Vulnerability-Lookup

RHSA-2026:22900

Vulnerability from csaf_redhat - Published: 2026-06-03 15:25 - Updated: 2026-06-05 00:49

Summary

Red Hat Security Advisory: kernel-rt security update

Severity

Important

Notes

Topic: An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-39766

In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-390 - Detection of Error Condition Without Action

Affected products

Fixed 36 products

Product	Version	Remediation
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-23270

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the traffic control `act_ct` path when it is incorrectly configured with non-ingress egress qdiscs (queueing disciplines). This can allow a local user with specific privileges to trigger a kernel crash, leading to a denial of service. In some cases, this vulnerability may also be exploited for privilege escalation.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 36 products

Product	Version	Remediation
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-31419

A flaw was found in the Linux kernel's bonding driver. A local attacker with low privileges could exploit a use-after-free vulnerability in the `bond_xmit_broadcast()` function. This occurs due to a race condition during concurrent slave enslave/release operations, which can lead to the original socket buffer (skb) being double-freed. Successful exploitation of this flaw can result in a system crash, leading to a denial of service.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 36 products

Product	Version	Remediation
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-31709

A flaw was found in the Linux kernel's Server Message Block (SMB) client, specifically within the cifsacl functionality. A malicious SMB server could provide a malformed Discretionary Access Control List (DACL) that claims to contain more Access Control Entries (ACEs) than are actually present. This insufficient validation allows the kernel to read or copy data beyond the intended memory boundaries, leading to memory corruption. This could potentially result in information disclosure or a denial of service.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1288 - Improper Validation of Consistency within Input

Affected products

Fixed 36 products

Product	Version	Remediation
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-43037

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr value. __ip_options_echo() then reads optlen from attacker-controlled packet data at sptr[rr+1] and copies that many bytes into dopt->__data, a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE). To fix this we clear skb2->cb[], as suggested by Oskar Kjos. Also add minimal IPv4 header validation (version == 4, ihl >= 5).

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Fixed 36 products

Product	Version	Remediation
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-43038

A flaw was found in the Linux kernel's IPv6 ICMP error generation. A remote attacker could send a specially crafted IPv4 ICMP error packet with a Common Internet Protocol Security Option (CIPSO) IP option. This could lead to incorrect handling of packet control block data when generating an IPv6 ICMP error, potentially causing an out-of-bounds memory access. This memory corruption could result in information disclosure or a denial of service.

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Affected products

Fixed 36 products

Product	Version	Remediation
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-43163

A flaw was found in the Linux kernel's md/bitmap component. This vulnerability involves a use-after-free race condition that occurs during array resize operations. When the `bitmap_daemon_work()` and `__bitmap_resize()` functions execute concurrently, they can access memory pages that have already been freed. This can lead to a General Protection Fault (GPF), which causes the system to crash, resulting in a denial of service.

4.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 36 products

Product	Version	Remediation
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

References

45 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:22900	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2394648	external
https://bugzilla.redhat.com/show_bug.cgi?id=2448745	external
https://bugzilla.redhat.com/show_bug.cgi?id=2457829	external
https://bugzilla.redhat.com/show_bug.cgi?id=2464351	external
https://bugzilla.redhat.com/show_bug.cgi?id=2464397	external
https://bugzilla.redhat.com/show_bug.cgi?id=2464476	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467059	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-39766	self
https://bugzilla.redhat.com/show_bug.cgi?id=2394648	external
https://www.cve.org/CVERecord?id=CVE-2025-39766	external
https://nvd.nist.gov/vuln/detail/CVE-2025-39766	external
https://lore.kernel.org/linux-cve-announce/202509…	external
https://access.redhat.com/security/cve/CVE-2026-23270	self
https://bugzilla.redhat.com/show_bug.cgi?id=2448745	external
https://www.cve.org/CVERecord?id=CVE-2026-23270	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23270	external
https://lore.kernel.org/linux-cve-announce/202603…	external
https://access.redhat.com/security/cve/CVE-2026-31419	self
https://bugzilla.redhat.com/show_bug.cgi?id=2457829	external
https://www.cve.org/CVERecord?id=CVE-2026-31419	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31419	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-31709	self
https://bugzilla.redhat.com/show_bug.cgi?id=2464476	external
https://www.cve.org/CVERecord?id=CVE-2026-31709	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31709	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43037	self
https://bugzilla.redhat.com/show_bug.cgi?id=2464351	external
https://www.cve.org/CVERecord?id=CVE-2026-43037	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43037	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43038	self
https://bugzilla.redhat.com/show_bug.cgi?id=2464397	external
https://www.cve.org/CVERecord?id=CVE-2026-43038	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43038	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43163	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467059	external
https://www.cve.org/CVERecord?id=CVE-2026-43163	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43163	external
https://lore.kernel.org/linux-cve-announce/202605…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)\n\n* kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)\n\n* kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)\n\n* kernel: ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err() (CVE-2026-43037)\n\n* kernel: ipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)\n\n* kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)\n\n* kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:22900",
        "url": "https://access.redhat.com/errata/RHSA-2026:22900"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2394648",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394648"
      },
      {
        "category": "external",
        "summary": "2448745",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448745"
      },
      {
        "category": "external",
        "summary": "2457829",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457829"
      },
      {
        "category": "external",
        "summary": "2464351",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464351"
      },
      {
        "category": "external",
        "summary": "2464397",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464397"
      },
      {
        "category": "external",
        "summary": "2464476",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464476"
      },
      {
        "category": "external",
        "summary": "2467059",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467059"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22900.json"
      }
    ],
    "title": "Red Hat Security Advisory: kernel-rt security update",
    "tracking": {
      "current_release_date": "2026-06-05T00:49:08+00:00",
      "generator": {
        "date": "2026-06-05T00:49:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2026:22900",
      "initial_release_date": "2026-06-03T15:25:47+00:00",
      "revision_history": [
        {
          "date": "2026-06-03T15:25:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-03T15:25:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-05T00:49:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Real Time E4S (v.9.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux Real Time E4S (v.9.2)",
                  "product_id": "RT-9.2.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_e4s:9.2::realtime"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
                  "product_id": "NFV-9.2.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_e4s:9.2::nfv"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
                "product": {
                  "name": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
                  "product_id": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@5.14.0-284.174.1.rt14.459.el9_2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-core@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-core@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-devel@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-modules@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-modules-core@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-modules-extra@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-devel@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-modules@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-modules-core@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-modules-extra@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-debuginfo@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo-common-x86_64@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-kvm@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_id": "kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-kvm@5.14.0-284.174.1.rt14.459.el9_2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src"
        },
        "product_reference": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src"
        },
        "product_reference": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-39766",
      "cwe": {
        "id": "CWE-390",
        "name": "Detection of Error Condition Without Action"
      },
      "discovery_date": "2025-09-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2394648"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit\n\nThe following setup can trigger a WARNING in htb_activate due to\nthe condition: !cl-\u003eleaf.q-\u003eq.qlen\n\ntc qdisc del dev lo root\ntc qdisc add dev lo root handle 1: htb default 1\ntc class add dev lo parent 1: classid 1:1 \\\n       htb rate 64bit\ntc qdisc add dev lo parent 1:1 handle f: \\\n       cake memlimit 1b\nping -I lo -f -c1 -s64 -W0.001 127.0.0.1\n\nThis is because the low memlimit leads to a low buffer_limit, which\ncauses packet dropping. However, cake_enqueue still returns\nNET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an\nempty child qdisc. We should return NET_XMIT_CN when packets are\ndropped from the same tin and flow.\n\nI do not believe return value of NET_XMIT_CN is necessary for packet\ndrops in the case of ack filtering, as that is meant to optimize\nperformance, not to signal congestion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-39766"
        },
        {
          "category": "external",
          "summary": "RHBZ#2394648",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394648"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-39766",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-39766"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-39766",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39766"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2025091144-CVE-2025-39766-7465@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2025091144-CVE-2025-39766-7465@gregkh/T"
        }
      ],
      "release_date": "2025-09-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-03T15:25:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
          "product_ids": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22900"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit"
    },
    {
      "cve": "CVE-2026-23270",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-03-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448745"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the traffic control `act_ct` path when it is incorrectly configured with non-ingress egress qdiscs (queueing disciplines). This can allow a local user with specific privileges to trigger a kernel crash, leading to a denial of service. In some cases, this vulnerability may also be exploited for privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A use after free risk exists in the traffic control act_ct path when it is attached to non ingress egress qdiscs. In this configuration classify can return TC_ACT_CONSUMED while the skb is still held by the defragmentation engine. That can result in the skb being consumed and later accessed again by defragmentation which may lead to a kernel crash. Impact is denial of service in the common case, but keeping in mind that a kernel UAF could be exploitable for privilege escalation in some cases. The bug could happen only if some specific configuration being used (when tc/action being used and if the act_ct linked to incorrect qdisc/block), and in some cases regular user (if with some privileges) can make such configuration.\nThe bug is not triggerable until some specific configuration being used, so considered with limited impact level.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-23270"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448745",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448745"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-23270",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-23270"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-23270",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23270"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026031847-CVE-2026-23270-cb9a@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026031847-CVE-2026-23270-cb9a@gregkh/T"
        }
      ],
      "release_date": "2026-03-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-03T15:25:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
          "product_ids": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22900"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation"
    },
    {
      "cve": "CVE-2026-31419",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-04-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457829"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s bonding driver. A local attacker with low privileges could exploit a use-after-free vulnerability in the `bond_xmit_broadcast()` function. This occurs due to a race condition during concurrent slave enslave/release operations, which can lead to the original socket buffer (skb) being double-freed. Successful exploitation of this flaw can result in a system crash, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important impact flaw affecting the Linux kernel\u0027s bonding driver in Red Hat Enterprise Linux 6, 8.8 and later, 9.2 and later, and 10, as well as Red Hat In-Vehicle OS 2.0. A local attacker with low privileges could trigger a use-after-free vulnerability, leading to a system crash and denial of service. Red Hat Enterprise Linux 7, 8.2, 8.4, 8.6, and 9.0 are not affected as the vulnerable code is not present.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-31419"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457829",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457829"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-31419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-31419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31419"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026041353-CVE-2026-31419-e176@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026041353-CVE-2026-31419-e176@gregkh/T"
        }
      ],
      "release_date": "2026-04-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-03T15:25:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
          "product_ids": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22900"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service"
    },
    {
      "cve": "CVE-2026-31709",
      "cwe": {
        "id": "CWE-1288",
        "name": "Improper Validation of Consistency within Input"
      },
      "discovery_date": "2026-05-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2464476"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s Server Message Block (SMB) client, specifically within the cifsacl functionality. A malicious SMB server could provide a malformed Discretionary Access Control List (DACL) that claims to contain more Access Control Entries (ACEs) than are actually present. This insufficient validation allows the kernel to read or copy data beyond the intended memory boundaries, leading to memory corruption. This could potentially result in information disclosure or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: smb: client: validate the whole DACL before rewriting it in cifsacl",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-31709"
        },
        {
          "category": "external",
          "summary": "RHBZ#2464476",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464476"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-31709",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-31709"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31709",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31709"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026050122-CVE-2026-31709-335b@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026050122-CVE-2026-31709-335b@gregkh/T"
        }
      ],
      "release_date": "2026-05-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-03T15:25:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
          "product_ids": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22900"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, if SMB client functionality is not required, the `cifs` kernel module can be blacklisted to prevent it from loading. This can be achieved by creating a modprobe configuration file.\n\n1. Create a file named `/etc/modprobe.d/disable-cifs.conf` with the following content:\n   ```\n   install cifs /bin/true\n   blacklist cifs\n   ```\n2. Regenerate the initramfs to ensure the change takes effect on boot:\n   ```bash\n   dracut -f -v\n   ```\n   or for systems using `mkinitrd`:\n   ```bash\n   mkinitrd -f /boot/initramfs-$(uname -r).img $(uname -r)\n   ```\n3. A system reboot is required for the changes to take effect.\n\nWarning: Disabling the `cifs` module will prevent the system from mounting SMB/CIFS shares. Ensure this functionality is not critical before applying this mitigation.\n\nrefer: https://access.redhat.com/solutions/4117281",
          "product_ids": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: smb: client: validate the whole DACL before rewriting it in cifsacl"
    },
    {
      "cve": "CVE-2026-43037",
      "discovery_date": "2026-05-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2464351"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()\n\nOskar Kjos reported the following problem.\n\nip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written\nby the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes\nIPCB(skb2) to __ip_options_echo(), which interprets that cb[] region\nas struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff\nat offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr\nvalue. __ip_options_echo() then reads optlen from attacker-controlled\npacket data at sptr[rr+1] and copies that many bytes into dopt-\u003e__data,\na fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).\n\nTo fix this we clear skb2-\u003ecb[], as suggested by Oskar Kjos.\n\nAlso add minimal IPv4 header validation (version == 4, ihl \u003e= 5).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43037"
        },
        {
          "category": "external",
          "summary": "RHBZ#2464351",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464351"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43037",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43037"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43037",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43037"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026050102-CVE-2026-43037-0346@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026050102-CVE-2026-43037-0346@gregkh/T"
        }
      ],
      "release_date": "2026-05-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-03T15:25:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
          "product_ids": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22900"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()"
    },
    {
      "cve": "CVE-2026-43038",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "discovery_date": "2026-05-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2464397"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s IPv6 ICMP error generation. A remote attacker could send a specially crafted IPv4 ICMP error packet with a Common Internet Protocol Security Option (CIPSO) IP option. This could lead to incorrect handling of packet control block data when generating an IPv6 ICMP error, potentially causing an out-of-bounds memory access. This memory corruption could result in information disclosure or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: ipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach()",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43038"
        },
        {
          "category": "external",
          "summary": "RHBZ#2464397",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464397"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43038",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43038"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43038",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43038"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026050103-CVE-2026-43038-b591@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026050103-CVE-2026-43038-b591@gregkh/T"
        }
      ],
      "release_date": "2026-05-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-03T15:25:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
          "product_ids": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22900"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: ipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach()"
    },
    {
      "cve": "CVE-2026-43163",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-05-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467059"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s md/bitmap component. This vulnerability involves a use-after-free race condition that occurs during array resize operations. When the `bitmap_daemon_work()` and `__bitmap_resize()` functions execute concurrently, they can access memory pages that have already been freed. This can lead to a General Protection Fault (GPF), which causes the system to crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: md/bitmap: fix GPF in write_page caused by resize race",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43163"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467059",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467059"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43163",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43163"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43163",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43163"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026050632-CVE-2026-43163-86e1@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026050632-CVE-2026-43163-86e1@gregkh/T"
        }
      ],
      "release_date": "2026-05-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-03T15:25:47+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.",
          "product_ids": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22900"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.174.1.rt14.459.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: md/bitmap: fix GPF in write_page caused by resize race"
    }
  ]
}

CVE-2025-39766 (GCVE-0-2025-39766)

Vulnerability from cvelistv5 – Published: 2025-09-11 16:56 – Updated: 2026-05-12 12:06

Title

net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit

Summary

Severity

No CVSS data available.

Assigner

Linux

References

11 references

URL	Tags
https://git.kernel.org/stable/c/7689ab22de36f8db1…
https://git.kernel.org/stable/c/de04ddd2980b48caa…
https://git.kernel.org/stable/c/0dacfc5372e314d12…
https://git.kernel.org/stable/c/710866fc0a64eafcb…
https://git.kernel.org/stable/c/aa12ee1c1bd260943…
https://git.kernel.org/stable/c/ff57186b2cc397666…
https://git.kernel.org/stable/c/62d591dde4defb133…
https://git.kernel.org/stable/c/15de71d06a400f7fd…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 7689ab22de36f8db19095f6bdf11f28cfde92f5c (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < de04ddd2980b48caa8d7e24a7db2742917a8b280 (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 0dacfc5372e314d1219f03e64dde3ab495a5a25e (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 710866fc0a64eafcb8bacd91bcb1329eb7e5035f (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < aa12ee1c1bd260943fd6ab556d8635811c332eeb (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < ff57186b2cc39766672c4c0332323933e5faaa88 (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 62d591dde4defb1333d202410609c4ddeae060b3 (git) Affected: 046f6fd5daefac7f5abdafb436b30f63bc7c602b , < 15de71d06a400f7fdc15bf377a2552b0ec437cf5 (git)
Linux	Linux	Affected: 4.19 Unaffected: 0 , < 4.19 (semver) Unaffected: 5.4.297 , ≤ 5.4.* (semver) Unaffected: 5.10.241 , ≤ 5.10.* (semver) Unaffected: 5.15.190 , ≤ 5.15.* (semver) Unaffected: 6.1.149 , ≤ 6.1.* (semver) Unaffected: 6.6.103 , ≤ 6.6.* (semver) Unaffected: 6.12.44 , ≤ 6.12.* (semver) Unaffected: 6.16.4 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC CN 4100	Affected: 0 , < V5.0 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:11.881Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:06:51.305Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7689ab22de36f8db19095f6bdf11f28cfde92f5c",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "de04ddd2980b48caa8d7e24a7db2742917a8b280",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "0dacfc5372e314d1219f03e64dde3ab495a5a25e",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "710866fc0a64eafcb8bacd91bcb1329eb7e5035f",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "aa12ee1c1bd260943fd6ab556d8635811c332eeb",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "ff57186b2cc39766672c4c0332323933e5faaa88",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "62d591dde4defb1333d202410609c4ddeae060b3",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            },
            {
              "lessThan": "15de71d06a400f7fdc15bf377a2552b0ec437cf5",
              "status": "affected",
              "version": "046f6fd5daefac7f5abdafb436b30f63bc7c602b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit\n\nThe following setup can trigger a WARNING in htb_activate due to\nthe condition: !cl-\u003eleaf.q-\u003eq.qlen\n\ntc qdisc del dev lo root\ntc qdisc add dev lo root handle 1: htb default 1\ntc class add dev lo parent 1: classid 1:1 \\\n       htb rate 64bit\ntc qdisc add dev lo parent 1:1 handle f: \\\n       cake memlimit 1b\nping -I lo -f -c1 -s64 -W0.001 127.0.0.1\n\nThis is because the low memlimit leads to a low buffer_limit, which\ncauses packet dropping. However, cake_enqueue still returns\nNET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an\nempty child qdisc. We should return NET_XMIT_CN when packets are\ndropped from the same tin and flow.\n\nI do not believe return value of NET_XMIT_CN is necessary for packet\ndrops in the case of ack filtering, as that is meant to optimize\nperformance, not to signal congestion."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:35:50.638Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7689ab22de36f8db19095f6bdf11f28cfde92f5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/de04ddd2980b48caa8d7e24a7db2742917a8b280"
        },
        {
          "url": "https://git.kernel.org/stable/c/0dacfc5372e314d1219f03e64dde3ab495a5a25e"
        },
        {
          "url": "https://git.kernel.org/stable/c/710866fc0a64eafcb8bacd91bcb1329eb7e5035f"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa12ee1c1bd260943fd6ab556d8635811c332eeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff57186b2cc39766672c4c0332323933e5faaa88"
        },
        {
          "url": "https://git.kernel.org/stable/c/62d591dde4defb1333d202410609c4ddeae060b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/15de71d06a400f7fdc15bf377a2552b0ec437cf5"
        }
      ],
      "title": "net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39766",
    "datePublished": "2025-09-11T16:56:21.514Z",
    "dateReserved": "2025-04-16T07:20:57.126Z",
    "dateUpdated": "2026-05-12T12:06:51.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23270 (GCVE-0-2026-23270)

Vulnerability from cvelistv5 – Published: 2026-03-18 17:54 – Updated: 2026-05-23 16:04

Title

net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the current skb being held by the defragmentation engine. As reported by GangMin Kim, if such packet is that may cause a UaF when the defrag engine later on tries to tuch again such packet." act_ct was never meant to be used in the egress path, however some users are attaching it to egress today [2]. Attempting to reach a middle ground, we noticed that, while most qdiscs are not handling TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we address the issue by only allowing act_ct to bind to clsact/ingress qdiscs and shared blocks. That way it's still possible to attach act_ct to egress (albeit only with clsact). [1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ [2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

7 references

URL	Tags
https://git.kernel.org/stable/c/bc4e5bb529823a09f…
https://git.kernel.org/stable/c/fb3c380a54e33d1fd…
https://git.kernel.org/stable/c/5a110ddcc99bda77a…
https://git.kernel.org/stable/c/524ce8b4ea8f64900…
https://git.kernel.org/stable/c/380ad8b7c65ea7aa1…
https://git.kernel.org/stable/c/9deda0fcda5c1f388…
https://git.kernel.org/stable/c/11cb63b0d1a0685e0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 172ba7d46c202e679f3ccb10264c67416aaeb1c4 , < bc4e5bb529823a09f02dbe96169de679a9db26e0 (git) Affected: 0b5b831122fc3789fff75be433ba3e4dd7b779d4 , < fb3c380a54e33d1fd272cc342faa906d787d7ef1 (git) Affected: 73f7da5fd124f2cda9161e2e46114915e6e82e97 , < 5a110ddcc99bda77a28598b3555fe009eaab3828 (git) Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 524ce8b4ea8f64900b6c52b6a28df74f6bc0801e (git) Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6 (git) Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 9deda0fcda5c1f388c5e279541850b71a2ccfcf4 (git) Affected: 3f14b377d01d8357eba032b4cabc8c1149b458b6 , < 11cb63b0d1a0685e0831ae3c77223e002ef18189 (git) Affected: f5346df0591d10bc948761ca854b1fae6d2ef441 (git) Affected: 5.15.148 , < 5.15.203 (semver) Affected: 6.1.75 , < 6.1.167 (semver) Affected: 6.6.14 , < 6.6.130 (semver) Affected: 6.7.2 , < 6.8 (semver)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.77 , ≤ 6.12.* (semver) Unaffected: 6.18.18 , ≤ 6.18.* (semver) Unaffected: 6.19.8 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_ct.c",
            "net/sched/cls_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bc4e5bb529823a09f02dbe96169de679a9db26e0",
              "status": "affected",
              "version": "172ba7d46c202e679f3ccb10264c67416aaeb1c4",
              "versionType": "git"
            },
            {
              "lessThan": "fb3c380a54e33d1fd272cc342faa906d787d7ef1",
              "status": "affected",
              "version": "0b5b831122fc3789fff75be433ba3e4dd7b779d4",
              "versionType": "git"
            },
            {
              "lessThan": "5a110ddcc99bda77a28598b3555fe009eaab3828",
              "status": "affected",
              "version": "73f7da5fd124f2cda9161e2e46114915e6e82e97",
              "versionType": "git"
            },
            {
              "lessThan": "524ce8b4ea8f64900b6c52b6a28df74f6bc0801e",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "9deda0fcda5c1f388c5e279541850b71a2ccfcf4",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "lessThan": "11cb63b0d1a0685e0831ae3c77223e002ef18189",
              "status": "affected",
              "version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f5346df0591d10bc948761ca854b1fae6d2ef441",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.203",
              "status": "affected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.167",
              "status": "affected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.130",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_ct.c",
            "net/sched/cls_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.15.148",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "6.1.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.18",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.8",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks\n\nAs Paolo said earlier [1]:\n\n\"Since the blamed commit below, classify can return TC_ACT_CONSUMED while\nthe current skb being held by the defragmentation engine. As reported by\nGangMin Kim, if such packet is that may cause a UaF when the defrag engine\nlater on tries to tuch again such packet.\"\n\nact_ct was never meant to be used in the egress path, however some users\nare attaching it to egress today [2]. Attempting to reach a middle\nground, we noticed that, while most qdiscs are not handling\nTC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we\naddress the issue by only allowing act_ct to bind to clsact/ingress\nqdiscs and shared blocks. That way it\u0027s still possible to attach act_ct to\negress (albeit only with clsact).\n\n[1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/\n[2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:04:25.027Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bc4e5bb529823a09f02dbe96169de679a9db26e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb3c380a54e33d1fd272cc342faa906d787d7ef1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a110ddcc99bda77a28598b3555fe009eaab3828"
        },
        {
          "url": "https://git.kernel.org/stable/c/524ce8b4ea8f64900b6c52b6a28df74f6bc0801e"
        },
        {
          "url": "https://git.kernel.org/stable/c/380ad8b7c65ea7aa10ef2258297079ed5ac1f5b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9deda0fcda5c1f388c5e279541850b71a2ccfcf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/11cb63b0d1a0685e0831ae3c77223e002ef18189"
        }
      ],
      "title": "net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23270",
    "datePublished": "2026-03-18T17:54:43.803Z",
    "dateReserved": "2026-01-13T15:37:45.991Z",
    "dateUpdated": "2026-05-23T16:04:25.027Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31419 (GCVE-0-2026-31419)

Vulnerability from cvelistv5 – Published: 2026-04-13 13:40 – Updated: 2026-05-23 16:04

Title

net: bonding: fix use-after-free in bond_xmit_broadcast()

Summary

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations. The UAF can trigger the following crash: ================================================================== BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_sendmsg (net/ipv6/udp.c:1733) __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Allocated by task 147: Freed by task 147: The buggy address belongs to the object at ffff888100ef8c80 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 192 bytes inside of freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60) Memory state around the buggy address: ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/3453882f36c40d233…
https://git.kernel.org/stable/c/d4cc7e4c80b1634c7…
https://git.kernel.org/stable/c/f5b94654a4a19891a…
https://git.kernel.org/stable/c/2884bf72fb8f03409…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4e5bd03ae34652cd932ab4c91c71c511793df75c , < 3453882f36c40d2339267093676585a89808a73d (git) Affected: 4e5bd03ae34652cd932ab4c91c71c511793df75c , < d4cc7e4c80b1634c7b1497574a2fdb18df6c026c (git) Affected: 4e5bd03ae34652cd932ab4c91c71c511793df75c , < f5b94654a4a19891a8108d66ef166de6c028c6cd (git) Affected: 4e5bd03ae34652cd932ab4c91c71c511793df75c , < 2884bf72fb8f03409e423397319205de48adca16 (git) Affected: 20949c3816463e97c6f8fe84c0280c7e5ae83a8d (git) Affected: f1d206181f19b00b275b258fea1418718a2f4173 (git) Affected: c1f1691ef84fa6d38fa5e5148eca073145e97ffa (git) Affected: 5.10.94 , < 5.11 (semver) Affected: 5.15.17 , < 5.16 (semver) Affected: 5.16.3 , < 5.17 (semver)
Linux	Linux	Affected: 5.17 Unaffected: 0 , < 5.17 (semver) Unaffected: 6.12.86 , ≤ 6.12.* (semver) Unaffected: 6.18.22 , ≤ 6.18.* (semver) Unaffected: 6.19.12 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3453882f36c40d2339267093676585a89808a73d",
              "status": "affected",
              "version": "4e5bd03ae34652cd932ab4c91c71c511793df75c",
              "versionType": "git"
            },
            {
              "lessThan": "d4cc7e4c80b1634c7b1497574a2fdb18df6c026c",
              "status": "affected",
              "version": "4e5bd03ae34652cd932ab4c91c71c511793df75c",
              "versionType": "git"
            },
            {
              "lessThan": "f5b94654a4a19891a8108d66ef166de6c028c6cd",
              "status": "affected",
              "version": "4e5bd03ae34652cd932ab4c91c71c511793df75c",
              "versionType": "git"
            },
            {
              "lessThan": "2884bf72fb8f03409e423397319205de48adca16",
              "status": "affected",
              "version": "4e5bd03ae34652cd932ab4c91c71c511793df75c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "20949c3816463e97c6f8fe84c0280c7e5ae83a8d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1d206181f19b00b275b258fea1418718a2f4173",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c1f1691ef84fa6d38fa5e5148eca073145e97ffa",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.94",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix use-after-free in bond_xmit_broadcast()\n\nbond_xmit_broadcast() reuses the original skb for the last slave\n(determined by bond_is_last_slave()) and clones it for others.\nConcurrent slave enslave/release can mutate the slave list during\nRCU-protected iteration, changing which slave is \"last\" mid-loop.\nThis causes the original skb to be double-consumed (double-freed).\n\nReplace the racy bond_is_last_slave() check with a simple index\ncomparison (i + 1 == slaves_count) against the pre-snapshot slave\ncount taken via READ_ONCE() before the loop.  This preserves the\nzero-copy optimization for the last slave while making the \"last\"\ndetermination stable against concurrent list mutations.\n\nThe UAF can trigger the following crash:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in skb_clone\nRead of size 8 at addr ffff888100ef8d40 by task exploit/147\n\nCPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:123)\n print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:597)\n skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593)\n dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887)\n __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838)\n ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136)\n ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219)\n ip6_output (net/ipv6/ip6_output.c:250)\n ip6_send_skb (net/ipv6/ip6_output.c:1985)\n udp_v6_send_skb (net/ipv6/udp.c:1442)\n udpv6_sendmsg (net/ipv6/udp.c:1733)\n __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206)\n __x64_sys_sendto (net/socket.c:2209)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n\nAllocated by task 147:\n\nFreed by task 147:\n\nThe buggy address belongs to the object at ffff888100ef8c80\n which belongs to the cache skbuff_head_cache of size 224\nThe buggy address is located 192 bytes inside of\n freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60)\n\nMemory state around the buggy address:\n ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc\n ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n                                                    ^\n ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb\n ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n=================================================================="
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:04:58.498Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3453882f36c40d2339267093676585a89808a73d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4cc7e4c80b1634c7b1497574a2fdb18df6c026c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5b94654a4a19891a8108d66ef166de6c028c6cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/2884bf72fb8f03409e423397319205de48adca16"
        }
      ],
      "title": "net: bonding: fix use-after-free in bond_xmit_broadcast()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31419",
    "datePublished": "2026-04-13T13:40:23.279Z",
    "dateReserved": "2026-03-09T15:48:24.088Z",
    "dateUpdated": "2026-05-23T16:04:58.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31709 (GCVE-0-2026-31709)

Vulnerability from cvelistv5 – Published: 2026-05-01 13:56 – Updated: 2026-05-17 15:21

Title

smb: client: validate the whole DACL before rewriting it in cifsacl

Summary

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security descriptor. The original fix only checked that the struct smb_acl header fits before reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate header-field OOB read, but the rewrite helpers still walk ACEs based on pdacl->num_aces with no structural validation of the incoming DACL body. A malicious server can return a truncated DACL that still contains a header, claims one or more ACEs, and then drive replace_sids_and_copy_aces() or set_chmod_dacl() past the validated extent while they compare or copy attacker-controlled ACEs. Factor the DACL structural checks into validate_dacl(), extend them to validate each ACE against the DACL bounds, and use the shared validator before the chmod/chown rebuild paths. parse_dacl() reuses the same validator so the read-side parser and write-side rewrite paths agree on what constitutes a well-formed incoming DACL.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/8e47d297e7cf9a602…
https://git.kernel.org/stable/c/d92f3f0b22414e751…
https://git.kernel.org/stable/c/b78db9bddc84136f6…
https://git.kernel.org/stable/c/0a8cf165566ba55a3…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 , < 8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12 (git) Affected: bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 , < d92f3f0b22414e7515696a02224d0af55e3004a3 (git) Affected: bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 , < b78db9bddc84136f6a0bb49e8883cf200dfb87a8 (git) Affected: bc3e9dd9d104ca1b75644eab87b38ce8a924aef4 , < 0a8cf165566ba55a39fd0f4de172119dd646d39a (git)
Linux	Linux	Affected: 5.12 Unaffected: 0 , < 5.12 (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.86 , ≤ 6.12.* (semver) Unaffected: 7.0.2 , ≤ 7.0.* (semver) Unaffected: 7.1-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12",
              "status": "affected",
              "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4",
              "versionType": "git"
            },
            {
              "lessThan": "d92f3f0b22414e7515696a02224d0af55e3004a3",
              "status": "affected",
              "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4",
              "versionType": "git"
            },
            {
              "lessThan": "b78db9bddc84136f6a0bb49e8883cf200dfb87a8",
              "status": "affected",
              "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4",
              "versionType": "git"
            },
            {
              "lessThan": "0a8cf165566ba55a39fd0f4de172119dd646d39a",
              "status": "affected",
              "version": "bc3e9dd9d104ca1b75644eab87b38ce8a924aef4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1-rc1",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate the whole DACL before rewriting it in cifsacl\n\nbuild_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a\nserver-supplied dacloffset and then use the incoming ACL to rebuild the\nchmod/chown security descriptor.\n\nThe original fix only checked that the struct smb_acl header fits before\nreading dacl_ptr-\u003esize or dacl_ptr-\u003enum_aces.  That avoids the immediate\nheader-field OOB read, but the rewrite helpers still walk ACEs based on\npdacl-\u003enum_aces with no structural validation of the incoming DACL body.\n\nA malicious server can return a truncated DACL that still contains a\nheader, claims one or more ACEs, and then drive\nreplace_sids_and_copy_aces() or set_chmod_dacl() past the validated\nextent while they compare or copy attacker-controlled ACEs.\n\nFactor the DACL structural checks into validate_dacl(), extend them to\nvalidate each ACE against the DACL bounds, and use the shared validator\nbefore the chmod/chown rebuild paths.  parse_dacl() reuses the same\nvalidator so the read-side parser and write-side rewrite paths agree on\nwhat constitutes a well-formed incoming DACL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-17T15:21:32.443Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12"
        },
        {
          "url": "https://git.kernel.org/stable/c/d92f3f0b22414e7515696a02224d0af55e3004a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a"
        }
      ],
      "title": "smb: client: validate the whole DACL before rewriting it in cifsacl",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31709",
    "datePublished": "2026-05-01T13:56:06.522Z",
    "dateReserved": "2026-03-09T15:48:24.133Z",
    "dateUpdated": "2026-05-17T15:21:32.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43037 (GCVE-0-2026-43037)

Vulnerability from cvelistv5 – Published: 2026-05-01 14:15 – Updated: 2026-05-11 22:16

Title

ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

Summary

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/ea9f65b27c8404e16…
https://git.kernel.org/stable/c/d6621f60192fe10c0…
https://git.kernel.org/stable/c/2cc6e3b0fe0f0242d…
https://git.kernel.org/stable/c/a0c4ce9900a108eaf…
https://git.kernel.org/stable/c/1063515ce15ff3106…
https://git.kernel.org/stable/c/590f622669b97eaf7…
https://git.kernel.org/stable/c/4a622658f384b0356…
https://git.kernel.org/stable/c/2edfa31769a4add82…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c4d3efafcc933fd2ffd169d7dc4f980393a13796 , < ea9f65b27c8404e164848ebff1443310fd187629 (git) Affected: c4d3efafcc933fd2ffd169d7dc4f980393a13796 , < d6621f60192fe10c047a4487be42a6f4c150707f (git) Affected: c4d3efafcc933fd2ffd169d7dc4f980393a13796 , < 2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5 (git) Affected: c4d3efafcc933fd2ffd169d7dc4f980393a13796 , < a0c4ce9900a108eaf55d0f3b399cb55999647d39 (git) Affected: c4d3efafcc933fd2ffd169d7dc4f980393a13796 , < 1063515ce15ff31065c4e7f8265f4c2fd3c54876 (git) Affected: c4d3efafcc933fd2ffd169d7dc4f980393a13796 , < 590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3 (git) Affected: c4d3efafcc933fd2ffd169d7dc4f980393a13796 , < 4a622658f384b03560834cbe8ffcfe69a278f7c8 (git) Affected: c4d3efafcc933fd2ffd169d7dc4f980393a13796 , < 2edfa31769a4add828a7e604b21cb82aaaa05925 (git)
Linux	Linux	Affected: 2.6.22 Unaffected: 0 , < 2.6.22 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.12.81 , ≤ 6.12.* (semver) Unaffected: 6.18.22 , ≤ 6.18.* (semver) Unaffected: 6.19.12 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea9f65b27c8404e164848ebff1443310fd187629",
              "status": "affected",
              "version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
              "versionType": "git"
            },
            {
              "lessThan": "d6621f60192fe10c047a4487be42a6f4c150707f",
              "status": "affected",
              "version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
              "versionType": "git"
            },
            {
              "lessThan": "2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5",
              "status": "affected",
              "version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
              "versionType": "git"
            },
            {
              "lessThan": "a0c4ce9900a108eaf55d0f3b399cb55999647d39",
              "status": "affected",
              "version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
              "versionType": "git"
            },
            {
              "lessThan": "1063515ce15ff31065c4e7f8265f4c2fd3c54876",
              "status": "affected",
              "version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
              "versionType": "git"
            },
            {
              "lessThan": "590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3",
              "status": "affected",
              "version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
              "versionType": "git"
            },
            {
              "lessThan": "4a622658f384b03560834cbe8ffcfe69a278f7c8",
              "status": "affected",
              "version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
              "versionType": "git"
            },
            {
              "lessThan": "2edfa31769a4add828a7e604b21cb82aaaa05925",
              "status": "affected",
              "version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.22"
            },
            {
              "lessThan": "2.6.22",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.22",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()\n\nOskar Kjos reported the following problem.\n\nip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written\nby the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes\nIPCB(skb2) to __ip_options_echo(), which interprets that cb[] region\nas struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff\nat offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr\nvalue. __ip_options_echo() then reads optlen from attacker-controlled\npacket data at sptr[rr+1] and copies that many bytes into dopt-\u003e__data,\na fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).\n\nTo fix this we clear skb2-\u003ecb[], as suggested by Oskar Kjos.\n\nAlso add minimal IPv4 header validation (version == 4, ihl \u003e= 5)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:16:29.957Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea9f65b27c8404e164848ebff1443310fd187629"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6621f60192fe10c047a4487be42a6f4c150707f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0c4ce9900a108eaf55d0f3b399cb55999647d39"
        },
        {
          "url": "https://git.kernel.org/stable/c/1063515ce15ff31065c4e7f8265f4c2fd3c54876"
        },
        {
          "url": "https://git.kernel.org/stable/c/590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a622658f384b03560834cbe8ffcfe69a278f7c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2edfa31769a4add828a7e604b21cb82aaaa05925"
        }
      ],
      "title": "ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43037",
    "datePublished": "2026-05-01T14:15:35.314Z",
    "dateReserved": "2026-05-01T14:12:55.978Z",
    "dateUpdated": "2026-05-11T22:16:29.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43038 (GCVE-0-2026-43038)

Vulnerability from cvelistv5 – Published: 2026-05-01 14:15 – Updated: 2026-05-11 22:16

Title

ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

Summary

In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 and passed to icmp6_send(), it uses IP6CB(skb2). IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm at offset 18. If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). This would scan the inner, attacker-controlled IPv6 packet starting at that offset, potentially returning a fake TLV without checking if the remaining packet length can hold the full 18-byte struct ipv6_destopt_hao. Could mip6_addr_swap() then perform a 16-byte swap that extends past the end of the packet data into skb_shared_info? Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and ip6ip6_err() to prevent this? This patch implements the first suggestion. I am not sure if ip6ip6_err() needs to be changed. A separate patch would be better anyway.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/c438ba010171b70ba…
https://git.kernel.org/stable/c/0452b6526b2f54b24…
https://git.kernel.org/stable/c/a4437faf135da293d…
https://git.kernel.org/stable/c/3d5127d998de617b1…
https://git.kernel.org/stable/c/e41953e7d118e2702…
https://git.kernel.org/stable/c/a2edbb6393972a021…
https://git.kernel.org/stable/c/1ceeebd5bd6d855b1…
https://git.kernel.org/stable/c/86ab3e55673a7a49a…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ca15a078bd907df5fc1c009477869c5cbde3b753 , < c438ba010171b70bad22fc18b1d5bdc3627476e8 (git) Affected: ca15a078bd907df5fc1c009477869c5cbde3b753 , < 0452b6526b2f54b2413b9cb4ff1ea2ac542c99c7 (git) Affected: ca15a078bd907df5fc1c009477869c5cbde3b753 , < a4437faf135da293d16fcc4cc607316742bd0ebb (git) Affected: ca15a078bd907df5fc1c009477869c5cbde3b753 , < 3d5127d998de617b130aae96b138dba22ac6a8a7 (git) Affected: ca15a078bd907df5fc1c009477869c5cbde3b753 , < e41953e7d118e2702bcb217879c173d9d1d3cd4e (git) Affected: ca15a078bd907df5fc1c009477869c5cbde3b753 , < a2edbb6393972a02114b6003953a5cef3104fada (git) Affected: ca15a078bd907df5fc1c009477869c5cbde3b753 , < 1ceeebd5bd6d855b17a5df625109bfe29129d7cf (git) Affected: ca15a078bd907df5fc1c009477869c5cbde3b753 , < 86ab3e55673a7a49a841838776f1ab18d23a67b5 (git)
Linux	Linux	Affected: 3.13 Unaffected: 0 , < 3.13 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.12.81 , ≤ 6.12.* (semver) Unaffected: 6.18.22 , ≤ 6.18.* (semver) Unaffected: 6.19.12 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/icmp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c438ba010171b70bad22fc18b1d5bdc3627476e8",
              "status": "affected",
              "version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
              "versionType": "git"
            },
            {
              "lessThan": "0452b6526b2f54b2413b9cb4ff1ea2ac542c99c7",
              "status": "affected",
              "version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
              "versionType": "git"
            },
            {
              "lessThan": "a4437faf135da293d16fcc4cc607316742bd0ebb",
              "status": "affected",
              "version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
              "versionType": "git"
            },
            {
              "lessThan": "3d5127d998de617b130aae96b138dba22ac6a8a7",
              "status": "affected",
              "version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
              "versionType": "git"
            },
            {
              "lessThan": "e41953e7d118e2702bcb217879c173d9d1d3cd4e",
              "status": "affected",
              "version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
              "versionType": "git"
            },
            {
              "lessThan": "a2edbb6393972a02114b6003953a5cef3104fada",
              "status": "affected",
              "version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
              "versionType": "git"
            },
            {
              "lessThan": "1ceeebd5bd6d855b17a5df625109bfe29129d7cf",
              "status": "affected",
              "version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
              "versionType": "git"
            },
            {
              "lessThan": "86ab3e55673a7a49a841838776f1ab18d23a67b5",
              "status": "affected",
              "version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/icmp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach()\n\nSashiko AI-review observed:\n\n  In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet\n  where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2\n  and passed to icmp6_send(), it uses IP6CB(skb2).\n\n  IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso\n  offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm\n  at offset 18.\n\n  If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao\n  would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called\n  and uses ipv6_find_tlv(skb, opt-\u003edsthao, IPV6_TLV_HAO).\n\n  This would scan the inner, attacker-controlled IPv6 packet starting at that\n  offset, potentially returning a fake TLV without checking if the remaining\n  packet length can hold the full 18-byte struct ipv6_destopt_hao.\n\n  Could mip6_addr_swap() then perform a 16-byte swap that extends past the end\n  of the packet data into skb_shared_info?\n\n  Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and\n  ip6ip6_err() to prevent this?\n\nThis patch implements the first suggestion.\n\nI am not sure if ip6ip6_err() needs to be changed.\nA separate patch would be better anyway."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:16:31.106Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c438ba010171b70bad22fc18b1d5bdc3627476e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/0452b6526b2f54b2413b9cb4ff1ea2ac542c99c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4437faf135da293d16fcc4cc607316742bd0ebb"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d5127d998de617b130aae96b138dba22ac6a8a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e41953e7d118e2702bcb217879c173d9d1d3cd4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2edbb6393972a02114b6003953a5cef3104fada"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ceeebd5bd6d855b17a5df625109bfe29129d7cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/86ab3e55673a7a49a841838776f1ab18d23a67b5"
        }
      ],
      "title": "ipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43038",
    "datePublished": "2026-05-01T14:15:35.986Z",
    "dateReserved": "2026-05-01T14:12:55.978Z",
    "dateUpdated": "2026-05-11T22:16:31.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43163 (GCVE-0-2026-43163)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-05-11 22:18

Title

md/bitmap: fix GPF in write_page caused by resize race

Summary

In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-free race between bitmap_daemon_work() and __bitmap_resize(). The daemon iterates over `bitmap->storage.filemap` without locking, while the resize path frees that storage via md_bitmap_file_unmap(). `quiesce()` does not stop the md thread, allowing concurrent access to freed pages. Fix by holding `mddev->bitmap_info.mutex` during the bitmap update.

Severity

No CVSS data available.

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/140cc839fbeb1ddb3…
https://git.kernel.org/stable/c/ebcacc7ca22d5e8a0…
https://git.kernel.org/stable/c/d3af62411e19752c6…
https://git.kernel.org/stable/c/d92b8fac294b5f915…
https://git.kernel.org/stable/c/a437e3bf30e328460…
https://git.kernel.org/stable/c/9a6f8cd28bb9bb6ed…
https://git.kernel.org/stable/c/5f73c8b33df9a605a…
https://git.kernel.org/stable/c/46ef85f854dfa9d52…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d60b479d177a5735b6b4db6ee5280ef6653f50e7 , < 140cc839fbeb1ddb33a8da8811b716d88d3905b7 (git) Affected: d60b479d177a5735b6b4db6ee5280ef6653f50e7 , < ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8 (git) Affected: d60b479d177a5735b6b4db6ee5280ef6653f50e7 , < d3af62411e19752c663fe4f424dbf49d95a4cc7c (git) Affected: d60b479d177a5735b6b4db6ee5280ef6653f50e7 , < d92b8fac294b5f915c50e65ce4ae2262e53614ec (git) Affected: d60b479d177a5735b6b4db6ee5280ef6653f50e7 , < a437e3bf30e32846079e470c1ba5ee790bccdf89 (git) Affected: d60b479d177a5735b6b4db6ee5280ef6653f50e7 , < 9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f (git) Affected: d60b479d177a5735b6b4db6ee5280ef6653f50e7 , < 5f73c8b33df9a605a591eab72d43a969600c1f8c (git) Affected: d60b479d177a5735b6b4db6ee5280ef6653f50e7 , < 46ef85f854dfa9d5226b3c1c46493d79556c9589 (git)
Linux	Linux	Affected: 3.5 Unaffected: 0 , < 3.5 (semver) Unaffected: 5.10.252 , ≤ 5.10.* (semver) Unaffected: 5.15.202 , ≤ 5.15.* (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/md-bitmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "140cc839fbeb1ddb33a8da8811b716d88d3905b7",
              "status": "affected",
              "version": "d60b479d177a5735b6b4db6ee5280ef6653f50e7",
              "versionType": "git"
            },
            {
              "lessThan": "ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8",
              "status": "affected",
              "version": "d60b479d177a5735b6b4db6ee5280ef6653f50e7",
              "versionType": "git"
            },
            {
              "lessThan": "d3af62411e19752c663fe4f424dbf49d95a4cc7c",
              "status": "affected",
              "version": "d60b479d177a5735b6b4db6ee5280ef6653f50e7",
              "versionType": "git"
            },
            {
              "lessThan": "d92b8fac294b5f915c50e65ce4ae2262e53614ec",
              "status": "affected",
              "version": "d60b479d177a5735b6b4db6ee5280ef6653f50e7",
              "versionType": "git"
            },
            {
              "lessThan": "a437e3bf30e32846079e470c1ba5ee790bccdf89",
              "status": "affected",
              "version": "d60b479d177a5735b6b4db6ee5280ef6653f50e7",
              "versionType": "git"
            },
            {
              "lessThan": "9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f",
              "status": "affected",
              "version": "d60b479d177a5735b6b4db6ee5280ef6653f50e7",
              "versionType": "git"
            },
            {
              "lessThan": "5f73c8b33df9a605a591eab72d43a969600c1f8c",
              "status": "affected",
              "version": "d60b479d177a5735b6b4db6ee5280ef6653f50e7",
              "versionType": "git"
            },
            {
              "lessThan": "46ef85f854dfa9d5226b3c1c46493d79556c9589",
              "status": "affected",
              "version": "d60b479d177a5735b6b4db6ee5280ef6653f50e7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/md-bitmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.5"
            },
            {
              "lessThan": "3.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/bitmap: fix GPF in write_page caused by resize race\n\nA General Protection Fault occurs in write_page() during array resize:\nRIP: 0010:write_page+0x22b/0x3c0 [md_mod]\n\nThis is a use-after-free race between bitmap_daemon_work() and\n__bitmap_resize(). The daemon iterates over `bitmap-\u003estorage.filemap`\nwithout locking, while the resize path frees that storage via\nmd_bitmap_file_unmap(). `quiesce()` does not stop the md thread,\nallowing concurrent access to freed pages.\n\nFix by holding `mddev-\u003ebitmap_info.mutex` during the bitmap update."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:18:58.873Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/140cc839fbeb1ddb33a8da8811b716d88d3905b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebcacc7ca22d5e8a03a970f0621ae1d1356b9ae8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3af62411e19752c663fe4f424dbf49d95a4cc7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d92b8fac294b5f915c50e65ce4ae2262e53614ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/a437e3bf30e32846079e470c1ba5ee790bccdf89"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a6f8cd28bb9bb6ed86a6df19331fb08016dee7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f73c8b33df9a605a591eab72d43a969600c1f8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/46ef85f854dfa9d5226b3c1c46493d79556c9589"
        }
      ],
      "title": "md/bitmap: fix GPF in write_page caused by resize race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43163",
    "datePublished": "2026-05-06T11:27:41.265Z",
    "dateReserved": "2026-05-01T14:12:55.990Z",
    "dateUpdated": "2026-05-11T22:18:58.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:22900

CVE-2025-39766 (GCVE-0-2025-39766)

CVE-2026-23270 (GCVE-0-2026-23270)

CVE-2026-31419 (GCVE-0-2026-31419)

CVE-2026-31709 (GCVE-0-2026-31709)

CVE-2026-43037 (GCVE-0-2026-43037)

CVE-2026-43038 (GCVE-0-2026-43038)

CVE-2026-43163 (GCVE-0-2026-43163)

Tags

Sightings

Nomenclature