernel.org/stable/c/e5824d5b841d99a2bcdd4e2c256643293bbc22c1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f96b3b35c622d565eff2438993e028d280163f5c", "url": "https://git.kernel.org/stable/c/f96b3b35c622d565eff2438993e028d280163f5c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3", "url": "https://git.kernel.org/stable/c/fe6b606fbf0c3beb94ccf17fcf31d8c2138264e3" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89656", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject buckets with mismatched CRUSH ids\n\ncrush_decode() stores bucket data by array slot, and the mapper later\nderives the per-bucket workspace index from the decoded bucket id. A\nmalformed map can therefore make one bucket reuse another bucket's\nworkspace by encoding an id different from -1 - slot.\n\nFor uniform buckets, the second replica selection expands the source\nbucket's permutation into that aliased workspace buffer. If the source\nbucket is larger than the aliased bucket, the write runs past the smaller\npermutation array and can escape the kvmalloc'd CRUSH workspace. KASAN\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\n\nReject buckets whose encoded id does not match their array slot. Valid\nCRUSH maps already use the canonical negative id corresponding to the\nbucket slot, so this restores the invariant expected by\nwork->work[-1 - in->id] without changing valid map behavior.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89656" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24", "url": "https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd", "url": "https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11", "url": "https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a", "url": "https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022", "url": "https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83", "url": "https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716", "url": "https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a", "url": "https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-72491", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/9p: fix race condition on rdma->state in trans_rdma.c\n\nThe rdma->state field is modified without holding req_lock in both\nrecv_done() and p9_cm_event_handler(), while rdma_request() accesses\nthe same field under the req_lock spinlock. This inconsistent locking\ncreates a race condition:\n\n- recv_done() running in softirq completion context sets\n rdma->state = P9_RDMA_FLUSHING without acquiring req_lock\n\n- p9_cm_event_handler() modifies rdma->state at multiple points\n (ADDR_RESOLVED, ROUTE_RESOLVED, ESTABLISHED, CLOSED) without\n req_lock\n\n- rdma_request() uses spin_lock_irqsave(&rdma->req_lock, flags) to\n protect the read-modify-write of rdma->state\n\nThe race can cause lost state transitions: recv_done() or the CM\nevent handler could set state to FLUSHING/CLOSED while rdma_request()\nis concurrently checking or modifying state under the lock, leading to\nthe FLUSHING transition being silently overwritten by CLOSING. This\ncorrupts the connection state machine and can cause use-after-free on\nRDMA request objects during teardown.\n\nFix by adding req_lock protection to all rdma->state modifications in\nrecv_done() and p9_cm_event_handler(), matching the pattern already\nused in rdma_request(). Use spin_lock_irqsave/spin_unlock_irqrestore\nin the CM event handler since it can race with recv_done() which runs\nin softirq context.\n\nTested with a kernel module that races two threads (simulating\nrdma_request and recv_done/CM handler) on rdma->state with proper\nlocking: 5.5M+ FLUSHING writes over 27M iterations with 0 lost\ntransitions.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72491" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/13bf9879b778b2f4b260b45bed18f31806120d1e", "url": "https://git.kernel.org/stable/c/13bf9879b778b2f4b260b45bed18f31806120d1e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/151f8cf5b23d8a534d884432a82a6d54d5a61989", "url": "https://git.kernel.org/stable/c/151f8cf5b23d8a534d884432a82a6d54d5a61989" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3970a19a80de530b801b6256354d4a529a9a2d6c", "url": "https://git.kernel.org/stable/c/3970a19a80de530b801b6256354d4a529a9a2d6c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4cee2b8766045059d5e0b8114837b4a8efe827ac", "url": "https://git.kernel.org/stable/c/4cee2b8766045059d5e0b8114837b4a8efe827ac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5424138848eb7d7d8a7196676e90a2cbf2142454", "url": "https://git.kernel.org/stable/c/5424138848eb7d7d8a7196676e90a2cbf2142454" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7d54894a1ee265a72d70f7cae1da6cc774cccc71", "url": "https://git.kernel.org/stable/c/7d54894a1ee265a72d70f7cae1da6cc774cccc71" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8aadc136d8e8d8fc95d7982d213cfe2234dfcf2b", "url": "https://git.kernel.org/stable/c/8aadc136d8e8d8fc95d7982d213cfe2234dfcf2b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ebbcbe5c0db215feecc17def06178da443f4eea6", "url": "https://git.kernel.org/stable/c/ebbcbe5c0db215feecc17def06178da443f4eea6" } ], "release_date": "2026-08-15T06:22:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74587", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix use-after-free of cached ASCONF chunk\n\naddip_last_asconf caches the outstanding outbound ASCONF chunk. The normal\nASCONF-ACK completion path releases the chunk and clears the pointer.\n\nHowever, sctp_asconf_queue_teardown() releases the cached chunk without\nclearing addip_last_asconf. During peer restart handling,\nsctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes\nsctp_asconf_queue_teardown() while the association remains alive and leaves\nthe pointer dangling.\n\nA delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(),\nwhich accesses the stale chunk and passes it to sctp_process_asconf_ack(),\ncausing a use-after-free and a second release.\n\nClearing the pointer exposes a race with T4 expiry. Peer restart handling\nqueues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses\ntimer_delete(), which does not wait for a callback already running on\nanother CPU. Such a callback can reach sctp_sf_t4_timer_expire() after\nthe purge and dereference NULL.\n\nClear addip_last_asconf after releasing the cached chunk, and make\nsctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding\nASCONF remains.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74587" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/07daf4f9750104960a1d60831b2353c0d41f35fb", "url": "https://git.kernel.org/stable/c/07daf4f9750104960a1d60831b2353c0d41f35fb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/10459b03e2d9ee12435e96f587de4d4cacdbf435", "url": "https://git.kernel.org/stable/c/10459b03e2d9ee12435e96f587de4d4cacdbf435" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/179676f0166230c80053a392303485b37c93dd33", "url": "https://git.kernel.org/stable/c/179676f0166230c80053a392303485b37c93dd33" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/618b5c6d049896fcfabb91afc072954c92cb2693", "url": "https://git.kernel.org/stable/c/618b5c6d049896fcfabb91afc072954c92cb2693" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c283e7b56adce00193837f3311b06662466fb21", "url": "https://git.kernel.org/stable/c/8c283e7b56adce00193837f3311b06662466fb21" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d949992bc3f00027a2c755e860a11950c75f6073", "url": "https://git.kernel.org/stable/c/d949992bc3f00027a2c755e860a11950c75f6073" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d", "url": "https://git.kernel.org/stable/c/dc67d528c2fa939cec7fe3bf7f3089c8d281ca3d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e1bb114e09372fd6e03387ced9ef566da336ed6c", "url": "https://git.kernel.org/stable/c/e1bb114e09372fd6e03387ced9ef566da336ed6c" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74597", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2->cb[] in ip6ip6_err()\n\nip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the\nquoted inner IPv6 packet, and then passes the clone to icmpv6_send().\nThe clone still carries the outer packet's inet6_skb_parm in skb->cb.\n\nIf the outer packet had a Home Address Option, IP6CB(skb2)->dsthao\nremains non-zero after skb_pull(). icmpv6_send() later calls\nmip6_addr_swap(), which uses that stale dsthao offset against the quoted\ninner packet. A malformed inner destination-options header can then make\nthe HAO lookup and address swap run past the end of the quoted packet\nand corrupt skb_shared_info.\n\nClear skb2->cb[] before pulling the quoted inner IPv6 packet so the\nreply path does not reuse metadata left by the outer IPv6 stack.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74597" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0dadb0620ab65949a8bc2439dd28ea3c942fe87d", "url": "https://git.kernel.org/stable/c/0dadb0620ab65949a8bc2439dd28ea3c942fe87d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/44fe898df302e91c5ee5acbc71ffa74e78e6c183", "url": "https://git.kernel.org/stable/c/44fe898df302e91c5ee5acbc71ffa74e78e6c183" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/484134e1eb07d700a73b1e4bbf3fb503e299be60", "url": "https://git.kernel.org/stable/c/484134e1eb07d700a73b1e4bbf3fb503e299be60" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4eb15c465337b18f44716c499cd6ad63eee0ad54", "url": "https://git.kernel.org/stable/c/4eb15c465337b18f44716c499cd6ad63eee0ad54" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/64e41736a26f37ab6215bc2e6df125df05aceb08", "url": "https://git.kernel.org/stable/c/64e41736a26f37ab6215bc2e6df125df05aceb08" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b6816536a2990c0db44a26130a03e40b441e829b", "url": "https://git.kernel.org/stable/c/b6816536a2990c0db44a26130a03e40b441e829b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f803c086399da277b5d0ff36a107d0f162751800", "url": "https://git.kernel.org/stable/c/f803c086399da277b5d0ff36a107d0f162751800" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fbf40faa0414b753212494ad197542002e66ed9e", "url": "https://git.kernel.org/stable/c/fbf40faa0414b753212494ad197542002e66ed9e" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98348", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: reject too-short association responses\n\nlibipw_handle_assoc_resp() reads the capability, status and aid fields\nof the 30-byte association response prefix and then computes the\ninformation element length as\n\n\tstats->len - sizeof(*frame)\n\nstats->len is a u16 and sizeof() has type size_t, so the subtraction is\nevaluated as size_t and wraps instead of going negative. Truncating\nthat to the u16 length parameter of libipw_parse_info_param() turns a\nframe shorter than the fixed fields into a length near 64 KiB, and the\nparser then reads past the receive buffer.\n\nBoth the ipw2100 and ipw2200 management receive paths reach this\nfunction having established only that the frame carries the generic\n24-byte three-address header.\n\nReject the frame before any fixed field is touched.\n\nFound by an AI-assisted review of length arithmetic in management frame\nparsers. Verified with a KUnit case under Generic KASAN on arm64 under\nQEMU; I do not have the hardware, so it is not tested on a real device.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98348" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb", "url": "https://git.kernel.org/stable/c/14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/400b89217058fac672134a0d4092c8493dadb8ad", "url": "https://git.kernel.org/stable/c/400b89217058fac672134a0d4092c8493dadb8ad" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/46aa75291056b6dc5faaf956dffdb3e9662477b0", "url": "https://git.kernel.org/stable/c/46aa75291056b6dc5faaf956dffdb3e9662477b0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/766268b429ae26d8ca599031fa962b0fe4673120", "url": "https://git.kernel.org/stable/c/766268b429ae26d8ca599031fa962b0fe4673120" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/adb7118b7d2cfd7e8213c17d7d2829f353017754", "url": "https://git.kernel.org/stable/c/adb7118b7d2cfd7e8213c17d7d2829f353017754" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/af1b69be19c34e28c0ae54bee954b58cd076969a", "url": "https://git.kernel.org/stable/c/af1b69be19c34e28c0ae54bee954b58cd076969a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d70bdb84cf1782039384c1ffa7a18b0303c286a7", "url": "https://git.kernel.org/stable/c/d70bdb84cf1782039384c1ffa7a18b0303c286a7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e3025ecdb2057f866c09e059fc1466e81d6f243e", "url": "https://git.kernel.org/stable/c/e3025ecdb2057f866c09e059fc1466e81d6f243e" } ], "release_date": "2026-10-06T09:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-46189", "cwe": { "id": "CWE-415", "name": "Double Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path\n\nSashiko points out that pvrdma_uar_free() is already called within\npvrdma_dealloc_ucontext(), so calling it before triggers a double free.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46189" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c63333ff97bd1275294fd12840a0efe9d7a4c59", "url": "https://git.kernel.org/stable/c/0c63333ff97bd1275294fd12840a0efe9d7a4c59" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1df5711121cdc11e76b889408fdbe459feba1d39", "url": "https://git.kernel.org/stable/c/1df5711121cdc11e76b889408fdbe459feba1d39" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/269967d7693304e1f06ed2dff4ebbbeeb397cda4", "url": "https://git.kernel.org/stable/c/269967d7693304e1f06ed2dff4ebbbeeb397cda4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3a231c34c5bc3d3cfc850b877758ec9fdaa8a483", "url": "https://git.kernel.org/stable/c/3a231c34c5bc3d3cfc850b877758ec9fdaa8a483" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/45d25e3ec17900bf5a9d6876ff16ceee31c4c0e0", "url": "https://git.kernel.org/stable/c/45d25e3ec17900bf5a9d6876ff16ceee31c4c0e0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/935ee27d0904aa944cbcc979094c20e5ef62eead", "url": "https://git.kernel.org/stable/c/935ee27d0904aa944cbcc979094c20e5ef62eead" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e38e86995df27f1f854063dab1f0c6a513db3faf", "url": "https://git.kernel.org/stable/c/e38e86995df27f1f854063dab1f0c6a513db3faf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ecc36a82ecfcfdf3c6606d209f22ec5543c410e0", "url": "https://git.kernel.org/stable/c/ecc36a82ecfcfdf3c6606d209f22ec5543c410e0" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:30848", "url": "https://access.redhat.com/errata/RHSA-2026:30848" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33685", "url": "https://access.redhat.com/errata/RHSA-2026:33685" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:33743", "url": "https://access.redhat.com/errata/RHSA-2026:33743" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:35904", "url": "https://access.redhat.com/errata/RHSA-2026:35904" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36049", "url": "https://access.redhat.com/errata/RHSA-2026:36049" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36073", "url": "https://access.redhat.com/errata/RHSA-2026:36073" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36767", "url": "https://access.redhat.com/errata/RHSA-2026:36767" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:38902", "url": "https://access.redhat.com/errata/RHSA-2026:38902" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:40068", "url": "https://access.redhat.com/errata/RHSA-2026:40068" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:40760", "url": "https://access.redhat.com/errata/RHSA-2026:40760" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47633", "url": "https://access.redhat.com/errata/RHSA-2026:47633" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-46189", "url": "https://access.redhat.com/security/cve/CVE-2026-46189" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2482588", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482588" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46189.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46189.json" } ], "release_date": "2026-05-28T10:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90203", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check block offset is not negative\n\nIf a negative offset is read off disk (for example the offset into the\ndecompressed fragment block), this will cause squashfs_copy_data() to\nperform an out of bounds access.\n\nFix by checking if offset is negative, and returning 0. This matches\nexisting behaviour where an offset beyond the block returns 0 bytes\ncopied.\n\nTo trigger this out of bounds access requires a crafted Squashfs\nfilesystem and CAP_SYS_ADMIN to mount it. Unprivileged users will not be\nable to mount such a filesystem, but once mounted, an unprivileged user\ncan trigger the out of bounds access by reading the crafted file with the\nnegative offset.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90203" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3d2f0cb66c909ea2312cdef465165bb9a3ba2d84", "url": "https://git.kernel.org/stable/c/3d2f0cb66c909ea2312cdef465165bb9a3ba2d84" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/95dadf366c117dcdca78a570e6832071deab1ecd", "url": "https://git.kernel.org/stable/c/95dadf366c117dcdca78a570e6832071deab1ecd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b169185d5c672b989985c6c2e38cafab2548ba88", "url": "https://git.kernel.org/stable/c/b169185d5c672b989985c6c2e38cafab2548ba88" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bbb2218eb072b0a15dc063929200183bd23c2344", "url": "https://git.kernel.org/stable/c/bbb2218eb072b0a15dc063929200183bd23c2344" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c2a126fca820ae74872da28de68dc74d4595dc4b", "url": "https://git.kernel.org/stable/c/c2a126fca820ae74872da28de68dc74d4595dc4b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d0a3729d464fcf516416a41cf304c0c92126ee03", "url": "https://git.kernel.org/stable/c/d0a3729d464fcf516416a41cf304c0c92126ee03" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e300eb5002925b29be803d2661af07266cfa267e", "url": "https://git.kernel.org/stable/c/e300eb5002925b29be803d2661af07266cfa267e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e4afd90bc7bf3dd477970c6c42bdd29ad3fda7fe", "url": "https://git.kernel.org/stable/c/e4afd90bc7bf3dd477970c6c42bdd29ad3fda7fe" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-89854", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix cs84xx use-after-free on host teardown\n\nqla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via\n__qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran\nbefore scsi_remove_host(), which is what removes the 84xx_fw_version host\nsysfs attribute. A concurrent read of that attribute in the window between\nthe two calls executes qla24xx_84xx_fw_version_show(), which dereferences\nthe freed ha->cs84xx, resulting in a use-after-free.\n\nMove qla84xx_put_chip() to after scsi_remove_host() in both\nqla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once\nscsi_remove_host() returns, the sysfs attribute is gone and kernfs has\ndrained any in-flight show(), so no reader can touch cs84xx; the put still\nruns before the host and ha are freed.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89854" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/122bf170c94a3797531b12fee580639a5dc893ed", "url": "https://git.kernel.org/stable/c/122bf170c94a3797531b12fee580639a5dc893ed" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1d8bbc4344b9367d9d54731475d745fbc9ea28f2", "url": "https://git.kernel.org/stable/c/1d8bbc4344b9367d9d54731475d745fbc9ea28f2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c3b17ee53f034936f7398dbf4d143e608b7c35c", "url": "https://git.kernel.org/stable/c/2c3b17ee53f034936f7398dbf4d143e608b7c35c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/33d102102d925357c5fd172dd6672a27d74b3215", "url": "https://git.kernel.org/stable/c/33d102102d925357c5fd172dd6672a27d74b3215" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8286a9095fb59751fba171afa2b4f590271c87d5", "url": "https://git.kernel.org/stable/c/8286a9095fb59751fba171afa2b4f590271c87d5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c1ebcade6aac58137f2645b579894301febabf3", "url": "https://git.kernel.org/stable/c/8c1ebcade6aac58137f2645b579894301febabf3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae09260be7454ed7630a913f147591a25e3a9d09", "url": "https://git.kernel.org/stable/c/ae09260be7454ed7630a913f147591a25e3a9d09" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fcf0804dfe05862007189ac9dc4dc2063be36de1", "url": "https://git.kernel.org/stable/c/fcf0804dfe05862007189ac9dc4dc2063be36de1" } ], "release_date": "2026-09-16T11:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2025-38685", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix vmalloc out-of-bounds write in fast_imageblit\n\nThis issue triggers when a userspace program does an ioctl\nFBIOPUT_CON2FBMAP by passing console number and frame buffer number.\nIdeally this maps console to frame buffer and updates the screen if\nconsole is visible.\n\nAs part of mapping it has to do resize of console according to frame\nbuffer info. if this resize fails and returns from vc_do_resize() and\ncontinues further. At this point console and new frame buffer are mapped\nand sets display vars. Despite failure still it continue to proceed\nupdating the screen at later stages where vc_data is related to previous\nframe buffer and frame buffer info and display vars are mapped to new\nframe buffer and eventully leading to out-of-bounds write in\nfast_imageblit(). This bheviour is excepted only when fg_console is\nequal to requested console which is a visible console and updates screen\nwith invalid struct references in fbcon_putcs().", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-38685" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/078e62bffca4b7e72e8f3550eb063ab981c36c7a", "url": "https://git.kernel.org/stable/c/078e62bffca4b7e72e8f3550eb063ab981c36c7a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/27b118aebdd84161c8ff5ce49d9d536f2af10754", "url": "https://git.kernel.org/stable/c/27b118aebdd84161c8ff5ce49d9d536f2af10754" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4c4d7ddaf1d43780b106bedc692679f965dc5a3a", "url": "https://git.kernel.org/stable/c/4c4d7ddaf1d43780b106bedc692679f965dc5a3a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/56701bf9eeb63219e378cb7fcbd066ea4eaeeb50", "url": "https://git.kernel.org/stable/c/56701bf9eeb63219e378cb7fcbd066ea4eaeeb50" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/af0db3c1f898144846d4c172531a199bb3ca375d", "url": "https://git.kernel.org/stable/c/af0db3c1f898144846d4c172531a199bb3ca375d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cfec17721265e72e50cc69c6004fe3475cd38df2", "url": "https://git.kernel.org/stable/c/cfec17721265e72e50cc69c6004fe3475cd38df2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ed9b8e5016230868c8d813d9179523f729fec8c6", "url": "https://git.kernel.org/stable/c/ed9b8e5016230868c8d813d9179523f729fec8c6" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" } ], "release_date": "2025-09-04T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-68283", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: replace BUG_ON with bounds check for map->max_osd\n\nOSD indexes come from untrusted network packets. Boundary checks are\nadded to validate these against map->max_osd.\n\n[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic\n edits ]", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-68283" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/57f5fbae9f1024aba17ff75e00433324115c548a", "url": "https://git.kernel.org/stable/c/57f5fbae9f1024aba17ff75e00433324115c548a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4368b7f97014e1015445d61abd0b27c4c6e8424", "url": "https://git.kernel.org/stable/c/b4368b7f97014e1015445d61abd0b27c4c6e8424" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/becc488a4d864db338ebd4e313aa3c77da24b604", "url": "https://git.kernel.org/stable/c/becc488a4d864db338ebd4e313aa3c77da24b604" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e67e3be690f5f7e3b031cf29e8d91e6d02a8e30d", "url": "https://git.kernel.org/stable/c/e67e3be690f5f7e3b031cf29e8d91e6d02a8e30d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ec3797f043756a94ea2d0f106022e14ac4946c02", "url": "https://git.kernel.org/stable/c/ec3797f043756a94ea2d0f106022e14ac4946c02" } ], "release_date": "2025-12-16T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53157", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phonet: free phonet_device after RCU grace period\n\nphonet_device_destroy() removes a phonet_device from the per-net device\nlist with list_del_rcu(), but frees it immediately. RCU readers walking\nthe same list can still hold a pointer to the object after it has been\nremoved, leading to a slab-use-after-free.\n\nUse kfree_rcu(), matching the lifetime rule already used by\nphonet_address_del() for the same object type.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53157" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0", "url": "https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578", "url": "https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001", "url": "https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763", "url": "https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296", "url": "https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bd2ab4d800fc26814d89328d87b5f97ef6aa906a", "url": "https://git.kernel.org/stable/c/bd2ab4d800fc26814d89328d87b5f97ef6aa906a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bff309ea51f1395c1ef8be8b75ce62d28a319113", "url": "https://git.kernel.org/stable/c/bff309ea51f1395c1ef8be8b75ce62d28a319113" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d59794337ea496042288c7c68356d9b9ca7f46a9", "url": "https://git.kernel.org/stable/c/d59794337ea496042288c7c68356d9b9ca7f46a9" } ], "release_date": "2026-06-25T09:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-90111", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6mr: do not clone dst in ip6mr_cache_report()\n\nIPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.\nWhen an ingress multicast packet misses MFC lookup,\nip6mr_cache_unresolved() places the skb onto the unresolved queue,\nescaping the receive-side RCU grace period.\n\nIf the underlying route is deleted and freed, and the MFC queue is later\nresolved with a wrong parent interface, ip6_mr_forward() invokes\nip6mr_cache_report(..., MRT6MSG_WRONGMIF), which executes\ndst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab\nuse-after-free.\n\nReport packets queued to mroute6_sk (a raw socket) and netlink\nnotifications do not require an attached dst entry.\n\nFix this by:\n1. Removing dst_clone() in ip6mr_cache_report() and ensuring report skbs\n do not hold a dst.\n2. Dropping skb_dst before queuing unresolved skbs in\n ip6mr_cache_unresolved(), matching the fact that multicast\n forwarding resolves outgoing routes anew via ip6_route_output().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90111" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/235b42b5860189eb8c27c36435ad932cae65a734", "url": "https://git.kernel.org/stable/c/235b42b5860189eb8c27c36435ad932cae65a734" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/42ef371466d5648f5c9e8bc219f0af0a2c2bbf8c", "url": "https://git.kernel.org/stable/c/42ef371466d5648f5c9e8bc219f0af0a2c2bbf8c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4a674afaae4136c71943aa3e35d433676fd40e8f", "url": "https://git.kernel.org/stable/c/4a674afaae4136c71943aa3e35d433676fd40e8f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7f8287f606c8c028d4224e85d95dc448c6d6d623", "url": "https://git.kernel.org/stable/c/7f8287f606c8c028d4224e85d95dc448c6d6d623" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f57b0fd1c62e1be274ee154ab7fb8ac4481b7f89", "url": "https://git.kernel.org/stable/c/f57b0fd1c62e1be274ee154ab7fb8ac4481b7f89" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-26589", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject variable offset alu on PTR_TO_FLOW_KEYS\n\nFor PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off\nfor validation. However, variable offset ptr alu is not prohibited\nfor this ptr kind. So the variable offset is not checked.\n\nThe following prog is accepted:\n\n func#0 @0\n 0: R1=ctx() R10=fp0\n 0: (bf) r6 = r1 ; R1=ctx() R6_w=ctx()\n 1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys()\n 2: (b7) r8 = 1024 ; R8_w=1024\n 3: (37) r8 /= 1 ; R8_w=scalar()\n 4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0,\n smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400))\n 5: (0f) r7 += r8\n mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1\n mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024\n mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1\n mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024\n 6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off\n =(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024,\n var_off=(0x0; 0x400))\n 6: (79) r0 = *(u64 *)(r7 +0) ; R0_w=scalar()\n 7: (95) exit\n\nThis prog loads flow_keys to r7, and adds the variable offset r8\nto r7, and finally causes out-of-bounds access:\n\n BUG: unable to handle page fault for address: ffffc90014c80038\n [...]\n Call Trace:\n \n bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline]\n __bpf_prog_run include/linux/filter.h:651 [inline]\n bpf_prog_run include/linux/filter.h:658 [inline]\n bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline]\n bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991\n bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359\n bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline]\n __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475\n __do_sys_bpf kernel/bpf/syscall.c:5561 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5559 [inline]\n __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nFix this by rejecting ptr alu with variable offset on flow_keys.\nApplying the patch rejects the program with \"R7 pointer arithmetic\non flow_keys prohibited\".", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-26589" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1b500d5d6cecf98dd6ca88bc9e7ae1783c83e6d3", "url": "https://git.kernel.org/stable/c/1b500d5d6cecf98dd6ca88bc9e7ae1783c83e6d3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/22c7fa171a02d310e3a3f6ed46a698ca8a0060ed", "url": "https://git.kernel.org/stable/c/22c7fa171a02d310e3a3f6ed46a698ca8a0060ed" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/29ffa63f21bcdcef3e36b03cccf9d0cd031f6ab0", "url": "https://git.kernel.org/stable/c/29ffa63f21bcdcef3e36b03cccf9d0cd031f6ab0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4108b86e324da42f7ed425bd71632fd844300dc8", "url": "https://git.kernel.org/stable/c/4108b86e324da42f7ed425bd71632fd844300dc8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e8d3872b617c21100c5ee4f64e513997a68c2e3d", "url": "https://git.kernel.org/stable/c/e8d3872b617c21100c5ee4f64e513997a68c2e3d" } ], "release_date": "2024-02-22T16:13:33Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89469", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: lp8727: fix use-after-free in lp8727_release_irq()\n\nlp8727_isr_func(), the threaded IRQ handler, is the only caller that arms\npchg->work via schedule_delayed_work(). lp8727_release_irq() currently\ncancels the work before freeing the IRQ, so an IRQ delivered in between\ncan re-arm the work through the threaded handler. After .remove returns\nthe devm layer frees pchg while lp8727_delayed_func() may still run and\ndereference it.\n\nFree the IRQ first so the threaded handler is quiesced and can no longer\nqueue work, then cancel the delayed work to drain the final generation.\n\nThis issue was found by an in-house static analysis tool.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89469" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/035cc6bc4d412dd4302862e8f859b784fcd4653b", "url": "https://git.kernel.org/stable/c/035cc6bc4d412dd4302862e8f859b784fcd4653b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1321a4e6247164312eabc6d07f88572da2ee308c", "url": "https://git.kernel.org/stable/c/1321a4e6247164312eabc6d07f88572da2ee308c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6ab3128292df67295de1b2a86f21d89cf6612a7e", "url": "https://git.kernel.org/stable/c/6ab3128292df67295de1b2a86f21d89cf6612a7e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6f0ce09d60a0e4fab6f9ebe8294750481f0c19dd", "url": "https://git.kernel.org/stable/c/6f0ce09d60a0e4fab6f9ebe8294750481f0c19dd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/80d4e40a85ba524e66c8c748aa7bb19eaf2f69df", "url": "https://git.kernel.org/stable/c/80d4e40a85ba524e66c8c748aa7bb19eaf2f69df" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ab6b1ad710bed7931540733ce145493fece8ceef", "url": "https://git.kernel.org/stable/c/ab6b1ad710bed7931540733ce145493fece8ceef" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ceb6ac43b0f591722401922ceb958ce2616935e0", "url": "https://git.kernel.org/stable/c/ceb6ac43b0f591722401922ceb958ce2616935e0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dc1dc2837f8e53bde2f16d52a63f4142e21757f1", "url": "https://git.kernel.org/stable/c/dc1dc2837f8e53bde2f16d52a63f4142e21757f1" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-46184", "cwe": { "id": "CWE-369", "name": "Divide By Zero" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsound: ua101: fix division by zero at probe\n\nAdd a missing sanity check for bNrChannels in detect_usb_format()\nto prevent a division by zero in playback_urb_complete() and\ncapture_urb_complete().\n\nUSB core does not validate class-specific descriptor fields such\nas bNrChannels, so drivers must verify them before use. If a\ndevice provides bNrChannels = 0, frame_bytes becomes zero and is\nlater used as a divisor in the URB completion handlers, leading\nto a kernel crash.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-46184" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0ff2b713f406e9ecadb406014d74e7a020ac12b1", "url": "https://git.kernel.org/stable/c/0ff2b713f406e9ecadb406014d74e7a020ac12b1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/593dd7e6c890d8e4ca21b3e2f796b7cb8e8da983", "url": "https://git.kernel.org/stable/c/593dd7e6c890d8e4ca21b3e2f796b7cb8e8da983" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6162e8212e88c39492d981b248b5e37002486c66", "url": "https://git.kernel.org/stable/c/6162e8212e88c39492d981b248b5e37002486c66" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/66d9c2ed081f299cfb201d9e9c4faf920e56e0bf", "url": "https://git.kernel.org/stable/c/66d9c2ed081f299cfb201d9e9c4faf920e56e0bf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aae1498c59f48d03ee358df84f07a5af9885f827", "url": "https://git.kernel.org/stable/c/aae1498c59f48d03ee358df84f07a5af9885f827" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d1f73f169c1014463b5060e3f60813e13ddc7b87", "url": "https://git.kernel.org/stable/c/d1f73f169c1014463b5060e3f60813e13ddc7b87" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e02897c5b041c9b980055fa9a6167023d6dc5caf", "url": "https://git.kernel.org/stable/c/e02897c5b041c9b980055fa9a6167023d6dc5caf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1862dbf09080254c52175a448290c784dd7d3de", "url": "https://git.kernel.org/stable/c/f1862dbf09080254c52175a448290c784dd7d3de" } ], "release_date": "2026-05-28T10:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-89965", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm/btt: reject an arena whose nfree is below the lane count\n\nThe BTT info block's nfree field, the number of reserve free blocks, is\nread from the medium without validation. btt_freelist_init() and\nbtt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree,\nbut the I/O path indexes them by the lane from nd_region_acquire_lane(),\nwhich is bounded by nd_region->num_lanes (ND_MAX_LANES), not by nfree.\nA crafted or foreign arena whose nfree is below the lane count makes\nfreelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write.\n\nbtt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the\ncode does not currently honor: num_lanes is ND_MAX_LANES regardless of\nnfree. Reject an arena whose nfree is below num_lanes at discovery,\nbefore the per-lane arrays are allocated, enforcing that invariant.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89965" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/59d5cd1f42b4bab3609512c3cb3d3540d3d21da7", "url": "https://git.kernel.org/stable/c/59d5cd1f42b4bab3609512c3cb3d3540d3d21da7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6a1f2e5ed9267ca19187038ac635393c165213ac", "url": "https://git.kernel.org/stable/c/6a1f2e5ed9267ca19187038ac635393c165213ac" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b1faf1f099f7060b5f1f2f0d024132581f1726e", "url": "https://git.kernel.org/stable/c/6b1faf1f099f7060b5f1f2f0d024132581f1726e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6f79d1a5f2611a3d36e9312be5425cd9cb397c51", "url": "https://git.kernel.org/stable/c/6f79d1a5f2611a3d36e9312be5425cd9cb397c51" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9dfa11cef4750b67591307f2c62e47a23d60e4b7", "url": "https://git.kernel.org/stable/c/9dfa11cef4750b67591307f2c62e47a23d60e4b7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/eb491343d2d1784121ad9af91c25b338c28913c3", "url": "https://git.kernel.org/stable/c/eb491343d2d1784121ad9af91c25b338c28913c3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f6c5313aae794ecca8f762c1a3493de5c266f120", "url": "https://git.kernel.org/stable/c/f6c5313aae794ecca8f762c1a3493de5c266f120" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f9bf05c63b77d000e9c01f3e47af36973887d350", "url": "https://git.kernel.org/stable/c/f9bf05c63b77d000e9c01f3e47af36973887d350" } ], "release_date": "2026-09-16T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98739", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix initial port reference race\n\nFor RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and\n__rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the\ninitial tty_port reference. The release path tests the bit separately\nfrom the install path setting it, so both can drop that reference.\n\nThe synchronous hangup does not prevent this race: port->tty is not\nassigned until tty_port_open(), after installation. The following\ninterleaving is possible:\n\n 1. Install and release each obtain a reference with rfcomm_dev_get().\n 2. Release observes RFCOMM_TTY_OWNED clear.\n 3. Install sets RFCOMM_TTY_OWNED and drops the initial reference.\n 4. Release drops the same initial reference again.\n 5. TTY cleanup drops its reference and frees the device.\n 6. Release performs its final tty_port_put() on the freed port.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190\n Write of size 4 at addr ffff8881001d3d5c by task poc/92\n\n Call Trace:\n tty_port_put+0x22/0x190\n rfcomm_dev_ioctl+0x1d4/0x1930\n sock_do_ioctl+0x110/0x260\n sock_ioctl+0x380/0x590\n __x64_sys_ioctl+0x134/0x1c0\n\n Allocated by task 88:\n rfcomm_dev_ioctl+0x8f6/0x1930\n sock_do_ioctl+0x110/0x260\n sock_ioctl+0x380/0x590\n __x64_sys_ioctl+0x134/0x1c0\n\n Freed by task 65:\n kfree+0x131/0x3c0\n rfcomm_dev_destruct+0x23b/0x2f0\n release_one_tty+0xc1/0x370\n process_one_work+0x661/0x1090\n\nUse test_and_set_bit() in both paths so that only the caller that changes\nRFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path\nkeeps its own lookup reference until release or TTY cleanup, preserving\nthe existing callback ordering and error handling.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98739" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0a554901bd227537f79220443b2b36d585d62893", "url": "https://git.kernel.org/stable/c/0a554901bd227537f79220443b2b36d585d62893" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2d696c1ed3468dcb62578a3911e687110d463520", "url": "https://git.kernel.org/stable/c/2d696c1ed3468dcb62578a3911e687110d463520" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9", "url": "https://git.kernel.org/stable/c/55d162aa00d1ee33c3e6fa88b71f1e2d6e1441e9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a03ccf1ab77380d4c4a3c56552e12de4a83efa21", "url": "https://git.kernel.org/stable/c/a03ccf1ab77380d4c4a3c56552e12de4a83efa21" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b", "url": "https://git.kernel.org/stable/c/e5aa7fbf7a4446bb89f0b8394b2dfc1a6b6aba5b" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-97612", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: clear inner_protocol when the last label is popped\n\nskb_mpls_push() records the pre-encapsulation network header once, gated\non !skb->inner_protocol. skb_mpls_pop() never clears that record, so it\noutlives the encapsulation it describes.\n\nOpen vSwitch can then re-push MPLS onto a packet whose\ninner_network_header still points at the older, deeper offset: push a\nlabel, pop every label, recirculate (ovs_flow_key_update() re-derives\nkey->eth.type and resets network_header, but leaves inner_*), then push\nagain. ovs_fragment() trusts the record:\n\n\tskb->network_header = skb->inner_network_header;\n\nso skb_network_offset() goes negative. The bound check is signed:\n\n\tif (skb_network_offset(skb) > MAX_L2_LEN)\n\na negative offset passes it, and prepare_frag() widens the value:\n\n\tunsigned int hlen = skb_network_offset(skb);\n\tmemcpy(&data->l2_data, skb->data, hlen);\n\nwhich is a ~4GiB memcpy out of a 30-byte per-CPU buffer.\n\nReproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):\n\n BUG: unable to handle page fault for address: ffffe8ffffc16000\n #PF: supervisor write access in kernel mode\n Oops: 0002 [#1] SMP KASAN NOPTI\n RIP: 0010:memcpy+0x8/0x20\n RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000\n prepare_frag+0x3df/0x4e0\n ovs_fragment+0x589/0x7e0\n do_output+0x4ce/0x5e0\n do_execute_actions+0x55d2/0x7b30\n ovs_execute_actions+0xea/0x450\n\nSame root-cause shape as commit 975b5b067f52 (\"ipv6: sr: restore network\nheader before routing and forwarding\"): a stale network header offset\nreaching a consumer that widens it. Here it originates in the MPLS\npush/pop path.\n\nClear inner_protocol once the packet is no longer MPLS, so a later push\nre-records the current header. net/sched/act_mpls.c is the only other\nskb_mpls_pop() caller and gets the same fix; sch_frag.c saves and\nrestores inner_protocol around fragmentation in the same way OVS does.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-97612" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0", "url": "https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0b3425fd0ecd515997956f7bb8a8a576b444ed64", "url": "https://git.kernel.org/stable/c/0b3425fd0ecd515997956f7bb8a8a576b444ed64" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34", "url": "https://git.kernel.org/stable/c/38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/55ed97db27bffe29c21fdefd5d25601322c36ff8", "url": "https://git.kernel.org/stable/c/55ed97db27bffe29c21fdefd5d25601322c36ff8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae", "url": "https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/833ec2788322306407503b4cfc7745cd1f9d785f", "url": "https://git.kernel.org/stable/c/833ec2788322306407503b4cfc7745cd1f9d785f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327", "url": "https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e", "url": "https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-64483", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: firewire: isight: bound the sample count to the packet payload\n\nisight_packet() takes the frame count from the device iso packet and\nchecks it only against the device claimed iso length.\n\n\tcount = be32_to_cpu(payload->sample_count);\n\tif (likely(count <= (length - 16) / 4))\n\t\tisight_samples(isight, payload->samples, count);\n\nlength is the iso header data_length. It can be up to 0xffff. So the\ngate allows a count up to about 16379. isight_samples() then copies\ncount frames out of payload->samples into the PCM DMA buffer.\n\npayload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The\ndevice multiplexes two samples per frame. A count past\nMAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer\nsize writes past runtime->dma_area. The smallest PCM buffer is larger\nthan MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET\nkeeps both the read and the write in range.\n\nA malicious or faulty Apple iSight on the FireWire bus reaches this\nduring a normal capture.\n\nAdd the MAX_FRAMES_PER_PACKET bound to the gate.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64483" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/24423e0a9251d348c3f1fb0bb0e61b879e1e976c", "url": "https://git.kernel.org/stable/c/24423e0a9251d348c3f1fb0bb0e61b879e1e976c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/29b9667982e4df2ed7744f86b1144f8bb58eb698", "url": "https://git.kernel.org/stable/c/29b9667982e4df2ed7744f86b1144f8bb58eb698" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/31a01b70bb90e3ef3147f308e2ea899e1d2485ca", "url": "https://git.kernel.org/stable/c/31a01b70bb90e3ef3147f308e2ea899e1d2485ca" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/31da82b9676c6b112e7c72c7529e6812b919742a", "url": "https://git.kernel.org/stable/c/31da82b9676c6b112e7c72c7529e6812b919742a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3ed2fa1ed8cc65f910b8bbc0be3cc366b30f8478", "url": "https://git.kernel.org/stable/c/3ed2fa1ed8cc65f910b8bbc0be3cc366b30f8478" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/57e4d9043afc1eaddee8f50d11def6e65415d273", "url": "https://git.kernel.org/stable/c/57e4d9043afc1eaddee8f50d11def6e65415d273" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8e48a29813df8dd71503800b7acf69c12c035045", "url": "https://git.kernel.org/stable/c/8e48a29813df8dd71503800b7acf69c12c035045" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ebbffacda6733dcbcef601b5b523460f8d8b671e", "url": "https://git.kernel.org/stable/c/ebbffacda6733dcbcef601b5b523460f8d8b671e" } ], "release_date": "2026-07-25T10:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98349", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: reject too-short beacon and probe responses\n\nlibipw_process_probe_response() and the libipw_network_init() call it\nmakes assume the frame contains the full 36-byte beacon and probe\nresponse prefix, but the ipw2100 and ipw2200 receive paths only\nestablish that a management frame carries the generic 24-byte\nthree-address header.\n\nlibipw_network_init() then computes the information element length as\n\n\tstats->len - sizeof(*beacon)\n\nstats->len is a u16 and sizeof() has type size_t, so the subtraction is\nevaluated as size_t and wraps instead of going negative. Truncating\nthat to the u16 length parameter of libipw_parse_info_param() yields\n65524 for a 24-byte beacon, and the parser then walks the receive\nbuffer as if it held almost 64 KiB of information elements, reading\npast the allocation.\n\nReject the frame before any fixed field is touched.\n\nFound by an AI-assisted review of length arithmetic in management frame\nparsers. Verified with a KUnit case under Generic KASAN on arm64 under\nQEMU; I do not have the hardware, so it is not tested on a real device.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98349" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/14ae269c1306053ddf1ccf37c4bd66e085a652d1", "url": "https://git.kernel.org/stable/c/14ae269c1306053ddf1ccf37c4bd66e085a652d1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/19959fb60228f6dccc40d55507f8b1a751c2dc89", "url": "https://git.kernel.org/stable/c/19959fb60228f6dccc40d55507f8b1a751c2dc89" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/23afeb5d2bdfd34c8a0a661876291a4fa9978293", "url": "https://git.kernel.org/stable/c/23afeb5d2bdfd34c8a0a661876291a4fa9978293" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c87bbc00dc93149d1dc4f803ad92d92e4ef3758", "url": "https://git.kernel.org/stable/c/2c87bbc00dc93149d1dc4f803ad92d92e4ef3758" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5ce5721e8cbe3e80db8f43851cc2a2a92485ef4b", "url": "https://git.kernel.org/stable/c/5ce5721e8cbe3e80db8f43851cc2a2a92485ef4b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/89959ff00a978f3172726d3d5f861ee6f1aae26d", "url": "https://git.kernel.org/stable/c/89959ff00a978f3172726d3d5f861ee6f1aae26d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cee6f141b3bebe62eb0363fd147acb52023935f0", "url": "https://git.kernel.org/stable/c/cee6f141b3bebe62eb0363fd147acb52023935f0" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff756e6647722b7d225d882f7bdb186d8eee318e", "url": "https://git.kernel.org/stable/c/ff756e6647722b7d225d882f7bdb186d8eee318e" } ], "release_date": "2026-10-06T09:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68158", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix multiplication overflow in decode_new_up_state_weight()\n\nIf a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted\nosdmap, out-of-bounds memory accesses may occur in\ndecode_new_up_state_weight(). This happens because the bounds check for\nthe new_state part is based on calculating its length depending on a len\nvalue read from the incoming message. This calculation may overflow\nleading to an incorrect bounds check. Subsequently, out-of-bounds reads\nmay occur when decoding this part.\n\nThis patch switches the multiplication to use check_mul_overflow() to\nabort processing the osdmap if an overflow occurred. Therefore,\nosdmaps/messages containing large values for len that result in a\nmultiplication overflow are treated as invalid.\n\n[ idryomov: rename new_state_len -> new_state_item_size, formatting ]", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68158" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/05c90e059269f087becfcce23348496085835c29", "url": "https://git.kernel.org/stable/c/05c90e059269f087becfcce23348496085835c29" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/143ba49ead77ec483c0326f8aaad8649874e99c4", "url": "https://git.kernel.org/stable/c/143ba49ead77ec483c0326f8aaad8649874e99c4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1732d89dfcd74f6fde9ce70900d316c4a151c153", "url": "https://git.kernel.org/stable/c/1732d89dfcd74f6fde9ce70900d316c4a151c153" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2ceee3b77b83052648c40fef965f836fd7699d26", "url": "https://git.kernel.org/stable/c/2ceee3b77b83052648c40fef965f836fd7699d26" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/98917a499ec7064c14fc56d180a4fd636fc2784c", "url": "https://git.kernel.org/stable/c/98917a499ec7064c14fc56d180a4fd636fc2784c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bee4b5b53e7bff0467fd916cc44c9b190733c6bd", "url": "https://git.kernel.org/stable/c/bee4b5b53e7bff0467fd916cc44c9b190733c6bd" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e4473751cc37db41f3f7da25d64a23e0c74570f1", "url": "https://git.kernel.org/stable/c/e4473751cc37db41f3f7da25d64a23e0c74570f1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f6961070c326bd158c38fa48756cde2bd78c4aaa", "url": "https://git.kernel.org/stable/c/f6961070c326bd158c38fa48756cde2bd78c4aaa" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98621", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gue: reject invalid REMCSUM offsets\n\nThe REMCSUM option carries an absolute checksum start and checksum field\noffset. gue_remcsum() passes them to skb_remcsum_process(), whose\npartial path stores offset - start in the u16 skb->csum_offset variable.\nIf offset is less than start, this underflows.\n\nA forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM\ndriver which trusts the metadata, leading skb_copy_and_csum_dev() to write\ntwo bytes about 64 KiB beyond the destination buffer.\n\nReject reversed tuples in validate_gue_flags(), after the existing length\nvalidation, so all GUE parsers enforce the ordering in one place.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98621" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1d664be4ca49d1696e85239236f4988dfc4653c3", "url": "https://git.kernel.org/stable/c/1d664be4ca49d1696e85239236f4988dfc4653c3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1eeec0c51fd5598da44080ed96bbd9880021c28b", "url": "https://git.kernel.org/stable/c/1eeec0c51fd5598da44080ed96bbd9880021c28b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2566866fc30965d915d0b52b5c3323b362619f0e", "url": "https://git.kernel.org/stable/c/2566866fc30965d915d0b52b5c3323b362619f0e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57f", "url": "https://git.kernel.org/stable/c/40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/43efb1f997e976f386aa89716f55870cd2cff9ad", "url": "https://git.kernel.org/stable/c/43efb1f997e976f386aa89716f55870cd2cff9ad" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4b9bc21b2396c396d88dd909caaf73d5be6ff593", "url": "https://git.kernel.org/stable/c/4b9bc21b2396c396d88dd909caaf73d5be6ff593" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/97f907203321eee2cc9132d5c9eb47698fb41d35", "url": "https://git.kernel.org/stable/c/97f907203321eee2cc9132d5c9eb47698fb41d35" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c20f755338ca234e523dfc943719f194dfc1f903", "url": "https://git.kernel.org/stable/c/c20f755338ca234e523dfc943719f194dfc1f903" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2021-47479", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8712: fix use-after-free in rtl8712_dl_fw\n\nSyzbot reported use-after-free in rtl8712_dl_fw(). The problem was in\nrace condition between r871xu_dev_remove() ->ndo_open() callback.\n\nIt's easy to see from crash log, that driver accesses released firmware\nin ->ndo_open() callback. It may happen, since driver was releasing\nfirmware _before_ unregistering netdev. Fix it by moving\nunregister_netdev() before cleaning up resources.\n\nCall Trace:\n...\n rtl871x_open_fw drivers/staging/rtl8712/hal_init.c:83 [inline]\n rtl8712_dl_fw+0xd95/0xe10 drivers/staging/rtl8712/hal_init.c:170\n rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline]\n rtl871x_hal_init+0xae/0x180 drivers/staging/rtl8712/hal_init.c:394\n netdev_open+0xe6/0x6c0 drivers/staging/rtl8712/os_intfs.c:380\n __dev_open+0x2bc/0x4d0 net/core/dev.c:1484\n\nFreed by task 1306:\n...\n release_firmware+0x1b/0x30 drivers/base/firmware_loader/main.c:1053\n r871xu_dev_remove+0xcc/0x2c0 drivers/staging/rtl8712/usb_intf.c:599\n usb_unbind_interface+0x1d8/0x8d0 drivers/usb/core/driver.c:458", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-47479" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a65c9afe9f2f55b7a7fb4a25ab654cd4139683a4", "url": "https://git.kernel.org/stable/c/a65c9afe9f2f55b7a7fb4a25ab654cd4139683a4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/befd23bd3b17f1a3f9c943a8580b47444c7c63ed", "url": "https://git.kernel.org/stable/c/befd23bd3b17f1a3f9c943a8580b47444c7c63ed" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c052cc1a069c3e575619cf64ec427eb41176ca70", "url": "https://git.kernel.org/stable/c/c052cc1a069c3e575619cf64ec427eb41176ca70" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c430094541a80575259a94ff879063ef01473506", "url": "https://git.kernel.org/stable/c/c430094541a80575259a94ff879063ef01473506" } ], "release_date": "2024-05-22T09:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-52956", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in __ceph_x_decrypt()\n\nIn __ceph_x_decrypt(), a part of the buffer p is interpreted as a\nceph_x_encrypt_header, and the magic field of this struct is accessed.\nThis happens without any guarantee that the buffer is large enough to\nhold this struct. The function parameter ciphertext_len represents the\nlength of the ciphertext to decrypt and is guaranteed to be at most the\nremaining size of the allocated buffer p. However, this value is not\nnecessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message\nframe of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold\nthe ciphertext at its end with a ciphertext_len of 8 or less, can\ntrigger an out-of-bounds memory access when accessing hdr->magic.\n\nThis patch fixes the issue by adding a check to ensure that the\ndecrypted plaintext in the buffer is large enough to represent at least\nthe ceph_x_encrypt_header.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-52956" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5df268406ef38d0f92547959296577c7077dacdc", "url": "https://git.kernel.org/stable/c/5df268406ef38d0f92547959296577c7077dacdc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/759053333a40c6997c2917dcd6160bfe40d2b42e", "url": "https://git.kernel.org/stable/c/759053333a40c6997c2917dcd6160bfe40d2b42e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/821365487aa58d06bda65c676ba215d506ba9768", "url": "https://git.kernel.org/stable/c/821365487aa58d06bda65c676ba215d506ba9768" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2", "url": "https://git.kernel.org/stable/c/c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ebc7eddf6225b87e3aae720875f9dd40cb6b1cef", "url": "https://git.kernel.org/stable/c/ebc7eddf6225b87e3aae720875f9dd40cb6b1cef" } ], "release_date": "2026-06-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53006", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix possible UAF in icmpv6_rcv()\n\nCaching saddr and daddr before pskb_pull() is problematic\nsince skb->head can change.\n\nRemove these temporary variables:\n\n- We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr\n when net_dbg_ratelimited() is called in the slow path.\n\n- Avoid potential future misuse after pskb_pull() call.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53006" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0069813e6ca9309eca78022bcb3aeb1e9ef90a12", "url": "https://git.kernel.org/stable/c/0069813e6ca9309eca78022bcb3aeb1e9ef90a12" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/085e31a811ef234ef8c3e219c4636dfebfe7e10f", "url": "https://git.kernel.org/stable/c/085e31a811ef234ef8c3e219c4636dfebfe7e10f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7", "url": "https://git.kernel.org/stable/c/1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/38bdbc897c0d83a3e2b925a51b69420f1feba29a", "url": "https://git.kernel.org/stable/c/38bdbc897c0d83a3e2b925a51b69420f1feba29a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7bff2c8fe5c35ae58bf73104f53db3676e6e5d94", "url": "https://git.kernel.org/stable/c/7bff2c8fe5c35ae58bf73104f53db3676e6e5d94" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c66b368c6ff453f99cb39d84af93e908e51eef2", "url": "https://git.kernel.org/stable/c/7c66b368c6ff453f99cb39d84af93e908e51eef2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aff0f28f5be803de2452ce702631c021fcd9ce8a", "url": "https://git.kernel.org/stable/c/aff0f28f5be803de2452ce702631c021fcd9ce8a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f996edd7615e686ada141b7f3395025729ff8ccb", "url": "https://git.kernel.org/stable/c/f996edd7615e686ada141b7f3395025729ff8ccb" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:45192", "url": "https://access.redhat.com/errata/RHSA-2026:45192" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47010", "url": "https://access.redhat.com/errata/RHSA-2026:47010" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47011", "url": "https://access.redhat.com/errata/RHSA-2026:47011" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47017", "url": "https://access.redhat.com/errata/RHSA-2026:47017" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:61932", "url": "https://access.redhat.com/errata/RHSA-2026:61932" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:62568", "url": "https://access.redhat.com/errata/RHSA-2026:62568" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:64767", "url": "https://access.redhat.com/errata/RHSA-2026:64767" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:65710", "url": "https://access.redhat.com/errata/RHSA-2026:65710" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:65711", "url": "https://access.redhat.com/errata/RHSA-2026:65711" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:65712", "url": "https://access.redhat.com/errata/RHSA-2026:65712" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:67721", "url": "https://access.redhat.com/errata/RHSA-2026:67721" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:67723", "url": "https://access.redhat.com/errata/RHSA-2026:67723" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-53006", "url": "https://access.redhat.com/security/cve/CVE-2026-53006" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2492363", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492363" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53006.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53006.json" } ], "release_date": "2026-06-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74556", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer\n\niscsi_tcp_hdr_dissect() receives the data segment of several PDU types\ninto the fixed-size conn->data buffer, which is allocated for\nISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP,\nREJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU\nwhose DataSegmentLength exceeds that buffer.\n\nThe SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its\ndata segment (sense/response data) into conn->data via\niscsi_tcp_data_recv_prep(), but it does so without the same check. The\nonly upstream bound on in.datalen is conn->max_recv_dlength, the\ninitiator's advertised MaxRecvDataSegmentLength, which is commonly\nnegotiated well above 8192 (open-iscsi defaults to 262144). A target\nthat returns a SCSI Response with a DataSegmentLength between 8193 and\nmax_recv_dlength therefore overflows the 8192-byte conn->data buffer.\n\nOnce the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly\nlike those responses: bound the data segment, receive it into conn->data\nwhen present, and otherwise complete the PDU with no data. Fold the\nopcode into that case group rather than duplicating the check.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74556" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/084af0253673425ce2ae62e3c7f74f0dd023711b", "url": "https://git.kernel.org/stable/c/084af0253673425ce2ae62e3c7f74f0dd023711b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/72815741715bd41556dac5eeb068bf0f8af06ee7", "url": "https://git.kernel.org/stable/c/72815741715bd41556dac5eeb068bf0f8af06ee7" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a51812842084fd390590ab8dc0431f10c73ddc56", "url": "https://git.kernel.org/stable/c/a51812842084fd390590ab8dc0431f10c73ddc56" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a8f94cc9f0e5759252551be3a172960c57f21f54", "url": "https://git.kernel.org/stable/c/a8f94cc9f0e5759252551be3a172960c57f21f54" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676", "url": "https://git.kernel.org/stable/c/b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c1dea15f819cded9b3faf58f8bec72323568b6e6", "url": "https://git.kernel.org/stable/c/c1dea15f819cded9b3faf58f8bec72323568b6e6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c97b5265cc47775f77fd2a23d6bde0426997b233", "url": "https://git.kernel.org/stable/c/c97b5265cc47775f77fd2a23d6bde0426997b233" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f1a3a51fc5dba0e99532379665069f1700da6b44", "url": "https://git.kernel.org/stable/c/f1a3a51fc5dba0e99532379665069f1700da6b44" } ], "release_date": "2026-08-15T13:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-53004", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks\n\nsctp_getsockopt_peer_auth_chunks() checks that the caller's optval\nbuffer is large enough for the peer AUTH chunk list with\n\n if (len < num_chunks)\n return -EINVAL;\n\nbut then writes num_chunks bytes to p->gauth_chunks, which lives\nat offset offsetof(struct sctp_authchunks, gauth_chunks) == 8\ninside optval. The check is missing the sizeof(struct\nsctp_authchunks) = 8-byte header. When the caller supplies\nlen == num_chunks (for any num_chunks > 0) the test passes but\ncopy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes\npast the declared buffer.\n\nThe sibling function sctp_getsockopt_local_auth_chunks() at the\nnext line already has the correct check:\n\n if (len < sizeof(struct sctp_authchunks) + num_chunks)\n return -EINVAL;\n\nAlign the peer variant with its sibling.\n\nReproducer confirms on v7.0-13-generic: an unprivileged userspace\ncaller that opens a loopback SCTP association with AUTH enabled,\nqueries num_chunks with a short optval, then issues the real\ngetsockopt with len == num_chunks and sentinel bytes painted past\nthe buffer observes those sentinel bytes overwritten with the\npeer's AUTH chunk type. The bytes written are under the peer's\ncontrol but land in the caller's own userspace; this is not a\nkernel memory corruption, but it is a kernel-side contract\nviolation that can silently corrupt adjacent userspace data.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53004" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0cf004ffb61cd32d140531c3a84afe975f9fc7ea", "url": "https://git.kernel.org/stable/c/0cf004ffb61cd32d140531c3a84afe975f9fc7ea" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b5a2c957c7769d40110f725cf23987fcef50d75", "url": "https://git.kernel.org/stable/c/2b5a2c957c7769d40110f725cf23987fcef50d75" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6849b995cda88a677bf08a05765d1db7905974fc", "url": "https://git.kernel.org/stable/c/6849b995cda88a677bf08a05765d1db7905974fc" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6bcf8fe4ef7967b22b814cbae9a57bbd3c853410", "url": "https://git.kernel.org/stable/c/6bcf8fe4ef7967b22b814cbae9a57bbd3c853410" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/70a089cc9590aa347a61e84434116ab74619e3c3", "url": "https://git.kernel.org/stable/c/70a089cc9590aa347a61e84434116ab74619e3c3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a132e199de69e2a45628aa8534df1bf5d44e1b6e", "url": "https://git.kernel.org/stable/c/a132e199de69e2a45628aa8534df1bf5d44e1b6e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d45c7e99caf915b0f6c716bd8ffe9d45b9685761", "url": "https://git.kernel.org/stable/c/d45c7e99caf915b0f6c716bd8ffe9d45b9685761" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d67fbc6dea5dbf7f46c618ebf65910a276078e20", "url": "https://git.kernel.org/stable/c/d67fbc6dea5dbf7f46c618ebf65910a276078e20" } ], "release_date": "2026-06-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-98027", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size\n\nmv88e6xxx_get_rxnfc() uses rxnfc->rule_cnt as the write index while\ndumping the policy IDR, clobbering the input value before it has been\nlooked at. That input is the number of entries the caller had room for.\nETHTOOL_GRXCLSRLALL requires no CAP_NET_ADMIN and the ioctl sizes the\nbuffer from the rule_cnt userspace passes in, so once an admin has\ninstalled policy rules any user can ask for fewer slots than there are\nrules and run off the end of the allocation. A rule_cnt of 0 leaves the\nbuffer pointer NULL and the walk dereferences it.\n\nCount into a local so the caller's limit survives the walk, and stop with\n-EMSGSIZE once it is reached.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98027" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/01124cd2cf4b71755b1130ac82d78dcfbd5d69e3", "url": "https://git.kernel.org/stable/c/01124cd2cf4b71755b1130ac82d78dcfbd5d69e3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/44cd4674d9aa5bdf793b8a8b481c9e8536ed6070", "url": "https://git.kernel.org/stable/c/44cd4674d9aa5bdf793b8a8b481c9e8536ed6070" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/609c4378f212cf580aae02250f1146caf63d873f", "url": "https://git.kernel.org/stable/c/609c4378f212cf580aae02250f1146caf63d873f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a683c2b062810bca203e41866389daf387c235b", "url": "https://git.kernel.org/stable/c/7a683c2b062810bca203e41866389daf387c235b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7e4bfc5f0b66feb22cba821303fc25ca22cd0887", "url": "https://git.kernel.org/stable/c/7e4bfc5f0b66feb22cba821303fc25ca22cd0887" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b1fffc273112e7284c5b705e186b43b5770cd3d5", "url": "https://git.kernel.org/stable/c/b1fffc273112e7284c5b705e186b43b5770cd3d5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c5b5c52b6524c9fb50def2260baac745c095ec3a", "url": "https://git.kernel.org/stable/c/c5b5c52b6524c9fb50def2260baac745c095ec3a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cda5ac8fe8ac8e80b1703ebb8c4250726fc19739", "url": "https://git.kernel.org/stable/c/cda5ac8fe8ac8e80b1703ebb8c4250726fc19739" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-52955", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in crush_decode()\n\nA message of type CEPH_MSG_OSD_MAP containing a crush map with at least\none bucket has two fields holding the bucket algorithm. If the values\nin these two fields differ, an out-of-bounds access can occur. This is\nthe case because the first algorithm field (alg) is used to allocate\nthe correct amount of memory for a bucket of this type, while the second\nalgorithm field inside the bucket (b->alg) is used in the subsequent\nprocessing.\n\nThis patch fixes the issue by adding a check that compares alg and\nb->alg and aborts the processing in case they differ. Furthermore,\nb->alg is set to 0 in this case, because the destruction of the crush\nmap also uses this field to determine the bucket type, which can again\nresult in an out-of-bounds access when trying to free the memory pointed\nto by the fields of the bucket. To correctly free the memory allocated\nfor the bucket in such a case, the corresponding call to kfree is moved\nfrom the algorithm-specific crush_destroy_bucket functions to the\ngeneric crush_destroy_bucket().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-52955" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0f3604cbe4df14c5e58288ac9f57511e726a222d", "url": "https://git.kernel.org/stable/c/0f3604cbe4df14c5e58288ac9f57511e726a222d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3f42508191e129ee6b5ea96578d5cab14f2a013a", "url": "https://git.kernel.org/stable/c/3f42508191e129ee6b5ea96578d5cab14f2a013a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4c79fc2d598694bda845b46229c9d48b65042970", "url": "https://git.kernel.org/stable/c/4c79fc2d598694bda845b46229c9d48b65042970" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6e70ef53e818c53eab28d7b0026b7fd03dddaba5", "url": "https://git.kernel.org/stable/c/6e70ef53e818c53eab28d7b0026b7fd03dddaba5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5", "url": "https://git.kernel.org/stable/c/cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ea0d42137f0c06da71e37ffc647aab4c5309599a", "url": "https://git.kernel.org/stable/c/ea0d42137f0c06da71e37ffc647aab4c5309599a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ebe76d58a48a48031b98543d86c4cd30a825b622", "url": "https://git.kernel.org/stable/c/ebe76d58a48a48031b98543d86c4cd30a825b622" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fb176a99e4c1a5a8448a83d83d3606203ba81faa", "url": "https://git.kernel.org/stable/c/fb176a99e4c1a5a8448a83d83d3606203ba81faa" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-52955", "url": "https://access.redhat.com/security/cve/CVE-2026-52955" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2492328", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492328" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52955.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52955.json" } ], "release_date": "2026-06-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-68373", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: at76c50x-usb: avoid length underflow in at76_guess_freq()\n\nat76_guess_freq() checks only that the received frame is at least a bare\n802.11 header (24 bytes) before subtracting the fixed management-body\noffset:\n\n\tlen -= el_off;\n\nFor both beacon and probe response frames, el_off is 36. If the frame is\nshorter than el_off, subtracting it causes the calculated IE length to\nwrap. The length is eventually passed to cfg80211_find_elem_match() as a\nvery large unsigned value, so the element walk runs beyond the RX skb.\n\nThis path is reached from at76_rx_tasklet() while scanning. If the device\ndelivers a truncated beacon or probe response, the oversized IE length\ncauses an out-of-bounds read during scanning.\n\nSkip the IE lookup if the frame does not reach the variable elements,\nbefore subtracting el_off.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-68373" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4875680d1703f56afa6257ba30244f2fb44ed205", "url": "https://git.kernel.org/stable/c/4875680d1703f56afa6257ba30244f2fb44ed205" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/61a799ffd1e5a4fd3702d547828b7ff3d161468e", "url": "https://git.kernel.org/stable/c/61a799ffd1e5a4fd3702d547828b7ff3d161468e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b406f33d234f98c8b310fdab5cbb492d85e98e49", "url": "https://git.kernel.org/stable/c/b406f33d234f98c8b310fdab5cbb492d85e98e49" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bcde7249d45f52f994a9872bedf45994472ade77", "url": "https://git.kernel.org/stable/c/bcde7249d45f52f994a9872bedf45994472ade77" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cb831aff2f850f72bc5ff5ad77d0a70bb5a84061", "url": "https://git.kernel.org/stable/c/cb831aff2f850f72bc5ff5ad77d0a70bb5a84061" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e165a1d295e7e814e13b0f92c86e5d48309509ce", "url": "https://git.kernel.org/stable/c/e165a1d295e7e814e13b0f92c86e5d48309509ce" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f742d9c98b5c504fc9e6744eef13a721c2aea486", "url": "https://git.kernel.org/stable/c/f742d9c98b5c504fc9e6744eef13a721c2aea486" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fb1b50ab699211e777dca5ccfb648788b6a6e519", "url": "https://git.kernel.org/stable/c/fb1b50ab699211e777dca5ccfb648788b6a6e519" } ], "release_date": "2026-08-10T13:20:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-52923", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc: limit next_id allocation to the valid ID range\n\nThe checkpoint/restore sysctl path can request the next SysV IPC id\nthrough ids->next_id. ipc_idr_alloc() currently forwards that request to\nidr_alloc() with an open-ended upper bound.\n\nIf the valid tail of the SysV IPC id space is full, the allocation can\nspill beyond ipc_mni. The returned SysV IPC id still uses the normal\nindex encoding, so later lookup and removal can target the wrong slot. \nThis leaves the real IDR entry behind and breaks the IDR state for the\nobject.\n\nThe bug is in ipc_idr_alloc() in the checkpoint/restore path.\n\n1. ids->next_id is passed to:\n\n idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...)\n\n2. The zero upper bound makes the allocation effectively open-ended.\n Once the valid SysV IPC tail is occupied, idr_alloc() can spill past\n ipc_mni and allocate an entry beyond the valid IPC id range.\n\n3. The new object id is still encoded with the narrower SysV IPC index\n width:\n\n new->id = (new->seq << ipcmni_seq_shift()) + idx\n\n4. Later removal goes through ipc_rmid(), which uses:\n\n ipcid_to_idx(ipcp->id)\n\n That truncates the real IDR index. An object actually stored at a\n high index can then be removed as if it lived at a low in-range\n index.\n\n5. For shared memory, shm_destroy() frees the current object anyway, but\n the real high IDR slot is left behind as a dangling pointer.\n\n6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry\n and dereferences freed memory.\n\nPrevent this by bounding the requested allocation to ipc_mni so the\ncheckpoint/restore path fails once the valid range is exhausted.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-52923" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/157ce2c6836ce0ff19108a819f38df061345425f", "url": "https://git.kernel.org/stable/c/157ce2c6836ce0ff19108a819f38df061345425f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3bbe2bb9111ce6967a951bfac79af142d816fae5", "url": "https://git.kernel.org/stable/c/3bbe2bb9111ce6967a951bfac79af142d816fae5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/41058d4c3f63ab64901560a704882e0565f4e456", "url": "https://git.kernel.org/stable/c/41058d4c3f63ab64901560a704882e0565f4e456" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8c58a92849175f5e2ab7bc2734b3b89afe79f6ef", "url": "https://git.kernel.org/stable/c/8c58a92849175f5e2ab7bc2734b3b89afe79f6ef" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a3cc795129e5ec0f8948653a3bf471e7d8852f5e", "url": "https://git.kernel.org/stable/c/a3cc795129e5ec0f8948653a3bf471e7d8852f5e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/af24e202b543ded8a34f1d5d3db54eb916173f04", "url": "https://git.kernel.org/stable/c/af24e202b543ded8a34f1d5d3db54eb916173f04" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bd4be70669af55b974860d13680348cfdf50bbed", "url": "https://git.kernel.org/stable/c/bd4be70669af55b974860d13680348cfdf50bbed" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139", "url": "https://git.kernel.org/stable/c/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:47248", "url": "https://access.redhat.com/errata/RHSA-2026:47248" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:48386", "url": "https://access.redhat.com/errata/RHSA-2026:48386" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49031", "url": "https://access.redhat.com/errata/RHSA-2026:49031" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49212", "url": "https://access.redhat.com/errata/RHSA-2026:49212" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49851", "url": "https://access.redhat.com/errata/RHSA-2026:49851" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:49857", "url": "https://access.redhat.com/errata/RHSA-2026:49857" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:51603", "url": "https://access.redhat.com/errata/RHSA-2026:51603" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:51604", "url": "https://access.redhat.com/errata/RHSA-2026:51604" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:52649", "url": "https://access.redhat.com/errata/RHSA-2026:52649" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:52764", "url": "https://access.redhat.com/errata/RHSA-2026:52764" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:53330", "url": "https://access.redhat.com/errata/RHSA-2026:53330" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:61692", "url": "https://access.redhat.com/errata/RHSA-2026:61692" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:63189", "url": "https://access.redhat.com/errata/RHSA-2026:63189" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-52923", "url": "https://access.redhat.com/security/cve/CVE-2026-52923" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2492094", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492094" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52923.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52923.json" } ], "release_date": "2026-06-24T08:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-64563", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nrhashtable: clear stale iter->p on table restart\n\nrhashtable_walk_start_check() has two restart paths when resuming a walk.\nWhen iter->walker.tbl is valid, it re-validates iter->p against the table\nand sets iter->p = NULL if the object is gone. When iter->walker.tbl is\nNULL (table was freed during resize), it resets slot and skip but forgets\nto clear iter->p.\n\nrhashtable_walk_next() then dereferences the stale iter->p, reading\nfreed memory. This is a use-after-free.\n\nAny caller that does multi-fragment rhashtable walks across\nwalk_stop/walk_start boundaries is affected. Concrete cases include\nnetlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC\n(tipc_nl_sk_walk in net/tipc/socket.c).\n\nCrash stack (netlink_diag):\n BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0\n Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)\n Call Trace:\n rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)\n __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)\n netlink_diag_dump+0xc2/0x240\n netlink_dump+0x5bc/0x1270\n netlink_recvmsg+0x7a3/0x980\n sock_recvmsg+0x1bc/0x200\n __sys_recvfrom+0x1d4/0x2c0", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-64563" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/042fda5c088015f18838e5c692659a7be60aeb26", "url": "https://git.kernel.org/stable/c/042fda5c088015f18838e5c692659a7be60aeb26" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0955b65c2b47c30b439e2cf1b1e375073aa0413a", "url": "https://git.kernel.org/stable/c/0955b65c2b47c30b439e2cf1b1e375073aa0413a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3ff7c1dbf722cf3fa538672452ba182318e0fcc3", "url": "https://git.kernel.org/stable/c/3ff7c1dbf722cf3fa538672452ba182318e0fcc3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3", "url": "https://git.kernel.org/stable/c/4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456", "url": "https://git.kernel.org/stable/c/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a0406c40c6638c5ae50257db6297b2fba6c9ba16", "url": "https://git.kernel.org/stable/c/a0406c40c6638c5ae50257db6297b2fba6c9ba16" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ba510b5e9fe396497d31162acb579f210adfe6c8", "url": "https://git.kernel.org/stable/c/ba510b5e9fe396497d31162acb579f210adfe6c8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c39643ad99fea749be50615550e8f0e6d6e60694", "url": "https://git.kernel.org/stable/c/c39643ad99fea749be50615550e8f0e6d6e60694" } ], "release_date": "2026-08-04T07:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74548", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nforcedeth: fix UAF of txrx_stats in nv_remove\n\nnv_remove() frees the per-CPU txrx_stats before unregister_netdev().\nUntil unregister completes, ndo_get_stats64, the NAPI/xmit data path,\nand nv_close()/drain may still access txrx_stats, leading to a\nuse-after-free.\n\nFree the stats only after unregister_netdev().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74548" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1", "url": "https://git.kernel.org/stable/c/201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/22666ba1420164753d7b0f5a841986b25ace5435", "url": "https://git.kernel.org/stable/c/22666ba1420164753d7b0f5a841986b25ace5435" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7c22b4ee0bd003cecfc14ca28981cb213e201f70", "url": "https://git.kernel.org/stable/c/7c22b4ee0bd003cecfc14ca28981cb213e201f70" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ae20a8a4de06a289d40b0a0633d8d573f1fcb049", "url": "https://git.kernel.org/stable/c/ae20a8a4de06a289d40b0a0633d8d573f1fcb049" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c9d24a205fd508b9999fcab6aca4c590490a12cf", "url": "https://git.kernel.org/stable/c/c9d24a205fd508b9999fcab6aca4c590490a12cf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9", "url": "https://git.kernel.org/stable/c/cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/cf2dcde2284562ff87830ca0b7fa2b06e95aef1e", "url": "https://git.kernel.org/stable/c/cf2dcde2284562ff87830ca0b7fa2b06e95aef1e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc", "url": "https://git.kernel.org/stable/c/d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc" } ], "release_date": "2026-08-15T13:18:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74588", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: keep chunk->transport in step with the list it is queued on\n\n__sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's\ntransmitted list without updating chunk->transport:\n\n\tif (chunk->tsn_gap_acked) {\n\t\tlist_move_tail(&chunk->transmitted_list,\n\t\t\t &transport->transmitted);\n\t\tcontinue;\n\t}\n\nThe chunk then sits on a live transport's list while chunk->transport still\nnames a different one. If that transport is removed - sctp_assoc_rm_peer()\nfrom an ASCONF Delete-IP - sctp_transport_free() RCU-frees it and the chunk\nis left with a dangling pointer. sctp_assoc_rm_peer() scrubs\npeer->transmitted and asoc->outqueue.out_chunk_list, but the chunk is on\nneither.\n\nThe pointer is not followed while tsn_gap_acked is set. A SACK that\nreneges on the TSN clears the flag, and the next SACK reaches\n\n\ttchunk->transport->flight_size -= sctp_data_size(tchunk);\n\ninside the freed transport. KASAN reports a slab-use-after-free read in\nsctp_check_transmitted(), freed from sctp_assoc_rm_peer(). Both the\nremoval and the SACKs come from the association peer.\n\nSet chunk->transport at the move. The ordinary resend path needs nothing:\nit reaches its list_move_tail() only after sctp_packet_append_chunk()\nreturned SCTP_XMIT_OK, and __sctp_packet_append_chunk() has rebound the\nchunk by then.\n\nDiscovered by XBOW, triaged by Baul Lee ", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74588" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1adf929121e13e0b19200bb9fef715b918d483fe", "url": "https://git.kernel.org/stable/c/1adf929121e13e0b19200bb9fef715b918d483fe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d", "url": "https://git.kernel.org/stable/c/2b3b5eec8b2c30ee237e3c31a6a38de9c39d804d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b", "url": "https://git.kernel.org/stable/c/5ccf35ef0ed6059cdf8b1f4606a6584d5b67166b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6575fb17230814b48b471727c8410c0aadff9274", "url": "https://git.kernel.org/stable/c/6575fb17230814b48b471727c8410c0aadff9274" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6b9e2ea2057113f3393990ba646d2d97c719a80d", "url": "https://git.kernel.org/stable/c/6b9e2ea2057113f3393990ba646d2d97c719a80d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/874a7c2b5e184f06134fdfde27e9ce9271bafe58", "url": "https://git.kernel.org/stable/c/874a7c2b5e184f06134fdfde27e9ce9271bafe58" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9f2cf069a9a72a2d6b97ca8b4c70e714aac99749", "url": "https://git.kernel.org/stable/c/9f2cf069a9a72a2d6b97ca8b4c70e714aac99749" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e2e7c1de0e226ca1b7fea2de57a6c9bca408709b", "url": "https://git.kernel.org/stable/c/e2e7c1de0e226ca1b7fea2de57a6c9bca408709b" } ], "release_date": "2026-08-22T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2021-47049", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Use after free in __vmbus_open()\n\nThe \"open_info\" variable is added to the &vmbus_connection.chn_msg_list,\nbut the error handling frees \"open_info\" without removing it from the\nlist. This will result in a use after free. First remove it from the\nlist, and then free it.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2021-47049" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2728f289b3270b0e273292b46c534421a33bbfd5", "url": "https://git.kernel.org/stable/c/2728f289b3270b0e273292b46c534421a33bbfd5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3e9bf43f7f7a46f21ec071cb47be92d0874c48da", "url": "https://git.kernel.org/stable/c/3e9bf43f7f7a46f21ec071cb47be92d0874c48da" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/d5c7b42c9f56ca46b286daa537d181bd7f69214f", "url": "https://git.kernel.org/stable/c/d5c7b42c9f56ca46b286daa537d181bd7f69214f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/f37dd5d1b5d38a79a4f7b8dd7bbb705505f05560", "url": "https://git.kernel.org/stable/c/f37dd5d1b5d38a79a4f7b8dd7bbb705505f05560" } ], "release_date": "2024-02-28T08:13:52Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-89559", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibnvdimm/labels: Prevent integer overflow in __nd_label_validate()\n\nThe on-media namespace index field nslot is a u32 read from the DIMM\nlabel storage area. __nd_label_validate() bounds it against the config\narea size, but sizeof_namespace_label() returns unsigned, so the product\nnslot * label_size is evaluated in 32-bit and wraps modulo 2^32 before\nthe comparison. A crafted nslot passes the bound and is then used as the\nloop trip count in nd_label_data_init(), whose memset() walks off the end\nof the config_size buffer: an out-of-bounds write.\n\nThe field is not trusted -- it comes from the medium, or from userspace\nvia ND_CMD_SET_CONFIG_DATA. Evaluate the product in 64-bit so the bound\ncheck is exact; conforming labels are unaffected.\n\nThe check was safe when introduced by commit 4a826c83db4e (\"libnvdimm:\nnamespace indices: read and validate\"): it multiplied by sizeof(struct\nnd_namespace_label), a size_t, so on a 64-bit build the product did not\nwrap. Commit 564e871aa66f (\"libnvdimm, label: add v1.2 nvdimm label\ndefinitions\") narrowed it to 32 bits when the label size became a runtime\nvalue read via sizeof_namespace_label().", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-89559" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/037770686126155eafc44501312989e2837b9659", "url": "https://git.kernel.org/stable/c/037770686126155eafc44501312989e2837b9659" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/09e649117c54b7e1c004f22eaa19efbadd9ac856", "url": "https://git.kernel.org/stable/c/09e649117c54b7e1c004f22eaa19efbadd9ac856" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/1c391696d2791f82ae462e11da9a0d96f90b240c", "url": "https://git.kernel.org/stable/c/1c391696d2791f82ae462e11da9a0d96f90b240c" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6030597ec683d1e5b46445f888bb5c7776b5a0c4", "url": "https://git.kernel.org/stable/c/6030597ec683d1e5b46445f888bb5c7776b5a0c4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/69a734359639fca16a0dd73ab17a34943e76c68b", "url": "https://git.kernel.org/stable/c/69a734359639fca16a0dd73ab17a34943e76c68b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/93967bfb17dab66642c57e609c99e1a91fe11278", "url": "https://git.kernel.org/stable/c/93967bfb17dab66642c57e609c99e1a91fe11278" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b4975f2ff6c82adc24ae547f029f82530ba43cfe", "url": "https://git.kernel.org/stable/c/b4975f2ff6c82adc24ae547f029f82530ba43cfe" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e057efcc9c71d90099d9ee00bed0748d0e9fd586", "url": "https://git.kernel.org/stable/c/e057efcc9c71d90099d9ee00bed0748d0e9fd586" } ], "release_date": "2026-09-11T20:19:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98077", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()\n\nsip_skip_whitespace() returns dptr unchanged when its own loop\nexhausts the buffer (dptr == limit), instead of NULL like its sibling\nsip_follow_continuation() returns on its own \"no more data\" path.\n\nct_sip_get_header() only checks for NULL after calling it:\n\n dptr = sip_skip_whitespace(dptr, limit);\n if (dptr == NULL)\n break;\n if (*dptr != ':' || ++dptr >= limit)\n break;\n\nso a recognized header name followed only by spaces/tabs running to\nthe exact end of the SIP payload, with no colon, makes the very next\nstatement read one byte past the buffer.\n\nMake both \"no more data\" outcomes return NULL, matching the\nconvention sip_follow_continuation() already uses and that both\nexisting callers already check for.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98077" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0cfb96a118c5c6d46d7a1cfdfa18355ad734ca79", "url": "https://git.kernel.org/stable/c/0cfb96a118c5c6d46d7a1cfdfa18355ad734ca79" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4a30aa2ba007db18210dd52219ecbd5528c03523", "url": "https://git.kernel.org/stable/c/4a30aa2ba007db18210dd52219ecbd5528c03523" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/4be8380e3af008f418f97992c06f23be649a430d", "url": "https://git.kernel.org/stable/c/4be8380e3af008f418f97992c06f23be649a430d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94", "url": "https://git.kernel.org/stable/c/60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9ae0a87e6f513293677fe286729fbae34d592215", "url": "https://git.kernel.org/stable/c/9ae0a87e6f513293677fe286729fbae34d592215" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b6277622b7323000895b674321c9a1f060553188", "url": "https://git.kernel.org/stable/c/b6277622b7323000895b674321c9a1f060553188" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c6beb08b1a9fdb96795816d8329ed75dd785d48e", "url": "https://git.kernel.org/stable/c/c6beb08b1a9fdb96795816d8329ed75dd785d48e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e8f8231824b5815f57ce62cba116e511b10196de", "url": "https://git.kernel.org/stable/c/e8f8231824b5815f57ce62cba116e511b10196de" } ], "release_date": "2026-09-25T11:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-63831", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: llsec: add skb_cow_data() before in-place crypto\n\nllsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),\nllsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform\nin-place cryptographic transformations on skb data. They build a\nscatterlist with sg_init_one() pointing into the skb's linear data area\nand then pass the same scatterlist as both src and dst to the crypto API\n(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).\n\nOn the RX path, __ieee802154_rx_handle_packet() clones the received skb\nbefore handing it to each subscriber via ieee802154_subif_frame(). The\ncloned skb shares the same underlying data buffer via reference\ncounting. When llsec_do_decrypt() subsequently modifies this shared\nbuffer in place, it corrupts data that other clones -- potentially\nbelonging to other sockets or subsystems -- still reference.\n\nOn the TX path, similar data sharing can occur when an skb's head has\nbeen cloned (skb_cloned() returns true).\n\nThe fix is to call skb_cow_data() before performing any in-place crypto\noperation. skb_cow_data() ensures that the skb's data area is not\nshared: if the skb head is cloned or the data spans multiple fragments,\nit copies the data into a private buffer that can be safely modified in\nplace. This is the same pattern used by:\n\n - ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)\n - MACsec (drivers/net/macsec.c)\n - WireGuard (drivers/net/wireguard/receive.c)\n - TIPC (net/tipc/crypto.c)\n\nWithout this guard, in-place crypto on shared skb data leads to:\n - Silent data corruption of other skb clones\n - Use-after-free when the crypto API scatterwalk writes through a\n page that has already been freed by another clone's kfree_skb()\n - Kernel crashes under concurrent 802.15.4 traffic with security\n enabled (KASAN/KMSAN reports slab-use-after-free)\n\nFound by 0sec (https://0sec.ai) using automated source analysis.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-63831" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3a2b378b3a9ca75d3518d879148d2ad25b5714a9", "url": "https://git.kernel.org/stable/c/3a2b378b3a9ca75d3518d879148d2ad25b5714a9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a831bcd0486788283ef35e396d4282ee01bb0d5", "url": "https://git.kernel.org/stable/c/7a831bcd0486788283ef35e396d4282ee01bb0d5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/84a04eb5b210643bd67aab81ff805d32f62aa865", "url": "https://git.kernel.org/stable/c/84a04eb5b210643bd67aab81ff805d32f62aa865" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/86d531337ea1ba02d9f2bc830d07c683d9bfaade", "url": "https://git.kernel.org/stable/c/86d531337ea1ba02d9f2bc830d07c683d9bfaade" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/993fd674fe85d114e6a8d3963033d4fbbc2170a8", "url": "https://git.kernel.org/stable/c/993fd674fe85d114e6a8d3963033d4fbbc2170a8" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bd968bdd568beacfdf98ec537a87527e85f1d0cf", "url": "https://git.kernel.org/stable/c/bd968bdd568beacfdf98ec537a87527e85f1d0cf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e28e7fd34c449028325322a3f5127b92594b7396", "url": "https://git.kernel.org/stable/c/e28e7fd34c449028325322a3f5127b92594b7396" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ff976ef7c39199ebff33c18034636595016db9f0", "url": "https://git.kernel.org/stable/c/ff976ef7c39199ebff33c18034636595016db9f0" } ], "release_date": "2026-07-19T12:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-93803", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: fix key index receive bound checks\n\nlibipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in\nboth the software-decrypt key selection path and the hardware-decrypted\nIV/ICV strip path. In both places the existing guard only checks\nskb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the\nbyte at hdrlen + 3.\n\nRequire hdrlen + 4 bytes before reading that item in both paths. This is\na local source-boundary check only; it does not change the key index\nsemantics.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-93803" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/062840bdc9ee06169b3c371bf66711f1d7ec0bf4", "url": "https://git.kernel.org/stable/c/062840bdc9ee06169b3c371bf66711f1d7ec0bf4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82", "url": "https://git.kernel.org/stable/c/09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0b61c465ea62063593bc9ac186871b69e58ae991", "url": "https://git.kernel.org/stable/c/0b61c465ea62063593bc9ac186871b69e58ae991" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2836a870f612a8a6d9e390d00fa2cf6c90aa5808", "url": "https://git.kernel.org/stable/c/2836a870f612a8a6d9e390d00fa2cf6c90aa5808" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/74ed3669f26803b1761c1f55403062bea44c3466", "url": "https://git.kernel.org/stable/c/74ed3669f26803b1761c1f55403062bea44c3466" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bb18262c19feb690ddde58c70e3ad04bc6fe566e", "url": "https://git.kernel.org/stable/c/bb18262c19feb690ddde58c70e3ad04bc6fe566e" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c54b643e9a0936d038921c547736574fd7382cea", "url": "https://git.kernel.org/stable/c/c54b643e9a0936d038921c547736574fd7382cea" } ], "release_date": "2026-09-24T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-72234", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: access unicast_ttvn skb->data only after skb realloc\n\nThe pskb_may_pull() called by batadv_get_vid() could reallocate the buffer\nbehind the skb. Variables which were pointing to the old buffer need to be\nreassigned to avoid an use-after-free.\n\nThis was done correctly for the ethernet header but missed for the\nunicast_packet pointer.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-72234" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7141990add3f75436f2933cb310654cad3b1e3e9", "url": "https://git.kernel.org/stable/c/7141990add3f75436f2933cb310654cad3b1e3e9" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7b162b36de750565404cd3b98315706622c6974f", "url": "https://git.kernel.org/stable/c/7b162b36de750565404cd3b98315706622c6974f" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/979175834a699ccc3c4c0b0ba60ecae0f135a587", "url": "https://git.kernel.org/stable/c/979175834a699ccc3c4c0b0ba60ecae0f135a587" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9a7b7248798123efbd5fafe58461d57c7cc718af", "url": "https://git.kernel.org/stable/c/9a7b7248798123efbd5fafe58461d57c7cc718af" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9c2c05629e46c1fd43931506d41c56a885a98eb4", "url": "https://git.kernel.org/stable/c/9c2c05629e46c1fd43931506d41c56a885a98eb4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/aa9558af859934f24717d4bab97d61004f91a736", "url": "https://git.kernel.org/stable/c/aa9558af859934f24717d4bab97d61004f91a736" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b8afcf799b2cc92c41beebd029e53ed18960184a", "url": "https://git.kernel.org/stable/c/b8afcf799b2cc92c41beebd029e53ed18960184a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/ed90eb5c68420cdfe67ec1f773324198d2ef6f50", "url": "https://git.kernel.org/stable/c/ed90eb5c68420cdfe67ec1f773324198d2ef6f50" } ], "release_date": "2026-08-15T06:21:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-98857", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: bound LBLCR and LBLC cache growth\n\nip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for\nevery previously unseen destination address. The table max_size only\ntells the periodic collector to reclaim entries after the cache has\nalready exceeded the limit. It does not reclaim entries that the\nattacker continues to use.\n\nReject new cache entries once either table reaches max_size * 3 / 2.\nThe extra headroom lets the periodic collector catch up while the\nexisting scheduler fallback continues to use the selected destination\nwhen cache creation fails. New traffic therefore stays serviceable\nwithout growing the tables further.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-98857" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/16c83c047ecfaf226ad81d45d77fa11a3184d0e4", "url": "https://git.kernel.org/stable/c/16c83c047ecfaf226ad81d45d77fa11a3184d0e4" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2a3c3de660f96865f303fd25f1285f2ffbfd521d", "url": "https://git.kernel.org/stable/c/2a3c3de660f96865f303fd25f1285f2ffbfd521d" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/31028d7b970962fbeda1e9131405c76551094300", "url": "https://git.kernel.org/stable/c/31028d7b970962fbeda1e9131405c76551094300" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/6316d17324bd4ca400c26adb7b656c6e3447c209", "url": "https://git.kernel.org/stable/c/6316d17324bd4ca400c26adb7b656c6e3447c209" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bc9ff8e64771cc32a216953fe615386f46ac1eaa", "url": "https://git.kernel.org/stable/c/bc9ff8e64771cc32a216953fe615386f46ac1eaa" } ], "release_date": "2026-10-18T16:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-74444", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n\nvmw_cmd_draw() computes\n\n\tmaxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl);\n\nwhere header->size is u32 and is taken straight from the user-supplied\ncommand stream. When header->size is less than sizeof(cmd->body) the\nunsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.\nAny user-controlled cmd->body.numVertexDecls then passes the bound and\nthe loop dereferences decl[i] far past the end of the kernel command\nbounce buffer, producing an out-of-bounds read of kernel memory.\n\nReject undersized headers up front.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-74444" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/112c6ff29a56f3a22db4d5af869697aa07035ad6", "url": "https://git.kernel.org/stable/c/112c6ff29a56f3a22db4d5af869697aa07035ad6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2666cddf0dd218aa9bd1f99db688d1b532eac21a", "url": "https://git.kernel.org/stable/c/2666cddf0dd218aa9bd1f99db688d1b532eac21a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/85891d174707d8bddcec7a888fb4e1d17def34f3", "url": "https://git.kernel.org/stable/c/85891d174707d8bddcec7a888fb4e1d17def34f3" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b89ca4bba820f79dde52af15ee139fe6e8bbc314", "url": "https://git.kernel.org/stable/c/b89ca4bba820f79dde52af15ee139fe6e8bbc314" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/bef30317fcb4c838a37bceb2fc76256eb6b975c1", "url": "https://git.kernel.org/stable/c/bef30317fcb4c838a37bceb2fc76256eb6b975c1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/c77cf8edae2bd3a1599115301cc7c98d0c78e731", "url": "https://git.kernel.org/stable/c/c77cf8edae2bd3a1599115301cc7c98d0c78e731" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/dc0be7662b7b0ce28cb5eea864737793ed7b9e70", "url": "https://git.kernel.org/stable/c/dc0be7662b7b0ce28cb5eea864737793ed7b9e70" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fc0c02f510e41650df3479f96e257acf87d8a20a", "url": "https://git.kernel.org/stable/c/fc0c02f510e41650df3479f96e257acf87d8a20a" } ], "release_date": "2026-08-15T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-90329", "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: synchronize input before cleaning up a failed probe\n\nhid_device_io_start() allows reports to run concurrently with probe. If\nthe probe subsequently fails, __hid_device_probe() releases driver\nresources and clears hdev->driver without first excluding those report\ncallbacks.\n\nFor example, a report may enter hidraw_report_event() while the failure\npath frees the associated hidraw object, leading to a use-after-free when\nthe report takes the object's list lock.\n\nStop input before performing failed-probe cleanup. This reacquires\ndriver_input_lock and waits for any report callback already in progress.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-90329" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/01eeb601a1626e683fb7b77c63f442b06fb87093", "url": "https://git.kernel.org/stable/c/01eeb601a1626e683fb7b77c63f442b06fb87093" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/207853d46f7ef2e28042344a1468da8754c3ddbf", "url": "https://git.kernel.org/stable/c/207853d46f7ef2e28042344a1468da8754c3ddbf" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/2c35cdeb13a0c52429501e66f368fa59cad235f6", "url": "https://git.kernel.org/stable/c/2c35cdeb13a0c52429501e66f368fa59cad235f6" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/3ffb088a2ed34ca982cfc2c81d107ce370aa45f1", "url": "https://git.kernel.org/stable/c/3ffb088a2ed34ca982cfc2c81d107ce370aa45f1" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/98201b46f7e33fe11af6f024fecb40fb56634225", "url": "https://git.kernel.org/stable/c/98201b46f7e33fe11af6f024fecb40fb56634225" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/9a3da56aae28e1ad3a3e591f72a537742053ecd2", "url": "https://git.kernel.org/stable/c/9a3da56aae28e1ad3a3e591f72a537742053ecd2" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/b85d1000eb8842768970f2fd0a8fd362472d02d5", "url": "https://git.kernel.org/stable/c/b85d1000eb8842768970f2fd0a8fd362472d02d5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/edd490b8ad85c052eaf10dcc9f390ea54f1e1b39", "url": "https://git.kernel.org/stable/c/edd490b8ad85c052eaf10dcc9f390ea54f1e1b39" } ], "release_date": "2026-09-17T17:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-30T16:27:49.253393Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667", "product_ids": [ "Oracle-Linux-7:bpftool-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-container-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-debug-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-devel-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.i686", "Oracle-Linux-7:kernel-uek-headers-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:kernel-uek-tools-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64", "Oracle-Linux-7:python-perf-0:5.4.17-2136.361.1.el7uek.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1793377667" } ], "threats": [ { "category": "impact", "details": "Critical" } ] } ] }