Vulnerability-Lookup

RHSA-2026:34094

Vulnerability from csaf_redhat - Published: 2026-07-01 09:48 - Updated: 2026-09-29 17:08

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648) * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691) * kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) * kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852) * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) Bug Fix(es) and Enhancement(s): * iavf: during POD churn vlan filters may not be added for a vlan interface, spoofchk drops subsequent packets [rhel-9.6.z] (JIRA:RHEL-172991) * [rhel-9] WARNING: possible recursive locking detected - vmd_enable_domain+0x757/0x910 [rhel-9.6.z] (JIRA:RHEL-174469) * RHEL9.4 - s390/mm: Add missing secure storage access fixups [rhel-9.6.z] (JIRA:RHEL-183316) * drm/mgag200: 300 ms busy loop [rhel-9.6.z] (JIRA:RHEL-150177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2025-21648

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See: 0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls") Note: hashtable resize is only possible from init_netns.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-789 - Memory Allocation with Excessive Size Value

Affected products

Fixed 305 products

Product	Version	Remediation
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-debug-devel-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-debug-devel-matched-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-devel-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-64k-devel-matched-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-matched-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-matched-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-matched-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-devel-matched-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-doc-0:5.14.0-570.125.1.el9_6.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-zfcpdump-devel-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rtla-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rtla-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rtla-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rtla-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rv-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rv-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rv-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.6.0.Z.EUS:rv-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.125.1.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-modules-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-modules-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debug-modules-extra-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-modules-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-modules-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-64k-modules-extra-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-abi-stablelists-0:5.14.0-570.125.1.el9_6.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-core-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-core-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-core-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-core-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-core-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-core-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debug-uki-virt-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-core-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-core-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-core-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-extra-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-extra-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-extra-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-modules-extra-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-libs-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-libs-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-tools-libs-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-uki-virt-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-uki-virt-addons-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-core-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-modules-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-modules-core-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-core-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-devel-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-kvm-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-modules-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-devel-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-modules-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-modules-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debug-modules-extra-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-devel-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-modules-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-modules-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-64k-modules-extra-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-core-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-devel-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-devel-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:libperf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:perf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.aarch64	—	Vendor Fix fix
Unresolved product id: RT-9.6.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-570.125.1.el9_6.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2025-21691

In the Linux kernel, the following vulnerability has been resolved: cachestat: fix page cache statistics permission checking When the 'cachestat()' system call was added in commit cf264e1329fb ("cachestat: implement cachestat syscall"), it was meant to be a much more convenient (and performant) version of mincore() that didn't need mapping things into the user virtual address space in order to work. But it ended up missing the "check for writability or ownership" fix for mincore(), done in commit 134fca9063ad ("mm/mincore.c: make mincore() more conservative"). This just adds equivalent logic to 'cachestat()', modified for the file context (rather than vma).

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-863 - Incorrect Authorization

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Moderate

CVE-2026-23191

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are performed outside the cable lock, this may result in UAF when a program attempts to trigger frequently while opening/closing the tied stream, as spotted by fuzzers. For addressing the UAF, this patch changes two things: - It covers the most of code in loopback_check_format() with cable->lock spinlock, and add the proper NULL checks. This avoids already some racy accesses. - In addition, now we try to check the state of the capture PCM stream that may be stopped in this function, which was the major pain point leading to UAF.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Moderate

CVE-2026-31669

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. Due to incorrect memory allocation for IPv6 subflow child sockets, a use-after-free vulnerability exists. A remote attacker could exploit this by triggering concurrent lookups in the kernel's hash table, potentially leading to a denial of service or arbitrary code execution.

7.5 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-763 - Release of Invalid Pointer or Reference

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Moderate

CVE-2026-43027

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the `nf_conntrack_helper`. When a connection tracking helper is unregistered, its associated expectations are not properly cleaned up. This oversight can lead to a use-after-free vulnerability, where the system attempts to access memory that has already been released. A local attacker could exploit this to cause a system crash, resulting in a Denial of Service (DoS), or potentially achieve privilege escalation.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-459 - Incomplete Cleanup

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Moderate

CVE-2026-43125

A flaw was found in the Linux kernel's Distributed Lock Manager (dlm) module. An attacker could send specially crafted network messages with an oversized length parameter to the dlm_dump_rsb_name() function. This lack of validation can lead to an out-of-bounds write in the dlm_search_rsb_tree() function, potentially causing a buffer overflow. This vulnerability could allow for denial of service or, in some cases, arbitrary code execution.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-130 - Improper Handling of Length Parameter Inconsistency

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Important

CVE-2026-43128

A flaw was found in the Linux kernel's RDMA/umem subsystem. A memory management error, specifically a double unpin of a `dma_buf`, can occur in a failure path during `dma_buf` pinning operations. This vulnerability could lead to system instability or a crash, resulting in a Denial of Service (DoS).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-911 - Improper Update of Reference Count

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Moderate

CVE-2026-43198

A flaw was found in the Linux kernel. A race condition exists in the TCP (Transmission Control Protocol) IPv6 (Internet Protocol version 6) socket handling, specifically within the tcp_v6_syn_recv_sock() function. This occurs because a child socket becomes visible in the TCP hash table before its IPv6-specific information is fully initialized. A remote attacker could potentially exploit this timing window, leading to an unstable system state or unexpected behavior, which may result in a denial of service (DoS).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-821 - Incorrect Synchronization

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Important

CVE-2026-43329

A flaw was found in the Netfilter flowtable component of the Linux kernel. This vulnerability occurs because the system does not strictly check the maximum number of hardware offload actions for IPv6, allowing it to process more actions than supported. This could potentially lead to system instability or a denial of service (DoS) condition, where the affected system becomes unresponsive.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Important

CVE-2026-43414

A flaw was found in the Linux kernel's `qla2xxx` SCSI driver. An issue exists where a Fibre Channel port (fcport) object can be freed twice due to an error in the `qla2x00_els_dcmd_sp_free()` function. This double free vulnerability can lead to memory corruption, potentially causing system instability or a denial of service.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Moderate

CVE-2026-43501

A flaw was found in the Linux kernel. A local attacker can exploit an out-of-bounds write vulnerability when the kernel recomputes an IPv6 Source Routing Header (SRH). This issue occurs because insufficient headroom is reserved during the recompression process, leading to memory corruption. Successful exploitation could result in a denial of service or potentially arbitrary code execution.

7.5 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-131 - Incorrect Calculation of Buffer Size

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Important

CVE-2026-45852

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem, specifically within the `rxe` driver. An error in the `rxe_srq_from_init` function's memory management can lead to a double free vulnerability. This occurs when an attempt to copy data to user space fails, causing the same memory region to be freed twice. A local attacker could potentially exploit this flaw to cause a denial of service (DoS) by crashing the system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Moderate

CVE-2026-46090

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) aloop driver. This Use-After-Free (UAF) vulnerability occurs when loopback_check_format() stops the capture side during a format change, while a concurrent close operation detaches or frees the runtime. An attacker could potentially exploit this to cause a system crash or achieve arbitrary code execution.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-364 - Signal Handler Race Condition

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Moderate

CVE-2026-46173

A flaw was found in the Linux kernel. During the exit process of a task that has encountered an error, the system can incorrectly allow the task to be interrupted. This can lead to improper management of the task's memory, potentially causing memory corruption. Such an issue could allow a local attacker to cause a system crash (Denial of Service) or potentially gain elevated privileges.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Moderate

CVE-2026-46176

A flaw was found in the Linux kernel's RDMA/mlx5 component. An error path fall-through in the `mlx5_ib_dev_res_srq_init()` function, specifically when `ib_create_srq()` fails, can lead to the use of freed memory and error pointers. This memory corruption vulnerability could result in system instability, denial of service, or potentially arbitrary code execution.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Important

CVE-2026-46181

A flaw was found in the Linux kernel's RDMA/mlx4 component. This vulnerability arises from the incorrect use of Read-Copy Update (RCU) in the `mlx4_srq_event()` function. An attacker could potentially trigger an event before the `srq` object is fully initialized, leading to a system crash. This could result in a Denial of Service (DoS) for the affected system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-366 - Race Condition within a Thread

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Important

CVE-2026-46227

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A race condition exists in the `SCTP_SENDALL` path where a cached list entry is not properly revalidated after the socket lock is temporarily released. This allows a local attacker or a remote attacker (via a network abort) to trigger a use-after-free or type confusion vulnerability. Successful exploitation can lead to a controlled indirect call, potentially resulting in arbitrary code execution.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Important

CVE-2026-46244

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nft_inner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset (inner_thoff) becomes desynchronized from the Layer 4 protocol (l4proto). A remote attacker could exploit this desynchronization to perform transport header forgery, potentially leading to a firewall bypass and allowing unauthorized network access.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-823 - Use of Out-of-range Pointer Offset

Affected products

Fixed 305 products, the same list as for CVE-2025-21648

Threats

Impact Important

References

111 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:34094	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2338814	external
https://bugzilla.redhat.com/show_bug.cgi?id=2344687	external
https://bugzilla.redhat.com/show_bug.cgi?id=2439947	external
https://bugzilla.redhat.com/show_bug.cgi?id=2461503	external
https://bugzilla.redhat.com/show_bug.cgi?id=2464369	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467144	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467228	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467234	external
https://bugzilla.redhat.com/show_bug.cgi?id=2468124	external
https://bugzilla.redhat.com/show_bug.cgi?id=2468155	external
https://bugzilla.redhat.com/show_bug.cgi?id=2480457	external
https://bugzilla.redhat.com/show_bug.cgi?id=2481980	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482166	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482532	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482564	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482594	external
https://bugzilla.redhat.com/show_bug.cgi?id=2482634	external
https://bugzilla.redhat.com/show_bug.cgi?id=2484451	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2025-21648	self
https://bugzilla.redhat.com/show_bug.cgi?id=2338814	external
https://www.cve.org/CVERecord?id=CVE-2025-21648	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21648	external
https://lore.kernel.org/linux-cve-announce/202501…	external
https://access.redhat.com/security/cve/CVE-2025-21691	self
https://bugzilla.redhat.com/show_bug.cgi?id=2344687	external
https://www.cve.org/CVERecord?id=CVE-2025-21691	external
https://nvd.nist.gov/vuln/detail/CVE-2025-21691	external
https://lore.kernel.org/linux-cve-announce/202502…	external
https://access.redhat.com/security/cve/CVE-2026-23191	self
https://bugzilla.redhat.com/show_bug.cgi?id=2439947	external
https://www.cve.org/CVERecord?id=CVE-2026-23191	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23191	external
https://lore.kernel.org/linux-cve-announce/202602…	external
https://access.redhat.com/security/cve/CVE-2026-31669	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461503	external
https://www.cve.org/CVERecord?id=CVE-2026-31669	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31669	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-43027	self
https://bugzilla.redhat.com/show_bug.cgi?id=2464369	external
https://www.cve.org/CVERecord?id=CVE-2026-43027	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43027	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43125	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467234	external
https://www.cve.org/CVERecord?id=CVE-2026-43125	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43125	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43128	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467144	external
https://www.cve.org/CVERecord?id=CVE-2026-43128	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43128	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43198	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467228	external
https://www.cve.org/CVERecord?id=CVE-2026-43198	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43198	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43329	self
https://bugzilla.redhat.com/show_bug.cgi?id=2468124	external
https://www.cve.org/CVERecord?id=CVE-2026-43329	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43329	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-43414	self
https://bugzilla.redhat.com/show_bug.cgi?id=2468155	external
https://www.cve.org/CVERecord?id=CVE-2026-43414	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43414	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43501	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480457	external
https://www.cve.org/CVERecord?id=CVE-2026-43501	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43501	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-45852	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482166	external
https://www.cve.org/CVERecord?id=CVE-2026-45852	external
https://nvd.nist.gov/vuln/detail/CVE-2026-45852	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46090	self
https://bugzilla.redhat.com/show_bug.cgi?id=2481980	external
https://www.cve.org/CVERecord?id=CVE-2026-46090	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46090	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46173	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482634	external
https://www.cve.org/CVERecord?id=CVE-2026-46173	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46173	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46176	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482594	external
https://www.cve.org/CVERecord?id=CVE-2026-46176	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46176	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46181	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482532	external
https://www.cve.org/CVERecord?id=CVE-2026-46181	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46181	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46227	self
https://bugzilla.redhat.com/show_bug.cgi?id=2482564	external
https://www.cve.org/CVERecord?id=CVE-2026-46227	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46227	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46244	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484451	external
https://www.cve.org/CVERecord?id=CVE-2026-46244	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46244	external
https://lore.kernel.org/linux-cve-announce/202606…	external

JSON

To clipboard

Loading 1.8 MB of JSON…

CVE-2025-21648 (GCVE-0-2025-21648)

Vulnerability from cvelistv5 – Published: 2025-01-19 10:18 – Updated: 2026-09-08 08:40

Title

netfilter: conntrack: clamp maximum hashtable size to INT_MAX

Summary

Severity

No CVSS data available.

Assigner

Linux mitre root Scorecard

References

10 references

URL	Tags
https://git.kernel.org/stable/c/a965f7f0ea3ae61b9…
https://git.kernel.org/stable/c/b1b2353d768f1b80c…
https://git.kernel.org/stable/c/5552b4fd44be3393b…
https://git.kernel.org/stable/c/d5807dd1328bbc86e…
https://git.kernel.org/stable/c/f559357d035877b9d…
https://git.kernel.org/stable/c/b541ba7d1f5a5b7b3…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

6 products

Vendor	Product	Version
Linux	Linux	Affected: 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 , < a965f7f0ea3ae61b9165bed619d5d6da02c75f80 (git) Affected: 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 , < b1b2353d768f1b80cd7fe045a70adee576b9b338 (git) Affected: 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 , < 5552b4fd44be3393b930434a7845d8d95a2a3c33 (git) Affected: 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 , < d5807dd1328bbc86e059c5de80d1bbee9d58ca3d (git) Affected: 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 , < f559357d035877b9d0dcd273e0ff83e18e1d46aa (git) Affected: 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 , < b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13 (git)
Linux	Linux	Affected: 4.7 Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.234 , ≤ 5.10.* (semver) Unaffected: 5.15.177 , ≤ 5.15.* (semver) Unaffected: 6.1.125 , ≤ 6.1.* (semver) Unaffected: 6.6.72 , ≤ 6.6.* (semver) Unaffected: 6.12.10 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:58:30.561Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:40:13.240Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a965f7f0ea3ae61b9165bed619d5d6da02c75f80",
              "status": "affected",
              "version": "9cc1c73ad66610bffc80b691136ffc1e9a3b1a58",
              "versionType": "git"
            },
            {
              "lessThan": "b1b2353d768f1b80cd7fe045a70adee576b9b338",
              "status": "affected",
              "version": "9cc1c73ad66610bffc80b691136ffc1e9a3b1a58",
              "versionType": "git"
            },
            {
              "lessThan": "5552b4fd44be3393b930434a7845d8d95a2a3c33",
              "status": "affected",
              "version": "9cc1c73ad66610bffc80b691136ffc1e9a3b1a58",
              "versionType": "git"
            },
            {
              "lessThan": "d5807dd1328bbc86e059c5de80d1bbee9d58ca3d",
              "status": "affected",
              "version": "9cc1c73ad66610bffc80b691136ffc1e9a3b1a58",
              "versionType": "git"
            },
            {
              "lessThan": "f559357d035877b9d0dcd273e0ff83e18e1d46aa",
              "status": "affected",
              "version": "9cc1c73ad66610bffc80b691136ffc1e9a3b1a58",
              "versionType": "git"
            },
            {
              "lessThan": "b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13",
              "status": "affected",
              "version": "9cc1c73ad66610bffc80b691136ffc1e9a3b1a58",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.234",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.177",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.125",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.72",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: clamp maximum hashtable size to INT_MAX\n\nUse INT_MAX as maximum size for the conntrack hashtable. Otherwise, it\nis possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when\nresizing hashtable because __GFP_NOWARN is unset. See:\n\n  0708a0afe291 (\"mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls\")\n\nNote: hashtable resize is only possible from init_netns."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:03:44.670Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a965f7f0ea3ae61b9165bed619d5d6da02c75f80"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1b2353d768f1b80cd7fe045a70adee576b9b338"
        },
        {
          "url": "https://git.kernel.org/stable/c/5552b4fd44be3393b930434a7845d8d95a2a3c33"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5807dd1328bbc86e059c5de80d1bbee9d58ca3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f559357d035877b9d0dcd273e0ff83e18e1d46aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13"
        }
      ],
      "title": "netfilter: conntrack: clamp maximum hashtable size to INT_MAX",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21648",
    "datePublished": "2025-01-19T10:18:05.700Z",
    "dateReserved": "2024-12-29T08:45:45.728Z",
    "dateUpdated": "2026-09-08T08:40:13.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21691 (GCVE-0-2025-21691)

Vulnerability from cvelistv5 – Published: 2025-02-10 15:58 – Updated: 2026-05-11 21:04

Title

cachestat: fix page cache statistics permission checking

Summary

Severity

No CVSS data available.

Assigner

Linux mitre root Scorecard

References

4 references

URL	Tags
https://git.kernel.org/stable/c/7d6405c13b0d8a836…
https://git.kernel.org/stable/c/780ab832967246498…
https://git.kernel.org/stable/c/97153a05077f618f7…
https://git.kernel.org/stable/c/5f537664e705b0bf8…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < 7d6405c13b0d8a8367cd8df63f118b619a3f0dd2 (git) Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < 780ab8329672464984cf1344bd5c3993af0226c7 (git) Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < 97153a05077f618f7471f50a78158602badccb30 (git) Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < 5f537664e705b0bf8b7e329861f20128534f6a83 (git)
Linux	Linux	Affected: 6.5 Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.75 , ≤ 6.6.* (semver) Unaffected: 6.12.12 , ≤ 6.12.* (semver) Unaffected: 6.13.1 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d6405c13b0d8a8367cd8df63f118b619a3f0dd2",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "780ab8329672464984cf1344bd5c3993af0226c7",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "97153a05077f618f7471f50a78158602badccb30",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "5f537664e705b0bf8b7e329861f20128534f6a83",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.75",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.12",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.1",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachestat: fix page cache statistics permission checking\n\nWhen the \u0027cachestat()\u0027 system call was added in commit cf264e1329fb\n(\"cachestat: implement cachestat syscall\"), it was meant to be a much\nmore convenient (and performant) version of mincore() that didn\u0027t need\nmapping things into the user virtual address space in order to work.\n\nBut it ended up missing the \"check for writability or ownership\" fix for\nmincore(), done in commit 134fca9063ad (\"mm/mincore.c: make mincore()\nmore conservative\").\n\nThis just adds equivalent logic to \u0027cachestat()\u0027, modified for the file\ncontext (rather than vma)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:04:33.709Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d6405c13b0d8a8367cd8df63f118b619a3f0dd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/780ab8329672464984cf1344bd5c3993af0226c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/97153a05077f618f7471f50a78158602badccb30"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f537664e705b0bf8b7e329861f20128534f6a83"
        }
      ],
      "title": "cachestat: fix page cache statistics permission checking",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21691",
    "datePublished": "2025-02-10T15:58:47.219Z",
    "dateReserved": "2024-12-29T08:45:45.742Z",
    "dateUpdated": "2026-05-11T21:04:33.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23191 (GCVE-0-2026-23191)

Vulnerability from cvelistv5 – Published: 2026-02-14 16:27 – Updated: 2026-09-14 11:58

Title

ALSA: aloop: Fix racy access at PCM trigger

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-16 20:20 UTC

Assigner

Linux mitre root Scorecard

References

7 references

URL	Tags
https://git.kernel.org/stable/c/f57467114f40c5aac…
https://git.kernel.org/stable/c/c99be0d5af02adebe…
https://git.kernel.org/stable/c/f3ce8be893726899e…
https://git.kernel.org/stable/c/0e6245b2424d126ac…
https://git.kernel.org/stable/c/bad15420050db1803…
https://git.kernel.org/stable/c/5727ccf9d19ca414c…
https://git.kernel.org/stable/c/826af7fa62e347464…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b1c73fc8e697eb73e23603e465e9af2711ed4183 , < f57467114f40c5aacebbea96fb4ff9e5cd2b7f18 (git) Affected: b1c73fc8e697eb73e23603e465e9af2711ed4183 , < c99be0d5af02adebe9cb6f9869d20397fa9935a3 (git) Affected: b1c73fc8e697eb73e23603e465e9af2711ed4183 , < f3ce8be893726899e3053cf8059ecc95d8410359 (git) Affected: b1c73fc8e697eb73e23603e465e9af2711ed4183 , < 0e6245b2424d126ac90018142d09f0707e12998b (git) Affected: b1c73fc8e697eb73e23603e465e9af2711ed4183 , < bad15420050db1803767e58756114800cce91ea4 (git) Affected: b1c73fc8e697eb73e23603e465e9af2711ed4183 , < 5727ccf9d19ca414cb76d9b647883822e2789c2e (git) Affected: b1c73fc8e697eb73e23603e465e9af2711ed4183 , < 826af7fa62e347464b1b4e0ba2fe19a92438084f (git)
Linux	Linux	Affected: 2.6.37 Unaffected: 0 , < 2.6.37 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.70 , ≤ 6.12.* (semver) Unaffected: 6.18.10 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23191",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T20:20:28.206628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T20:20:36.627Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/drivers/aloop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f57467114f40c5aacebbea96fb4ff9e5cd2b7f18",
              "status": "affected",
              "version": "b1c73fc8e697eb73e23603e465e9af2711ed4183",
              "versionType": "git"
            },
            {
              "lessThan": "c99be0d5af02adebe9cb6f9869d20397fa9935a3",
              "status": "affected",
              "version": "b1c73fc8e697eb73e23603e465e9af2711ed4183",
              "versionType": "git"
            },
            {
              "lessThan": "f3ce8be893726899e3053cf8059ecc95d8410359",
              "status": "affected",
              "version": "b1c73fc8e697eb73e23603e465e9af2711ed4183",
              "versionType": "git"
            },
            {
              "lessThan": "0e6245b2424d126ac90018142d09f0707e12998b",
              "status": "affected",
              "version": "b1c73fc8e697eb73e23603e465e9af2711ed4183",
              "versionType": "git"
            },
            {
              "lessThan": "bad15420050db1803767e58756114800cce91ea4",
              "status": "affected",
              "version": "b1c73fc8e697eb73e23603e465e9af2711ed4183",
              "versionType": "git"
            },
            {
              "lessThan": "5727ccf9d19ca414cb76d9b647883822e2789c2e",
              "status": "affected",
              "version": "b1c73fc8e697eb73e23603e465e9af2711ed4183",
              "versionType": "git"
            },
            {
              "lessThan": "826af7fa62e347464b1b4e0ba2fe19a92438084f",
              "status": "affected",
              "version": "b1c73fc8e697eb73e23603e465e9af2711ed4183",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/drivers/aloop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.37"
            },
            {
              "lessThan": "2.6.37",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.70",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: aloop: Fix racy access at PCM trigger\n\nThe PCM trigger callback of aloop driver tries to check the PCM state\nand stop the stream of the tied substream in the corresponding cable.\nSince both check and stop operations are performed outside the cable\nlock, this may result in UAF when a program attempts to trigger\nfrequently while opening/closing the tied stream, as spotted by\nfuzzers.\n\nFor addressing the UAF, this patch changes two things:\n- It covers the most of code in loopback_check_format() with\n  cable-\u003elock spinlock, and add the proper NULL checks.  This avoids\n  already some racy accesses.\n- In addition, now we try to check the state of the capture PCM stream\n  that may be stopped in this function, which was the major pain point\n  leading to UAF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is in the ALSA aloop PCM driver, accessed through local sound device files (/dev/snd/pcmC*D*p and /dev/snd/pcmC*D*c). No network or adjacent access path exists.\nAC:L - The attacker fully controls both sides of the race condition \u2014 they can concurrently trigger PCM start on one substream while closing the paired substream. The race is reliably winnable by the attacker, as confirmed by syzbot reproducibility.\nPR:L - Accessing ALSA PCM device files requires a local unprivileged user with audio group membership or equivalent permissions, which is standard on desktop Linux and Android. The snd-aloop module must be loaded, but no root/admin privileges are required to trigger the bug once available.\nUI:N - No user interaction is required. The attacker can open, trigger, and close PCM substreams entirely on their own.\nS:U - The vulnerability and its impact remain within the kernel\u0027s security authority. There is no crossing of a security boundary such as a VM escape or sandbox escape.\nC:H - This is a use-after-free vulnerability where freed loopback_pcm and runtime structures are dereferenced. An attacker can reclaim the freed memory with controlled data, enabling arbitrary kernel memory reads.\nI:H - The UAF allows the attacker to reclaim freed heap objects via heap spraying, providing arbitrary write primitives and potential control flow hijacking through corrupted function pointers in the loopback_pcm or runtime structures.\nA:H - The use-after-free reliably causes kernel crashes (oops/panic) when the freed memory is accessed, as demonstrated by the syzbot fuzzer report."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:58:11.809Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f57467114f40c5aacebbea96fb4ff9e5cd2b7f18"
        },
        {
          "url": "https://git.kernel.org/stable/c/c99be0d5af02adebe9cb6f9869d20397fa9935a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3ce8be893726899e3053cf8059ecc95d8410359"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e6245b2424d126ac90018142d09f0707e12998b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bad15420050db1803767e58756114800cce91ea4"
        },
        {
          "url": "https://git.kernel.org/stable/c/5727ccf9d19ca414cb76d9b647883822e2789c2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/826af7fa62e347464b1b4e0ba2fe19a92438084f"
        }
      ],
      "title": "ALSA: aloop: Fix racy access at PCM trigger",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23191",
    "datePublished": "2026-02-14T16:27:18.882Z",
    "dateReserved": "2026-01-13T15:37:45.985Z",
    "dateUpdated": "2026-09-14T11:58:11.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-31669 (GCVE-0-2026-31669)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:45 – Updated: 2026-09-08 08:47

Title

mptcp: fix slab-use-after-free in __inet_lookup_established

Summary

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side critical sections. Both tcp_prot and tcpv6_prot have their slab caches created with this flag via proto_register(). However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into tcpv6_prot_override during inet_init() (fs_initcall, level 5), before inet6_init() (module_init/device_initcall, level 6) has called proto_register(&tcpv6_prot). At that point, tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab remains NULL permanently. This causes MPTCP v6 subflow child sockets to be allocated via kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so when these sockets are freed without SOCK_RCU_FREE (which is cleared for child sockets by design), the memory can be immediately reused. Concurrent ehash lookups under rcu_read_lock can then access freed memory, triggering a slab-use-after-free in __inet_lookup_established. Fix this by splitting the IPv6-specific initialization out of mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called from mptcp_proto_v6_init() before protocol registration. This ensures tcpv6_prot_override.slab correctly inherits the SLAB_TYPESAFE_BY_RCU slab cache.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

9 references

URL	Tags
https://git.kernel.org/stable/c/f6e1f25fa5e733570…
https://git.kernel.org/stable/c/fb1f54b7d16f393b8…
https://git.kernel.org/stable/c/3fd6547f5b8ac9968…
https://git.kernel.org/stable/c/eb9c6aeb512f877cf…
https://git.kernel.org/stable/c/15fa9ead4d5e6b6b9…
https://git.kernel.org/stable/c/b313e9037d98c1393…
https://git.kernel.org/stable/c/9b55b253907e74312…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

8 products

Vendor	Product	Version
Linux	Linux	Affected: b19bc2945b40b9fd38e835700907ffe8534ef0de , < f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47 (git) Affected: b19bc2945b40b9fd38e835700907ffe8534ef0de , < fb1f54b7d16f393b8b65d328410f78b4beea8fcc (git) Affected: b19bc2945b40b9fd38e835700907ffe8534ef0de , < 3fd6547f5b8ac99687be6d937a0321efda760597 (git) Affected: b19bc2945b40b9fd38e835700907ffe8534ef0de , < eb9c6aeb512f877cf397deb1e4526f646c70e4a7 (git) Affected: b19bc2945b40b9fd38e835700907ffe8534ef0de , < 15fa9ead4d5e6b6b9c794e84144146c917f2cb62 (git) Affected: b19bc2945b40b9fd38e835700907ffe8534ef0de , < b313e9037d98c13938740e5ebda7852929366dff (git) Affected: b19bc2945b40b9fd38e835700907ffe8534ef0de , < 9b55b253907e7431210483519c5ad711a37dafa1 (git)
Linux	Linux	Affected: 5.12 Unaffected: 0 , < 5.12 (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.169 , ≤ 6.1.* (semver) Unaffected: 6.6.135 , ≤ 6.6.* (semver) Unaffected: 6.12.82 , ≤ 6.12.* (semver) Unaffected: 6.18.23 , ≤ 6.18.* (semver) Unaffected: 6.19.13 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:47:59.039Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c",
            "net/mptcp/protocol.h",
            "net/mptcp/subflow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            },
            {
              "lessThan": "fb1f54b7d16f393b8b65d328410f78b4beea8fcc",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            },
            {
              "lessThan": "3fd6547f5b8ac99687be6d937a0321efda760597",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            },
            {
              "lessThan": "eb9c6aeb512f877cf397deb1e4526f646c70e4a7",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            },
            {
              "lessThan": "15fa9ead4d5e6b6b9c794e84144146c917f2cb62",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            },
            {
              "lessThan": "b313e9037d98c13938740e5ebda7852929366dff",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            },
            {
              "lessThan": "9b55b253907e7431210483519c5ad711a37dafa1",
              "status": "affected",
              "version": "b19bc2945b40b9fd38e835700907ffe8534ef0de",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c",
            "net/mptcp/protocol.h",
            "net/mptcp/subflow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.135",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.82",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix slab-use-after-free in __inet_lookup_established\n\nThe ehash table lookups are lockless and rely on\nSLAB_TYPESAFE_BY_RCU to guarantee socket memory stability\nduring RCU read-side critical sections. Both tcp_prot and\ntcpv6_prot have their slab caches created with this flag\nvia proto_register().\n\nHowever, MPTCP\u0027s mptcp_subflow_init() copies tcpv6_prot into\ntcpv6_prot_override during inet_init() (fs_initcall, level 5),\nbefore inet6_init() (module_init/device_initcall, level 6) has\ncalled proto_register(\u0026tcpv6_prot). At that point,\ntcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab\nremains NULL permanently.\n\nThis causes MPTCP v6 subflow child sockets to be allocated via\nkmalloc (falling into kmalloc-4k) instead of the TCPv6 slab\ncache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so\nwhen these sockets are freed without SOCK_RCU_FREE (which is\ncleared for child sockets by design), the memory can be\nimmediately reused. Concurrent ehash lookups under\nrcu_read_lock can then access freed memory, triggering a\nslab-use-after-free in __inet_lookup_established.\n\nFix this by splitting the IPv6-specific initialization out of\nmptcp_subflow_init() into a new mptcp_subflow_v6_init(), called\nfrom mptcp_proto_v6_init() before protocol registration. This\nensures tcpv6_prot_override.slab correctly inherits the\nSLAB_TYPESAFE_BY_RCU slab cache."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote IPv6 TCP/MPTCP packets reach `tcp_v6_rcv()` and its lockless established-socket ehash lookup through the normal network receive path. A reachable IPv6 MPTCP service can be exercised over the network without local execution.\nAC:L - The vulnerability is a race between freeing an MPTCP IPv6 child socket and concurrent ehash lookup, but the attacker can drive both sides by repeatedly creating/closing MPTCP connections or subflows while sending packets. Under the required rule, this attacker-controlled race is Low complexity.\nPR:N - No local account, capability, namespace setup, or protocol authentication is needed to send the packets that reach the vulnerable receive path. The only environmental requirement is a reachable MPTCP IPv6 listener.\nUI:N - No victim user action is required after the vulnerable service is listening. Network traffic alone can trigger allocation, teardown, and lookup of the affected sockets.\nS:U - The flaw is in the kernel networking stack and impacts kernel-managed resources within the same security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - This is a kernel heap use-after-free where freed socket memory can be immediately reused while lockless lookup still dereferences it. Such UAF conditions are defensibly capable of exposing kernel memory or primitives useful for broader disclosure.\nI:H - The stale socket pointer can reference attacker-influenced reused kmalloc memory during refcounting and socket processing. Kernel heap UAF is treated as high integrity impact because it can plausibly be developed into write/control-flow corruption.\nA:H - The reported condition is a slab-use-after-free in `__inet_lookup_established`, which can crash or oops the kernel. A remote attacker can trigger it repeatedly against a reachable affected service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:19.282Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb1f54b7d16f393b8b65d328410f78b4beea8fcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fd6547f5b8ac99687be6d937a0321efda760597"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb9c6aeb512f877cf397deb1e4526f646c70e4a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/15fa9ead4d5e6b6b9c794e84144146c917f2cb62"
        },
        {
          "url": "https://git.kernel.org/stable/c/b313e9037d98c13938740e5ebda7852929366dff"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b55b253907e7431210483519c5ad711a37dafa1"
        }
      ],
      "title": "mptcp: fix slab-use-after-free in __inet_lookup_established",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31669",
    "datePublished": "2026-04-24T14:45:17.295Z",
    "dateReserved": "2026-03-09T15:48:24.130Z",
    "dateUpdated": "2026-09-08T08:47:59.039Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43027 (GCVE-0-2026-43027)

Vulnerability from cvelistv5 – Published: 2026-05-01 14:15 – Updated: 2026-09-08 08:48

Title

netfilter: nf_conntrack_helper: pass helper to expect cleanup

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() to remove expectations belonging to the helper being unregistered. However, it passes NULL instead of the helper pointer as the data argument, so expect_iter_me() never matches any expectation and all of them survive the cleanup. After unregister returns, nfnl_cthelper_del() frees the helper object immediately. Subsequent expectation dumps or packet-driven init_conntrack() calls then dereference the freed exp->helper, causing a use-after-free. Pass the actual helper pointer so expectations referencing it are properly destroyed before the helper object is freed. BUG: KASAN: slab-use-after-free in string+0x38f/0x430 Read of size 1 at addr ffff888003b14d20 by task poc/103 Call Trace: string+0x38f/0x430 vsnprintf+0x3cc/0x1170 seq_printf+0x17a/0x240 exp_seq_show+0x2e5/0x560 seq_read_iter+0x419/0x1280 proc_reg_read+0x1ac/0x270 vfs_read+0x179/0x930 ksys_read+0xef/0x1c0 Freed by task 103: The buggy address is located 32 bytes inside of freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)

Severity

No CVSS data available.

Assigner

Linux mitre root Scorecard

References

10 references

URL	Tags
https://git.kernel.org/stable/c/5cf28d5c8dcbbe8af…
https://git.kernel.org/stable/c/504ba4168466c9121…
https://git.kernel.org/stable/c/dc1739eff48e34cc7…
https://git.kernel.org/stable/c/2cf2737c85a2ba2b5…
https://git.kernel.org/stable/c/2c16e4d64dd912277…
https://git.kernel.org/stable/c/620f3d14c1ef51d42…
https://git.kernel.org/stable/c/90bd7e8501349db30…
https://git.kernel.org/stable/c/a242a9ae58aa46ff7…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

8 products

Vendor	Product	Version
Linux	Linux	Affected: ac7b848390036dadd4351899d2a23748075916bd , < 5cf28d5c8dcbbe8af6d3b145babe491906d7bad1 (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < 504ba4168466c91210c45acdc332479cfd5f2da6 (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < dc1739eff48e34cc71d4e2f03715493fbcebd8af (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < 2cf2737c85a2ba2b52024dafe68ffad2676f97be (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < 2c16e4d64dd91227742dfe196a3e7b0568bef65a (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < 620f3d14c1ef51d425060a3056ad8dbae8f998a3 (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < 90bd7e8501349db3006d21fbc09df9ffcb172965 (git) Affected: ac7b848390036dadd4351899d2a23748075916bd , < a242a9ae58aa46ff7dae51ce64150a93957abe65 (git)
Linux	Linux	Affected: 4.14 Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.253 , ≤ 5.10.* (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.12.81 , ≤ 6.12.* (semver) Unaffected: 6.18.22 , ≤ 6.18.* (semver) Unaffected: 6.19.12 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:48:27.805Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5cf28d5c8dcbbe8af6d3b145babe491906d7bad1",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "504ba4168466c91210c45acdc332479cfd5f2da6",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "dc1739eff48e34cc71d4e2f03715493fbcebd8af",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "2cf2737c85a2ba2b52024dafe68ffad2676f97be",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "2c16e4d64dd91227742dfe196a3e7b0568bef65a",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "620f3d14c1ef51d425060a3056ad8dbae8f998a3",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "90bd7e8501349db3006d21fbc09df9ffcb172965",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "a242a9ae58aa46ff7dae51ce64150a93957abe65",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_helper: pass helper to expect cleanup\n\nnf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy()\nto remove expectations belonging to the helper being unregistered.\nHowever, it passes NULL instead of the helper pointer as the data\nargument, so expect_iter_me() never matches any expectation and all\nof them survive the cleanup.\n\nAfter unregister returns, nfnl_cthelper_del() frees the helper\nobject immediately.  Subsequent expectation dumps or packet-driven\ninit_conntrack() calls then dereference the freed exp-\u003ehelper,\ncausing a use-after-free.\n\nPass the actual helper pointer so expectations referencing it are\nproperly destroyed before the helper object is freed.\n\n  BUG: KASAN: slab-use-after-free in string+0x38f/0x430\n  Read of size 1 at addr ffff888003b14d20 by task poc/103\n  Call Trace:\n   string+0x38f/0x430\n   vsnprintf+0x3cc/0x1170\n   seq_printf+0x17a/0x240\n   exp_seq_show+0x2e5/0x560\n   seq_read_iter+0x419/0x1280\n   proc_reg_read+0x1ac/0x270\n   vfs_read+0x179/0x930\n   ksys_read+0xef/0x1c0\n  Freed by task 103:\n  The buggy address is located 32 bytes inside of\n   freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:16:18.081Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5cf28d5c8dcbbe8af6d3b145babe491906d7bad1"
        },
        {
          "url": "https://git.kernel.org/stable/c/504ba4168466c91210c45acdc332479cfd5f2da6"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc1739eff48e34cc71d4e2f03715493fbcebd8af"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cf2737c85a2ba2b52024dafe68ffad2676f97be"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c16e4d64dd91227742dfe196a3e7b0568bef65a"
        },
        {
          "url": "https://git.kernel.org/stable/c/620f3d14c1ef51d425060a3056ad8dbae8f998a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/90bd7e8501349db3006d21fbc09df9ffcb172965"
        },
        {
          "url": "https://git.kernel.org/stable/c/a242a9ae58aa46ff7dae51ce64150a93957abe65"
        }
      ],
      "title": "netfilter: nf_conntrack_helper: pass helper to expect cleanup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43027",
    "datePublished": "2026-05-01T14:15:28.521Z",
    "dateReserved": "2026-05-01T14:12:55.976Z",
    "dateUpdated": "2026-09-08T08:48:27.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43125 (GCVE-0-2026-43125)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-08-25 12:05

Title

dlm: validate length in dlm_search_rsb_tree

Summary

In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-bounds write in dlm_search_rsb_tree(). Add length validation to prevent potential buffer overflow.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-130 - Improper Handling of Length Parameter Inconsistency

Assigner

Linux mitre root Scorecard

References

25 references

URL	Tags
https://git.kernel.org/stable/c/67288113c5e6cf9e6…
https://git.kernel.org/stable/c/082083c9fbd99422a…
https://git.kernel.org/stable/c/5f053a2e7209d326c…
https://git.kernel.org/stable/c/080e5563f878c64e6…
https://access.redhat.com/security/cve/CVE-2026-43125	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2467234	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:35844	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41236	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34095	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36767	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34094	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25217	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25121	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55762	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59091	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33899	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35863	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55761	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55837	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56224	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56225	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55763	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25120	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33900	vendor-advisoryx_refsource_REDHAT

Impacted products

23 products

Vendor	Product	Version
Linux	Linux	Affected: 7210cb7a72a22303cdb225bd1aea28697a17bbae , < 67288113c5e6cf9e659b4065c0ed6f16100e0c71 (git) Affected: 7210cb7a72a22303cdb225bd1aea28697a17bbae , < 082083c9fbd99422a0370fe2102144a231c9f5d6 (git) Affected: 7210cb7a72a22303cdb225bd1aea28697a17bbae , < 5f053a2e7209d326cbbc07738fa6d6893d307438 (git) Affected: 7210cb7a72a22303cdb225bd1aea28697a17bbae , < 080e5563f878c64e697b89e7439d730d0daad882 (git)
Linux	Linux	Affected: 3.4 Unaffected: 0 , < 3.4 (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.155.1.rt56.1307.el7 , < * (rpm) cpe:/a:redhat:rhel_extras_rt_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.154.1.el7 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.132.1.rt7.473.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.132.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.198.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.198.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.150.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.150.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.15.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.178.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.178.1.rt14.463.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.136.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.125.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	cpe:/o:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_extras_rt_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.155.1.rt56.1307.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.154.1.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.132.1.rt7.473.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.132.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.198.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.198.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.150.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.150.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.15.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.178.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.178.1.rt14.463.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.136.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.125.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-06T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Distributed Lock Manager (dlm) module. An attacker could send specially crafted network messages with an oversized length parameter to the dlm_dump_rsb_name() function. This lack of validation can lead to an out-of-bounds write in the dlm_search_rsb_tree() function, potentially causing a buffer overflow. This vulnerability could allow for denial of service or, in some cases, arbitrary code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-130",
                "description": "Improper Handling of Length Parameter Inconsistency",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T12:05:44.813Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-43125"
          },
          {
            "name": "RHBZ#2467234",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467234"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43125.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35844"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41236"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34095"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36767"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34094"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25217"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25121"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55762"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59091"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33899"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35863"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55761"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55837"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56224"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56225"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55763"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25120"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33900"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:35844: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34095: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36767: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34094: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25217: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25121: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55762: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59091: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33899: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35863: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55761: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55837: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56224: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56225: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55763: Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25120: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33900: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: dlm: validate length in dlm_search_rsb_tree",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/lock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "67288113c5e6cf9e659b4065c0ed6f16100e0c71",
              "status": "affected",
              "version": "7210cb7a72a22303cdb225bd1aea28697a17bbae",
              "versionType": "git"
            },
            {
              "lessThan": "082083c9fbd99422a0370fe2102144a231c9f5d6",
              "status": "affected",
              "version": "7210cb7a72a22303cdb225bd1aea28697a17bbae",
              "versionType": "git"
            },
            {
              "lessThan": "5f053a2e7209d326cbbc07738fa6d6893d307438",
              "status": "affected",
              "version": "7210cb7a72a22303cdb225bd1aea28697a17bbae",
              "versionType": "git"
            },
            {
              "lessThan": "080e5563f878c64e697b89e7439d730d0daad882",
              "status": "affected",
              "version": "7210cb7a72a22303cdb225bd1aea28697a17bbae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/lock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: validate length in dlm_search_rsb_tree\n\nThe len parameter in dlm_dump_rsb_name() is not validated and comes\nfrom network messages. When it exceeds DLM_RESNAME_MAXLEN, it can\ncause out-of-bounds write in dlm_search_rsb_tree().\n\nAdd length validation to prevent potential buffer overflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is reached by DLM recovery messages received over the kernel DLM TCP/SCTP lowcomms transport from a remote cluster peer. Although the peer address must match configured cluster membership, the bug is triggered by network protocol data delivered to the target kernel.\nAC:L - A remote peer that can send DLM recovery traffic controls the malformed RCOM_LOOKUP packet, including the special debug rc_id and oversized length/name payload. The recovery-state gate is a normal DLM condition that a participating peer can plausibly induce or target, so exploitation does not depend on conditions outside attacker control.\nPR:N - The vulnerable receive path does not require credentials or privileges on the target system before parsing the packet. Cluster peer/source-address admission is not a privilege on the vulnerable host, and there is no DLM authentication check before the oversized name reaches the copy.\nUI:N - No victim user action is required once the target DLM lockspace is active and receiving cluster traffic. The attacker sends the malformed recovery message directly.\nS:U - The impact is compromise or crash of the target kernel within the same security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary.\nC:H - The bug is a network-controlled stack buffer overflow in the kernel, copying up to socket-buffer-sized attacker data into a 64-byte resource-name key. Such memory corruption is defensibly exploitable for kernel information disclosure as part of code execution or memory disclosure primitives.\nI:H - The oversized memcpy can corrupt the kernel stack, including control data, from attacker-controlled network bytes. This supports arbitrary kernel memory modification or code execution in the highest reasonable scenario.\nA:H - Even without reliable code execution, the stack overflow can corrupt kernel control state and readily crash or panic the system. The malformed packet can be sent remotely whenever the vulnerable DLM receive path is reachable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:06.027Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/67288113c5e6cf9e659b4065c0ed6f16100e0c71"
        },
        {
          "url": "https://git.kernel.org/stable/c/082083c9fbd99422a0370fe2102144a231c9f5d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f053a2e7209d326cbbc07738fa6d6893d307438"
        },
        {
          "url": "https://git.kernel.org/stable/c/080e5563f878c64e697b89e7439d730d0daad882"
        }
      ],
      "title": "dlm: validate length in dlm_search_rsb_tree",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43125",
    "datePublished": "2026-05-06T11:27:10.903Z",
    "dateReserved": "2026-05-01T14:12:55.988Z",
    "dateUpdated": "2026-08-25T12:05:44.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43128 (GCVE-0-2026-43128)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-08-05 12:26

Title

RDMA/umem: Fix double dma_buf_unpin in failure path

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately unpinned but the umem_dmabuf->pinned flag is still set. Then, when ib_umem_release() is called, it calls ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again. Fix this by removing the immediate unpin upon failure and just let the ib_umem_release/revoke path handle it. This also ensures the proper unmap-unpin unwind ordering if the dmabuf_map_pages call happened to fail due to dma_resv_wait_timeout (and therefore has a non-NULL umem_dmabuf->sgt).

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

6 references

URL	Tags
https://git.kernel.org/stable/c/70542b69abff34d24…
https://git.kernel.org/stable/c/b324327ff6f48d806…
https://git.kernel.org/stable/c/ba3bf0f1bf1d5d040…
https://git.kernel.org/stable/c/d3e32e2f3262f1b25…
https://git.kernel.org/stable/c/40126bcbefa79ea86…
https://git.kernel.org/stable/c/104016eb671e19709…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1e4df4a21c5ac722df1099eee30cad9246c889b5 , < 70542b69abff34d24b11ae0bb200cc7a766d18df (git) Affected: 1e4df4a21c5ac722df1099eee30cad9246c889b5 , < b324327ff6f48d8065dca67eb3b91357e72726bd (git) Affected: 1e4df4a21c5ac722df1099eee30cad9246c889b5 , < ba3bf0f1bf1d5d0404678485e872980532fcc2c4 (git) Affected: 1e4df4a21c5ac722df1099eee30cad9246c889b5 , < d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf (git) Affected: 1e4df4a21c5ac722df1099eee30cad9246c889b5 , < 40126bcbefa79ea86672e05dae608596bab38319 (git) Affected: 1e4df4a21c5ac722df1099eee30cad9246c889b5 , < 104016eb671e19709721c1b0048dd912dc2e96be (git)
Linux	Linux	Affected: 5.16 Unaffected: 0 , < 5.16 (semver) Unaffected: 6.1.165 , ≤ 6.1.* (semver) Unaffected: 6.6.128 , ≤ 6.6.* (semver) Unaffected: 6.12.75 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/umem_dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "70542b69abff34d24b11ae0bb200cc7a766d18df",
              "status": "affected",
              "version": "1e4df4a21c5ac722df1099eee30cad9246c889b5",
              "versionType": "git"
            },
            {
              "lessThan": "b324327ff6f48d8065dca67eb3b91357e72726bd",
              "status": "affected",
              "version": "1e4df4a21c5ac722df1099eee30cad9246c889b5",
              "versionType": "git"
            },
            {
              "lessThan": "ba3bf0f1bf1d5d0404678485e872980532fcc2c4",
              "status": "affected",
              "version": "1e4df4a21c5ac722df1099eee30cad9246c889b5",
              "versionType": "git"
            },
            {
              "lessThan": "d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf",
              "status": "affected",
              "version": "1e4df4a21c5ac722df1099eee30cad9246c889b5",
              "versionType": "git"
            },
            {
              "lessThan": "40126bcbefa79ea86672e05dae608596bab38319",
              "status": "affected",
              "version": "1e4df4a21c5ac722df1099eee30cad9246c889b5",
              "versionType": "git"
            },
            {
              "lessThan": "104016eb671e19709721c1b0048dd912dc2e96be",
              "status": "affected",
              "version": "1e4df4a21c5ac722df1099eee30cad9246c889b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/umem_dmabuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Fix double dma_buf_unpin in failure path\n\nIn ib_umem_dmabuf_get_pinned_with_dma_device(), the call to\nib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf\nis immediately unpinned but the umem_dmabuf-\u003epinned flag is still\nset. Then, when ib_umem_release() is called, it calls\nib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.\n\nFix this by removing the immediate unpin upon failure and just let\nthe ib_umem_release/revoke path handle it. This also ensures the\nproper unmap-unpin unwind ordering if the dmabuf_map_pages call\nhappened to fail due to dma_resv_wait_timeout (and therefore has\na non-NULL umem_dmabuf-\u003esgt)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local RDMA uverbs ioctls such as dma-buf MR/CQ/DevX registration on /dev/infiniband/uverbs*, with a user-supplied dma-buf fd.\nAC:L - The attacker controls the ioctl inputs and dma-buf fd and can repeatedly drive the failure path after dma_buf_pin() succeeds; no uncontrollable race is required.\nPR:L - The uverbs device nodes are created mode 0666 and the relevant paths do not require CAP_* privileges, but the attacker still needs local unprivileged code execution and access to the device files.\nUI:N - No victim action is needed once the local attacker can issue the uverbs ioctl sequence.\nS:U - The impact remains within the kernel/device memory management security authority; this is not a VM escape or distinct authorization-domain boundary crossing.\nC:H - The double unpin can prematurely drop the exporter pin count while another active mapping of the same dma-buf still exists, allowing stale RDMA DMA mappings to read memory after the buffer is moved or reused.\nI:H - The same stale DMA mapping scenario can allow writes into moved or reused physical pages, giving a plausible high-impact memory corruption primitive.\nA:H - At minimum the double unpin reaches exporter/TTM WARN paths and corrupted pin/accounting state; with panic_on_warn or resulting stale-DMA corruption this can crash or destabilize the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:08.164Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/70542b69abff34d24b11ae0bb200cc7a766d18df"
        },
        {
          "url": "https://git.kernel.org/stable/c/b324327ff6f48d8065dca67eb3b91357e72726bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/40126bcbefa79ea86672e05dae608596bab38319"
        },
        {
          "url": "https://git.kernel.org/stable/c/104016eb671e19709721c1b0048dd912dc2e96be"
        }
      ],
      "title": "RDMA/umem: Fix double dma_buf_unpin in failure path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43128",
    "datePublished": "2026-05-06T11:27:17.474Z",
    "dateReserved": "2026-05-01T14:12:55.988Z",
    "dateUpdated": "2026-08-05T12:26:08.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43198 (GCVE-0-2026-43198)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-09-14 11:58

Title

tcp: fix potential race in tcp_v6_syn_recv_sock()

Summary

In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-821 - Incorrect Synchronization

Assigner

Linux mitre root Scorecard

References

25 references

URL	Tags
https://git.kernel.org/stable/c/aef4a9ae95d1bc4f7…
https://git.kernel.org/stable/c/dad1fe7db6c651913…
https://git.kernel.org/stable/c/a7e761ba55efaa9c4…
https://git.kernel.org/stable/c/cd644e6dc72eec8d9…
https://git.kernel.org/stable/c/9ed654e340f4c73bc…
https://git.kernel.org/stable/c/fe89b2f05b8548477…
https://git.kernel.org/stable/c/7178e2a8027423b2a…
https://git.kernel.org/stable/c/858d2a4f67ff69e64…
https://access.redhat.com/security/cve/CVE-2026-43198	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2467228	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:36216	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41236	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33215	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30129	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36073	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34443	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34094	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33285	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36349	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35896	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35894	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35863	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36348	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35904	vendor-advisoryx_refsource_REDHAT

Impacted products

21 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < aef4a9ae95d1bc4f7897065011e6261026719aeb (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dad1fe7db6c6519138430ac8f5e589c18f83bfc9 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a7e761ba55efaa9c49e0afdd304bb78167af3429 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cd644e6dc72eec8d9d988717ea1c54f8668ded69 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9ed654e340f4c73bc6f0af2fbc90ac293e645ce0 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < fe89b2f05b854847784f91127319172945c1fadd (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7178e2a8027423b2af17ab95df73a749a5b72e5b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 858d2a4f67ff69e645a43487ef7ea7f28f06deae (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.28.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.84.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.155.1.rt56.1307.el7 , < * (rpm) cpe:/a:redhat:rhel_extras_rt_els:7
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:3.10.0-1160.155.1.el7 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.140.1.rt7.481.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.140.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-305.197.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-305.197.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.199.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.199.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.150.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.150.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.20.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.179.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.179.1.rt14.464.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.135.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.125.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.28.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.84.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_extras_rt_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.155.1.rt56.1307.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:3.10.0-1160.155.1.el7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.140.1.rt7.481.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.140.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.197.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.197.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.199.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.199.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.150.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.150.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.20.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.179.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.179.1.rt14.464.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.135.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.125.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-06T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel. A race condition exists in the TCP (Transmission Control Protocol) IPv6 (Internet Protocol version 6) socket handling, specifically within the tcp_v6_syn_recv_sock() function. This occurs because a child socket becomes visible in the TCP hash table before its IPv6-specific information is fully initialized. A remote attacker could potentially exploit this timing window, leading to an unstable system state or unexpected behavior, which may result in a denial of service (DoS)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-821",
                "description": "Incorrect Synchronization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T12:04:45.125Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-43198"
          },
          {
            "name": "RHBZ#2467228",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467228"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43198.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36216"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41236"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33215"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30129"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36073"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34443"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34094"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33285"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36349"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35896"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35894"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35863"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36348"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35904"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:36216: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33215: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30129: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36073: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34443: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34094: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33285: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36349: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35896: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35894: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35863: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36348: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35904: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: tcp: fix potential race in tcp_v6_syn_recv_sock()",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/inet_connection_sock.h",
            "include/net/tcp.h",
            "net/ipv4/syncookies.c",
            "net/ipv4/tcp_fastopen.c",
            "net/ipv4/tcp_ipv4.c",
            "net/ipv4/tcp_minisocks.c",
            "net/ipv6/tcp_ipv6.c",
            "net/mptcp/subflow.c",
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aef4a9ae95d1bc4f7897065011e6261026719aeb",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "dad1fe7db6c6519138430ac8f5e589c18f83bfc9",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a7e761ba55efaa9c49e0afdd304bb78167af3429",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cd644e6dc72eec8d9d988717ea1c54f8668ded69",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9ed654e340f4c73bc6f0af2fbc90ac293e645ce0",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fe89b2f05b854847784f91127319172945c1fadd",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7178e2a8027423b2af17ab95df73a749a5b72e5b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "858d2a4f67ff69e645a43487ef7ea7f28f06deae",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/inet_connection_sock.h",
            "include/net/tcp.h",
            "net/ipv4/syncookies.c",
            "net/ipv4/tcp_fastopen.c",
            "net/ipv4/tcp_ipv4.c",
            "net/ipv4/tcp_minisocks.c",
            "net/ipv6/tcp_ipv6.c",
            "net/mptcp/subflow.c",
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix potential race in tcp_v6_syn_recv_sock()\n\nCode in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()\nis done too late.\n\nAfter tcp_v4_syn_recv_sock(), the child socket is already visible\nfrom TCP ehash table and other cpus might use it.\n\nSince newinet-\u003epinet6 is still pointing to the listener ipv6_pinfo\nbad things can happen as syzbot found.\n\nMove the problematic code in tcp_v6_mapped_child_init()\nand call this new helper from tcp_v4_syn_recv_sock() before\nthe ehash insertion.\n\nThis allows the removal of one tcp_sync_mss(), since\ntcp_v4_syn_recv_sock() will call it with the correct\ncontext."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An unauthenticated remote peer can reach this through ordinary IPv4 TCP packets delivered to a dual-stack IPv6 listener with IPV6_V6ONLY disabled, which is the default on Linux. The vulnerable path is in the packet receive and TCP handshake path before any application authentication.\nAC:L - The race can be exercised by driving many concurrent TCP handshakes and follow-up packets against the same listener, so the attacker controls the relevant network-side timing. Under the required conservative rule, this is Low complexity.\nPR:N - No local account, capability, or prior authentication is required to send TCP connection attempts to an exposed listening service. The vulnerable kernel code runs before the connection is handed to userspace.\nUI:N - No victim user action is needed beyond the target system already running a reachable dual-stack TCP listener. Packets alone trigger the vulnerable path.\nS:U - The impact remains within the target kernel and its networking state. This is not a VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The bug leaves a newly created child socket temporarily using the listener\u0027s IPv6 private pointer, allowing concurrent reads of the wrong kernel socket private area and associated pointer-bearing state. Conservatively, this kernel memory corruption/race is treated as capable of high confidentiality impact.\nI:H - Operations on the child can write through the stale pinet6 pointer into the listener\u0027s IPv6 state, and related cleanup paths can affect pointer-backed socket options. Conservatively, this is high integrity impact because kernel socket state can be corrupted.\nA:H - Corrupting or freeing the wrong socket IPv6 state can lead to kernel warnings, oopses, or crashes. The trigger can be repeated remotely with connection floods, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:58:18.188Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aef4a9ae95d1bc4f7897065011e6261026719aeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/dad1fe7db6c6519138430ac8f5e589c18f83bfc9"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7e761ba55efaa9c49e0afdd304bb78167af3429"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd644e6dc72eec8d9d988717ea1c54f8668ded69"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ed654e340f4c73bc6f0af2fbc90ac293e645ce0"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe89b2f05b854847784f91127319172945c1fadd"
        },
        {
          "url": "https://git.kernel.org/stable/c/7178e2a8027423b2af17ab95df73a749a5b72e5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/858d2a4f67ff69e645a43487ef7ea7f28f06deae"
        }
      ],
      "title": "tcp: fix potential race in tcp_v6_syn_recv_sock()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43198",
    "datePublished": "2026-05-06T11:28:05.569Z",
    "dateReserved": "2026-05-01T14:12:55.992Z",
    "dateUpdated": "2026-09-14T11:58:18.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43329 (GCVE-0-2026-43329)

Vulnerability from cvelistv5 – Published: 2026-05-08 13:31 – Updated: 2026-09-15 12:04

Title

netfilter: flowtable: strictly check for maximum number of actions

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethernet address) * SNAT (4 payload actions) * DNAT (4 payload actions) * Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing) for QinQ. * Redirect (1 action) Which makes 17, while the maximum is 16. But act_ct supports for tunnels actions too. Note that payload action operates at 32-bit word level, so mangling an IPv6 address takes 4 payload actions. Update flow_action_entry_next() calls to check for the maximum number of supported actions. While at it, rise the maximum number of actions per flow from 16 to 24 so this works fine with IPv6 setups.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Linux mitre root Scorecard

References

40 references

URL	Tags
https://git.kernel.org/stable/c/ead66c77303f760f6…
https://git.kernel.org/stable/c/fe9018d3e94329f19…
https://git.kernel.org/stable/c/5382bb03e9c33b089…
https://git.kernel.org/stable/c/57c78bd2e2dd08897…
https://git.kernel.org/stable/c/504c9456699dcf4d1…
https://git.kernel.org/stable/c/879959a7a2be814dd…
https://git.kernel.org/stable/c/76522fcdbc3a02b56…
https://access.redhat.com/security/cve/CVE-2026-43329	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2468124	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:47702	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54187	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43252	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56911	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56853	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47727	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44230	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44231	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44259	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40764	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33215	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:23329	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34095	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27713	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34094	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:30848	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55618	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26427	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55762	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35896	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33899	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35863	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55761	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55837	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56224	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56225	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55763	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26428	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33900	vendor-advisoryx_refsource_REDHAT

Impacted products

39 products

Vendor	Product	Version
Linux	Linux	Affected: c29f74e0df7a02b8303bcdce93a7c0132d62577a , < ead66c77303f760f6c30be96e2e20d5a77cef614 (git) Affected: c29f74e0df7a02b8303bcdce93a7c0132d62577a , < fe9018d3e94329f1951b00805a8640bc06f56ead (git) Affected: c29f74e0df7a02b8303bcdce93a7c0132d62577a , < 5382bb03e9c33b089d60788478b922a2dca284cc (git) Affected: c29f74e0df7a02b8303bcdce93a7c0132d62577a , < 57c78bd2e2dd08897acd35b2bf8bcef322e36f5e (git) Affected: c29f74e0df7a02b8303bcdce93a7c0132d62577a , < 504c9456699dcf4d15195ef34a0fa94a80bfc877 (git) Affected: c29f74e0df7a02b8303bcdce93a7c0132d62577a , < 879959a7a2be814dd57568655eafa3d8f4d0309e (git) Affected: c29f74e0df7a02b8303bcdce93a7c0132d62577a , < 76522fcdbc3a02b568f5d957f7e66fc194abb893 (git)
Linux	Linux	Affected: 5.5 Unaffected: 0 , < 5.5 (semver) Unaffected: 5.15.203 , ≤ 5.15.* (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.12.81 , ≤ 6.12.* (semver) Unaffected: 6.18.22 , ≤ 6.18.* (semver) Unaffected: 6.19.12 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.20.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.84.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.134.1.rt7.475.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.134.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-305.197.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-305.197.1.el8_4 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.198.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.198.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.150.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.150.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.19.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.178.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.178.1.rt14.463.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.134.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.125.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	cpe:/o:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202607211933-0 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 413.92.202608111330-0 , < * (rpm) cpe:/a:redhat:openshift:4.13::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 414.92.202607210313-0 , < * (rpm) cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 415.92.202608180329-0 , < * (rpm) cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 416.94.202608150307-0 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202607240132-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202607211754-0 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202607220857-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 4.20.9.6.202607221038-0 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 4.21.9.6.202607221317-0 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.22	Unaffected: 4.22.9.8.202607152026-0 , < * (rpm) cpe:/a:redhat:openshift:4.22::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.20.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.84.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.134.1.rt7.475.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.134.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.197.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-305.197.1.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.198.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.198.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.150.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.150.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.19.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.178.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.178.1.rt14.463.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.134.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.125.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "412.86.202607211933-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "413.92.202608111330-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "414.92.202607210313-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "415.92.202608180329-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "416.94.202608150307-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "417.94.202607240132-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "418.94.202607211754-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202607220857-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.20.9.6.202607221038-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.21.9.6.202607221317-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.22.9.8.202607152026-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "libkrun",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-08T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Netfilter flowtable component of the Linux kernel. This vulnerability occurs because the system does not strictly check the maximum number of hardware offload actions for IPv6, allowing it to process more actions than supported. This could potentially lead to system instability or a denial of service (DoS) condition, where the affected system becomes unresponsive."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:04:27.704Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-43329"
          },
          {
            "name": "RHBZ#2468124",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468124"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43329.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47702"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54187"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43252"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56911"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56853"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47727"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44230"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44231"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44259"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44262"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40764"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33215"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23329"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34095"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27713"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34094"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:30848"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55618"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26427"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55762"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35896"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33899"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35863"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55761"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55837"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56224"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56225"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55763"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26428"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33900"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:47702: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54187: Red Hat OpenShift Container Platform 4.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43252: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56911: Red Hat OpenShift Container Platform 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56853: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47727: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44230: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44231: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44259: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44262: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40764: Red Hat OpenShift Container Platform 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33215: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23329: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34095: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27713: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34094: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:30848: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55618: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26427: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55762: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35896: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33899: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35863: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55761: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55837: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56224: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56225: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55763: Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26428: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33900: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-08T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-08T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: netfilter: flowtable: strictly check for maximum number of actions",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ead66c77303f760f6c30be96e2e20d5a77cef614",
              "status": "affected",
              "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
              "versionType": "git"
            },
            {
              "lessThan": "fe9018d3e94329f1951b00805a8640bc06f56ead",
              "status": "affected",
              "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
              "versionType": "git"
            },
            {
              "lessThan": "5382bb03e9c33b089d60788478b922a2dca284cc",
              "status": "affected",
              "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
              "versionType": "git"
            },
            {
              "lessThan": "57c78bd2e2dd08897acd35b2bf8bcef322e36f5e",
              "status": "affected",
              "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
              "versionType": "git"
            },
            {
              "lessThan": "504c9456699dcf4d15195ef34a0fa94a80bfc877",
              "status": "affected",
              "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
              "versionType": "git"
            },
            {
              "lessThan": "879959a7a2be814dd57568655eafa3d8f4d0309e",
              "status": "affected",
              "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
              "versionType": "git"
            },
            {
              "lessThan": "76522fcdbc3a02b568f5d957f7e66fc194abb893",
              "status": "affected",
              "version": "c29f74e0df7a02b8303bcdce93a7c0132d62577a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: strictly check for maximum number of actions\n\nThe maximum number of flowtable hardware offload actions in IPv6 is:\n\n* ethernet mangling (4 payload actions, 2 for each ethernet address)\n* SNAT (4 payload actions)\n* DNAT (4 payload actions)\n* Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing)\n  for QinQ.\n* Redirect (1 action)\n\nWhich makes 17, while the maximum is 16. But act_ct supports for tunnels\nactions too. Note that payload action operates at 32-bit word level, so\nmangling an IPv6 address takes 4 payload actions.\n\nUpdate flow_action_entry_next() calls to check for the maximum number of\nsupported actions.\n\nWhile at it, rise the maximum number of actions per flow from 16 to 24\nso this works fine with IPv6 setups."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable flowtable offload action array is reached through local netfilter/nftables or tc netlink configuration and packet-triggered flow offload work. A remote packet can trigger an already configured flow, but creating the vulnerable offload setup is a local control-plane action.\nAC:L - There is no race or probabilistic condition; once the attacker can create the qualifying IPv6/NAT/VLAN/tunnel hardware-offload flowtable setup, creating a flow reliably drives action allocation past the old bound. The required action combination is complex but attacker-controlled in the local netlink setup.\nPR:L - nfnetlink/rtnetlink require CAP_NET_ADMIN, but this is reachable as a low-privileged local user in a user and network namespace where CAP_NET_ADMIN is granted. It does not require real init-namespace root in the highest defensible local scenario.\nUI:N - No victim user action is required after the attacker configures the local netfilter/tc objects. The attacker can generate the traffic needed to instantiate the flow.\nS:U - The corruption occurs inside the kernel networking/offload subsystem and impacts the same kernel security authority. This is standard kernel memory corruption, not a cross-scope escape such as guest-to-host.\nC:H - The bug is a slab out-of-bounds write past a flex-array of flow_action_entry objects. Kernel heap memory corruption is defensibly exploitable for information disclosure primitives.\nI:H - The unchecked append writes attacker-influenced flow_action_entry fields beyond the allocated action array. Such kernel heap out-of-bounds writes are defensibly exploitable for arbitrary memory corruption or code execution.\nA:H - Even without full exploitation, writing past the allocated flow action array can corrupt adjacent kernel heap objects and cause an oops or panic. Repeated triggering can therefore cause high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:15.192Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ead66c77303f760f6c30be96e2e20d5a77cef614"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe9018d3e94329f1951b00805a8640bc06f56ead"
        },
        {
          "url": "https://git.kernel.org/stable/c/5382bb03e9c33b089d60788478b922a2dca284cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/57c78bd2e2dd08897acd35b2bf8bcef322e36f5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/504c9456699dcf4d15195ef34a0fa94a80bfc877"
        },
        {
          "url": "https://git.kernel.org/stable/c/879959a7a2be814dd57568655eafa3d8f4d0309e"
        },
        {
          "url": "https://git.kernel.org/stable/c/76522fcdbc3a02b568f5d957f7e66fc194abb893"
        }
      ],
      "title": "netfilter: flowtable: strictly check for maximum number of actions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43329",
    "datePublished": "2026-05-08T13:31:17.479Z",
    "dateReserved": "2026-05-01T14:12:56.002Z",
    "dateUpdated": "2026-09-15T12:04:27.704Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43414 (GCVE-0-2026-43414)

Vulnerability from cvelistv5 – Published: 2026-05-08 14:21 – Updated: 2026-08-05 12:27

Title

scsi: qla2xxx: Completely fix fcport double free

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference. qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport(). Doing it one more time after kref_put() is a bad idea.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

2 references

URL	Tags
https://git.kernel.org/stable/c/d48ea85463f5b34f7…
https://git.kernel.org/stable/c/c0b7da13a04bd70ef…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4895009c4bb72f71f2e682f1e7d2c2d96e482087 , < d48ea85463f5b34f7b92ea0a13eddf1ab993da7b (git) Affected: 4895009c4bb72f71f2e682f1e7d2c2d96e482087 , < c0b7da13a04bd70ef6070bfb9ea85f582294560a (git) Affected: 7861213201838480dc222634c56fb6db113d010d (git) Affected: 3b9d72442adfbc9ddb0f76dd1b03977b3a578b16 (git) Affected: ef23850940d9a52c39936d27254824ccf5e9b6bd (git) Affected: 6c6bf6cacf9461f8d301cfac4f9c175d80cbcc63 (git) Affected: cd10dee1f07a782f5aa05703c55299ca86a85ee4 (git) Affected: b03e626bd6d3f0684f56ee1890d70fc9ca991c04 (git) Affected: 282877633b25d67021a34169c5b5519b1d4ef65e (git) Affected: f85af9f1aa5e2f53694a6cbe72010f754b5ff862 (git) Affected: 9b43d2884b54d415caab48878b526dfe2ae9921b (git) Affected: 846fb9f112f618ec6ae181d8dae7961652574774 (git) Affected: 5.15.154 , < 5.16 (semver) Affected: 6.1.84 , < 6.2 (semver) Affected: 6.6.24 , < 6.7 (semver) Affected: 6.7.12 , < 6.8 (semver) Affected: 6.8.3 , < 6.9 (semver)
Linux	Linux	Affected: 6.9 Unaffected: 0 , < 6.9 (semver) Unaffected: 6.19.9 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_iocb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d48ea85463f5b34f7b92ea0a13eddf1ab993da7b",
              "status": "affected",
              "version": "4895009c4bb72f71f2e682f1e7d2c2d96e482087",
              "versionType": "git"
            },
            {
              "lessThan": "c0b7da13a04bd70ef6070bfb9ea85f582294560a",
              "status": "affected",
              "version": "4895009c4bb72f71f2e682f1e7d2c2d96e482087",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7861213201838480dc222634c56fb6db113d010d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3b9d72442adfbc9ddb0f76dd1b03977b3a578b16",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ef23850940d9a52c39936d27254824ccf5e9b6bd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6c6bf6cacf9461f8d301cfac4f9c175d80cbcc63",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cd10dee1f07a782f5aa05703c55299ca86a85ee4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b03e626bd6d3f0684f56ee1890d70fc9ca991c04",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "282877633b25d67021a34169c5b5519b1d4ef65e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f85af9f1aa5e2f53694a6cbe72010f754b5ff862",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b43d2884b54d415caab48878b526dfe2ae9921b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "846fb9f112f618ec6ae181d8dae7961652574774",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_iocb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.154",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.154",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Completely fix fcport double free\n\nIn qla24xx_els_dcmd_iocb() sp-\u003efree is set to qla2x00_els_dcmd_sp_free().\nWhen an error happens, this function is called by qla2x00_sp_release(),\nwhen kref_put() releases the first and the last reference.\n\nqla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport().\nDoing it one more time after kref_put() is a bad idea."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable ELS direct-command path is reachable from a remote Fibre Channel initiator through qla2xxx target-mode ELS/session-deletion handling, not only through the root-only sysfs issue_logo knob. Using the highest reasonable SAN deployment, attacker-controlled FC frames from another host on the storage fabric make this network-reachable.\nAC:L - The bug is a deterministic double free once the ELS direct-command error path is hit after kref_put(), and the attacker can plausibly drive repeated logins/logouts/session teardown plus resource pressure to make qla2x00_start_sp() fail. No uncontrollable race is required for the memory corruption once that path is reached.\nPR:N - The FC target path processes remote ELS events before any Linux credential or capability check on the victim, so the attacker does not need a local account or kernel privilege. Fabric access/zoning is environmental network access, not privileges on the vulnerable system.\nUI:N - No victim user action is required; remote FC protocol activity can drive the target-mode session deletion and LOGO path. The sysfs path requires an admin write, but it is not the highest-severity reachable path.\nS:U - The corruption occurs inside the same kernel/driver security authority and does not cross a VM, IOMMU, or other separate security boundary. A kernel compromise or crash remains unchanged scope.\nC:H - This is kernel heap double-free/use-after-free style memory corruption of an fc_port object. Under the required overestimation rule, such corruption can be leveraged for information disclosure through heap reuse/read primitives.\nI:H - A double free of a kernel heap object can corrupt allocator state or enable controlled reuse of freed memory, making arbitrary write or control-flow compromise defensible. Therefore integrity impact is High.\nA:H - Related qla2xxx fcport double-free reports show immediate SLUB/kernel BUG crashes, and this fix removes another remaining double-free error path. A remotely triggerable kernel crash is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:52.557Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d48ea85463f5b34f7b92ea0a13eddf1ab993da7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0b7da13a04bd70ef6070bfb9ea85f582294560a"
        }
      ],
      "title": "scsi: qla2xxx: Completely fix fcport double free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43414",
    "datePublished": "2026-05-08T14:21:51.604Z",
    "dateReserved": "2026-05-01T14:12:56.008Z",
    "dateUpdated": "2026-08-05T12:27:52.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:34094

CVE-2025-21648 (GCVE-0-2025-21648)

CVE-2025-21691 (GCVE-0-2025-21691)

CVE-2026-23191 (GCVE-0-2026-23191)

CVE-2026-31669 (GCVE-0-2026-31669)

CVE-2026-43027 (GCVE-0-2026-43027)

CVE-2026-43125 (GCVE-0-2026-43125)

CVE-2026-43128 (GCVE-0-2026-43128)

CVE-2026-43198 (GCVE-0-2026-43198)

CVE-2026-43329 (GCVE-0-2026-43329)

CVE-2026-43414 (GCVE-0-2026-43414)

Tags

Sightings

Nomenclature

Related by attack behaviour