Vulnerability-Lookup

RHSA-2026:82806

Vulnerability from csaf_redhat - Published: 2026-10-14 09:05 - Updated: 2026-10-20 04:43

Summary

Red Hat Security Advisory: kernel-rt security update

Severity

Important

Notes

Topic: An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678) * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920) * kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236) * kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278) * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409) * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108) * kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887) * kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-31678

A flaw was found in the Linux kernel's Open vSwitch (OVS) component. A race condition can occur during the destruction of a network device (netdev) tunnel, where the `ovs_netdev_tunnel_destroy()` function may attempt to release a device reference while other parts of the system are still actively using it. This timing issue, or race condition, could lead to system instability or a denial of service (DoS) due to improper resource handling.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-63920

A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure from kernel memory.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 30 products, the same list as for CVE-2026-31678

Threats

Impact Moderate

CVE-2026-68108

A flaw was found in the `drm/amdgpu/vce` component of the Linux kernel. Malicious VCE (Video Codec Engine) command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead to system instability or potentially arbitrary code execution.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 30 products, the same list as for CVE-2026-31678

Threats

Impact Important

CVE-2026-68236

A flaw was found in the Linux kernel's drm/amd/display component. Specifically, within the `dm_update_crtc_state()` function, a stream pointer is released but not subsequently set to NULL. This can lead to a double release of the same pointer if an error occurs later in the process, creating a use-after-free vulnerability. This issue could potentially lead to memory corruption or a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-763 - Release of Invalid Pointer or Reference

Affected products

Fixed 30 products, the same list as for CVE-2026-31678

Threats

Impact Important

CVE-2026-68278

A flaw was found in the Linux kernel's DisplayPort (DP) Multi-Stream Transport (MST) subsystem. This vulnerability involves multiple buffer overflows within the `drm_dp_sideband_append_payload()` function when handling data from connected devices. A physically connected, malicious DP MST device can exploit this by sending specially crafted messages, leading to memory corruption. This could potentially allow an attacker to cause system instability or execute unauthorized code.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 30 products, the same list as for CVE-2026-31678

Threats

Impact Moderate

CVE-2026-68409

A flaw was found in the mac80211 Wi-Fi driver of the Linux kernel. When an MLO (Multi-Link Operation) link is removed, the RX statistics per-CPU buffer is freed immediately, while the link container is deferred to RCU (Read-Copy-Update). This timing issue can lead to a use-after-free vulnerability, where a reader might still access the freed memory. While difficult to exploit in practice, this could potentially lead to system instability or denial of service.

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 30 products, the same list as for CVE-2026-31678

Threats

Impact Important

CVE-2026-80887

A flaw was found in the `drm/vmwgfx` component of the Linux kernel. An integer overflow vulnerability exists in the `vmw_shader_define()` function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around, causing the size check to pass incorrectly. This allows an unbounded offset to be used, which could lead to memory corruption and potentially privilege escalation or denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

Affected products

Fixed 30 products, the same list as for CVE-2026-31678

Threats

Impact Important

CVE-2026-89811

A flaw was found in the Linux kernel's drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler (MES) fails to perform a necessary Translation Lookaside Buffer (TLB) invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access (DMA) descriptors to access memory that has already been unmapped, leading to page faults and potential GPU queue hangs, particularly during Shared Virtual Memory (SVM) page migration.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 30 products, the same list as for CVE-2026-31678

Threats

Impact Important

References

51 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:82806	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2461761	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502330	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513148	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513287	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513299	external
https://bugzilla.redhat.com/show_bug.cgi?id=2513361	external
https://bugzilla.redhat.com/show_bug.cgi?id=2528788	external
https://bugzilla.redhat.com/show_bug.cgi?id=2535309	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-31678	self
https://bugzilla.redhat.com/show_bug.cgi?id=2461761	external
https://www.cve.org/CVERecord?id=CVE-2026-31678	external
https://nvd.nist.gov/vuln/detail/CVE-2026-31678	external
https://lore.kernel.org/linux-cve-announce/202604…	external
https://access.redhat.com/security/cve/CVE-2026-63920	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502330	external
https://www.cve.org/CVERecord?id=CVE-2026-63920	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63920	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-68108	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513361	external
https://www.cve.org/CVERecord?id=CVE-2026-68108	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68108	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68236	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513148	external
https://www.cve.org/CVERecord?id=CVE-2026-68236	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68236	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68278	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513287	external
https://www.cve.org/CVERecord?id=CVE-2026-68278	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68278	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-68409	self
https://bugzilla.redhat.com/show_bug.cgi?id=2513299	external
https://www.cve.org/CVERecord?id=CVE-2026-68409	external
https://nvd.nist.gov/vuln/detail/CVE-2026-68409	external
https://lore.kernel.org/linux-cve-announce/202608…	external
https://access.redhat.com/security/cve/CVE-2026-80887	self
https://bugzilla.redhat.com/show_bug.cgi?id=2528788	external
https://www.cve.org/CVERecord?id=CVE-2026-80887	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80887	external
https://git.kernel.org/pub/scm/linux/security/vul…	external
https://access.redhat.com/security/cve/CVE-2026-89811	self
https://bugzilla.redhat.com/show_bug.cgi?id=2535309	external
https://www.cve.org/CVERecord?id=CVE-2026-89811	external
https://nvd.nist.gov/vuln/detail/CVE-2026-89811	external
https://git.kernel.org/pub/scm/linux/security/vul…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for kernel-rt is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)\n\n* kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)\n\n* kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)\n\n* kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)\n\n* kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)\n\n* kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108)\n\n* kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)\n\n* kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:82806",
        "url": "https://access.redhat.com/errata/RHSA-2026:82806"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2461761",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461761"
      },
      {
        "category": "external",
        "summary": "2502330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502330"
      },
      {
        "category": "external",
        "summary": "2513148",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513148"
      },
      {
        "category": "external",
        "summary": "2513287",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513287"
      },
      {
        "category": "external",
        "summary": "2513299",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513299"
      },
      {
        "category": "external",
        "summary": "2513361",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513361"
      },
      {
        "category": "external",
        "summary": "2528788",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528788"
      },
      {
        "category": "external",
        "summary": "2535309",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535309"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82806.json"
      }
    ],
    "title": "Red Hat Security Advisory: kernel-rt security update",
    "tracking": {
      "current_release_date": "2026-10-20T04:43:36+00:00",
      "generator": {
        "date": "2026-10-20T04:43:36+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:82806",
      "initial_release_date": "2026-10-14T09:05:33+00:00",
      "revision_history": [
        {
          "date": "2026-10-14T09:05:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-14T09:05:33+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-20T04:43:36+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux NFV (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux NFV (v. 8)",
                  "product_id": "NFV-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux RT (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux RT (v. 8)",
                  "product_id": "RT-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::realtime"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
                "product": {
                  "name": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
                  "product_id": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@4.18.0-553.173.1.rt7.514.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-core@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-core@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-devel@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-kvm@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-modules@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-modules-extra@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-devel@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-kvm@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-modules@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-modules-extra@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-debuginfo@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_id": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo-common-x86_64@4.18.0-553.173.1.rt7.514.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src"
        },
        "product_reference": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src"
        },
        "product_reference": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-31678",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-04-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2461761"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s Open vSwitch (OVS) component. A race condition can occur during the destruction of a network device (netdev) tunnel, where the `ovs_netdev_tunnel_destroy()` function may attempt to release a device reference while other parts of the system are still actively using it. This timing issue, or race condition, could lead to system instability or a denial of service (DoS) due to improper resource handling.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: openvswitch: defer tunnel netdev_put to RCU release",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Open vSwitch tunnel destroy could drop netdev references too early; upstream defers `netdev_put()` to RCU free. Red Hat recommends OVS users take virtualization/networking kernel updates.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-31678"
        },
        {
          "category": "external",
          "summary": "RHBZ#2461761",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461761"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-31678",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-31678"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31678",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31678"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026042544-CVE-2026-31678-79f5@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026042544-CVE-2026-31678-79f5@gregkh/T"
        }
      ],
      "release_date": "2026-04-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-14T09:05:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82806"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, prevent the openvswitch module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: openvswitch: defer tunnel netdev_put to RCU release"
    },
    {
      "cve": "CVE-2026-63920",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-07-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2502330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure from kernel memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: ipv6: validate extension header length before copying to cmsg",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63920"
        },
        {
          "category": "external",
          "summary": "RHBZ#2502330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502330"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63920",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63920"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63920",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63920"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63920-54a7@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63920-54a7@gregkh/T"
        }
      ],
      "release_date": "2026-07-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-14T09:05:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82806"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: ipv6: validate extension header length before copying to cmsg"
    },
    {
      "cve": "CVE-2026-68108",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2513361"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `drm/amdgpu/vce` component of the Linux kernel. Malicious VCE (Video Codec Engine) command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead to system instability or potentially arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: drm/amdgpu/vce: fix integer overflow in image size",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68108"
        },
        {
          "category": "external",
          "summary": "RHBZ#2513361",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513361"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68108",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68108"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68108",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68108"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026081053-CVE-2026-68108-4308@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026081053-CVE-2026-68108-4308@gregkh/T"
        }
      ],
      "release_date": "2026-08-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-14T09:05:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82806"
        },
        {
          "category": "workaround",
          "details": "If AMD GPU Video Codec Engine (VCE) functionality is not required, the `amdgpu` kernel module can be prevented from loading to mitigate this vulnerability. This can be achieved by blacklisting the module.\n\nTo blacklist the `amdgpu` module, create a file named `/etc/modprobe.d/blacklist-amdgpu.conf` with the following content:\n\n```\nblacklist amdgpu\n```\n\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact graphics performance or functionality if AMD GPU features are in use.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: drm/amdgpu/vce: fix integer overflow in image size"
    },
    {
      "cve": "CVE-2026-68236",
      "cwe": {
        "id": "CWE-763",
        "name": "Release of Invalid Pointer or Reference"
      },
      "discovery_date": "2026-08-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2513148"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s drm/amd/display component. Specifically, within the `dm_update_crtc_state()` function, a stream pointer is released but not subsequently set to NULL. This can lead to a double release of the same pointer if an error occurs later in the process, creating a use-after-free vulnerability. This issue could potentially lead to memory corruption or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: drm/amd/display: set new_stream to NULL after release",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68236"
        },
        {
          "category": "external",
          "summary": "RHBZ#2513148",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513148"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68236",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68236"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68236",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68236"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026081017-CVE-2026-68236-54da@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026081017-CVE-2026-68236-54da@gregkh/T"
        }
      ],
      "release_date": "2026-08-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-14T09:05:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82806"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue on systems that do not require AMD graphics hardware, prevent the amdgpu module from loading:\n\n1. Create a configuration file in /etc/modprobe.d to disable the driver:\n# echo \"install amdgpu /bin/true\" \u003e /etc/modprobe.d/disable-amdgpu.conf\n\n2. If the amdgpu module is already loaded in the running kernel, a system reboot is required for the configuration to take effect.\n\nWarning: Disabling this module prevents the initialization of AMD graphics adapters, which disables graphical desktop environments, display output, and GPU acceleration on systems relying on AMD hardware.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: drm/amd/display: set new_stream to NULL after release"
    },
    {
      "cve": "CVE-2026-68278",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-08-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2513287"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s DisplayPort (DP) Multi-Stream Transport (MST) subsystem. This vulnerability involves multiple buffer overflows within the `drm_dp_sideband_append_payload()` function when handling data from connected devices. A physically connected, malicious DP MST device can exploit this by sending specially crafted messages, leading to memory corruption. This could potentially allow an attacker to cause system instability or execute unauthorized code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate security impact flaw was found in the Linux kernel\u0027s DisplayPort (DP) Multi-Stream Transport (MST) subsystem. The drm_dp_sideband_append_payload() function contains multiple buffer overflow conditions when accumulating sideband reply chunks from a connected device: a zero-length message length field causes an integer underflow that leads to out-of-bounds reads and writes of up to 255 bytes, a chunk length field of up to 63 can write past the end of the 48-byte chunk buffer, and unbounded payload accumulation can overflow the 256-byte message buffer into adjacent memory. A physically connected malicious DP MST device can exploit these flaws by sending forged sideband reply messages, resulting in kernel memory corruption that can crash the system or potentially lead to arbitrary code execution. Red Hat rates this flaw as moderate security impact because exploitation requires physical access to connect a malicious DisplayPort device. The vulnerable code was introduced upstream in the 3.17 kernel, so the kernel and kernel-rt packages in Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present. Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 (kernel) are affected, and fixes are being pursued through the standard delegated Red Hat kernel maintenance process.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68278"
        },
        {
          "category": "external",
          "summary": "RHBZ#2513287",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513287"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68278",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68278"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68278",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68278"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026081025-CVE-2026-68278-ddb6@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026081025-CVE-2026-68278-ddb6@gregkh/T"
        }
      ],
      "release_date": "2026-08-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-14T09:05:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82806"
        },
        {
          "category": "workaround",
          "details": "Prevent the \u0027drm_dp_mst\u0027 kernel module from loading to mitigate this vulnerability. This will disable DisplayPort Multi-Stream Transport functionality, which may affect multi-monitor setups using DisplayPort.\n\nTo blacklist the module, create a file named `/etc/modprobe.d/blacklist-drm_dp_mst.conf` with the following content:\n\n```\nblacklist drm_dp_mst\n```\n\nThen, regenerate the initramfs and reboot the system for the changes to take effect:\n\n```bash\ndrancut --force --kver $(uname -r)\nreboot\n```\n\nA system reboot is required for the module to be unloaded and the mitigation to be active. This may impact display functionality if DP MST is in use.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation"
    },
    {
      "cve": "CVE-2026-68409",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-10T12:29:15.227455+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2513299"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mac80211 Wi-Fi driver of the Linux kernel. When an MLO (Multi-Link Operation) link is removed, the RX statistics per-CPU buffer is freed immediately, while the link container is deferred to RCU (Read-Copy-Update). This timing issue can lead to a use-after-free vulnerability, where a reader might still access the freed memory. While difficult to exploit in practice, this could potentially lead to system instability or denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: wifi: mac80211: defer link RX stats percpu free to RCU",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68409"
        },
        {
          "category": "external",
          "summary": "RHBZ#2513299",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513299"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68409",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68409"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68409",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68409"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026081050-CVE-2026-68409-4c77@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026081050-CVE-2026-68409-4c77@gregkh/T"
        }
      ],
      "release_date": "2026-08-10T12:04:29.238000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-14T09:05:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82806"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, prevent the mac80211 kernel module from loading on systems where wireless networking is not required.\n\n1. Create a configuration file to prevent the module from loading:\n```\necho \"install mac80211 /bin/true\" \u003e /etc/modprobe.d/disable-mac80211.conf\necho \"blacklist mac80211\" \u003e\u003e /etc/modprobe.d/disable-mac80211.conf\n```\n\n2. If the module is currently loaded, attempt to remove it:\n```\nmodprobe -r mac80211\n```\n\nCaveats:\nDisabling this module will disable wireless network interfaces relying on the mac80211 subsystem.\n\nWarning:\nIf the mac80211 module is currently in use by active network hardware or dependent modules, unloading it will fail, and a system reboot is required for the configuration changes to take effect.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: wifi: mac80211: defer link RX stats percpu free to RCU"
    },
    {
      "cve": "CVE-2026-80887",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-09-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528788"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `drm/vmwgfx` component of the Linux kernel. An integer overflow vulnerability exists in the `vmw_shader_define()` function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around, causing the size check to pass incorrectly. This allows an unbounded offset to be used, which could lead to memory corruption and potentially privilege escalation or denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Linux kernel drm/vmwgfx driver, which Red Hat Product Security rates as IMPORTANT (CVSS 7.0, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vmw_shader_define() function validates a user-supplied shader window against its backing buffer using an unsigned addition of size and offset. Because drm_vmw_shader_create_arg::offset is a 64-bit user-controlled value, an offset near U64_MAX causes the addition to wrap around, so the resulting small value incorrectly passes the bounds check. The unbounded offset is then stored in res-\u003eguest_memory_offset and forwarded to the host SVGA shader-create commands. A local unprivileged attacker with access to the vmwgfx DRM device, such as within a guest virtual machine using VMware graphics, could exploit this integer overflow to cause memory corruption, potentially leading to privilege escalation or denial of service; successful exploitation is judged to require high attack complexity. Currently affected products include the Red Hat Enterprise Linux 8, 9, and 10 kernels (kernel and kernel-rt) and Red Hat In-Vehicle OS, for which fixes are being pursued. Several older update streams (RHEL 7 ELS, RHEL 8.4, 8.6, and 8.8 z streams, and RHEL 9.2.0.z) are not affected because the vulnerable code is not present in those kernels.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80887"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528788",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528788"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80887",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80887"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80887",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80887"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80887.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80887.mbox"
        }
      ],
      "release_date": "2026-09-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-14T09:05:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82806"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound"
    },
    {
      "cve": "CVE-2026-89811",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535309"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler (MES) fails to perform a necessary Translation Lookaside Buffer (TLB) invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access (DMA) descriptors to access memory that has already been unmapped, leading to page faults and potential GPU queue hangs, particularly during Shared Virtual Memory (SVM) page migration.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-89811"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535309",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535309"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-89811",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89811"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89811",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89811"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89811.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89811.mbox"
        }
      ],
      "release_date": "2026-09-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-14T09:05:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82806"
        },
        {
          "category": "workaround",
          "details": "Prevent the amdgpu kernel module from loading:\n\n1. Create a configuration file to prevent module loading:\n# echo \"install amdgpu /bin/true\" \u003e /etc/modprobe.d/disable-amdgpu.conf\n\n2. Rebuild the initial RAM disk:\n# dracut -f\n\nWarning: A system reboot is required for this change to take effect if the driver is currently loaded. Disabling the amdgpu driver prevents graphical acceleration and GPU compute operations on systems with AMD graphics hardware, and display servers may fail or revert to basic framebuffer mode.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.173.1.rt7.514.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension"
    }
  ]
}

CVE-2026-31678 (GCVE-0-2026-31678)

Vulnerability from cvelistv5 – Published: 2026-04-25 08:46 – Updated: 2026-10-19 18:56

Title

openvswitch: defer tunnel netdev_put to RCU release

Summary

In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race with concurrent readers that still observe vport->dev. Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let vport_netdev_free() drop the reference from the RCU callback, matching the non-tunnel destroy path and avoiding additional synchronization under RTNL.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:12 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

6 references

URL	Tags
https://git.kernel.org/stable/c/9d56aced21fb9c104…
https://git.kernel.org/stable/c/42f0d3d81209654c0…
https://git.kernel.org/stable/c/bbe7bd722bfaea36a…
https://git.kernel.org/stable/c/98b726ab5e2a4811e…
https://git.kernel.org/stable/c/b8c56a3fc5d879c09…
https://git.kernel.org/stable/c/6931d21f87bc6d657…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a9020fde67a6eb77f8130feff633189f99264db1 , < 9d56aced21fb9c104e8a3f3be9b21fbafe448ffc (git) Affected: a9020fde67a6eb77f8130feff633189f99264db1 , < 42f0d3d81209654c08ffdde5a34b9b92d2645896 (git) Affected: a9020fde67a6eb77f8130feff633189f99264db1 , < bbe7bd722bfaea36aab3da6cc60fb4a05c644643 (git) Affected: a9020fde67a6eb77f8130feff633189f99264db1 , < 98b726ab5e2a4811e27c28e4d041f75bba147eab (git) Affected: a9020fde67a6eb77f8130feff633189f99264db1 , < b8c56a3fc5d879c0928f207a756b0f067f06c6a8 (git) Affected: a9020fde67a6eb77f8130feff633189f99264db1 , < 6931d21f87bc6d657f145798fad0bf077b82486c (git)
Linux	Linux	Affected: 4.3 Unaffected: 0 , < 4.3 (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.131 , ≤ 6.6.* (semver) Unaffected: 6.12.80 , ≤ 6.12.* (semver) Unaffected: 6.18.21 , ≤ 6.18.* (semver) Unaffected: 6.19.11 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-31678",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:12:17.787623Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:56:04.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/vport-netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9d56aced21fb9c104e8a3f3be9b21fbafe448ffc",
              "status": "affected",
              "version": "a9020fde67a6eb77f8130feff633189f99264db1",
              "versionType": "git"
            },
            {
              "lessThan": "42f0d3d81209654c08ffdde5a34b9b92d2645896",
              "status": "affected",
              "version": "a9020fde67a6eb77f8130feff633189f99264db1",
              "versionType": "git"
            },
            {
              "lessThan": "bbe7bd722bfaea36aab3da6cc60fb4a05c644643",
              "status": "affected",
              "version": "a9020fde67a6eb77f8130feff633189f99264db1",
              "versionType": "git"
            },
            {
              "lessThan": "98b726ab5e2a4811e27c28e4d041f75bba147eab",
              "status": "affected",
              "version": "a9020fde67a6eb77f8130feff633189f99264db1",
              "versionType": "git"
            },
            {
              "lessThan": "b8c56a3fc5d879c0928f207a756b0f067f06c6a8",
              "status": "affected",
              "version": "a9020fde67a6eb77f8130feff633189f99264db1",
              "versionType": "git"
            },
            {
              "lessThan": "6931d21f87bc6d657f145798fad0bf077b82486c",
              "status": "affected",
              "version": "a9020fde67a6eb77f8130feff633189f99264db1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/vport-netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "lessThan": "4.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: defer tunnel netdev_put to RCU release\n\novs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already\ndetached the device. Dropping the netdev reference in destroy can race\nwith concurrent readers that still observe vport-\u003edev.\n\nDo not release vport-\u003edev in ovs_netdev_tunnel_destroy(). Instead, let\nvport_netdev_free() drop the reference from the RCU callback, matching\nthe non-tunnel destroy path and avoiding additional synchronization\nunder RTNL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable destroy path is reached through local Generic Netlink/rtnetlink control operations that create or delete Open vSwitch tunnel vports. Remote tunnel packets alone do not invoke `ovs_netdev_tunnel_destroy()`.\nAC:L - This is a race/lifetime bug, but the attacker can control both sides by repeatedly deleting tunnel vports while concurrently driving RCU readers such as vport get/dump, packet execute, or datapath traffic. No rare external condition is required.\nPR:L - Creating and deleting OVS datapaths/vports requires `CAP_NET_ADMIN`, but the OVS Generic Netlink families are netns-aware and use `GENL_UNS_ADMIN_PERM`, making this reachable with CAP_NET_ADMIN in an unprivileged user namespace. This is Low privileges rather than High.\nUI:N - No victim user action is needed once the local attacker can issue the relevant netlink operations. The attacker can trigger creation, deletion, and racing reader activity directly.\nS:U - The vulnerability is a kernel memory lifetime error within the same host kernel security authority. It is a standard local kernel privilege-escalation/DoS class issue, not a VM or hardware boundary escape.\nC:H - The early `netdev_put()` can free the `net_device` while RCU readers still dereference `vport-\u003edev`, creating a use-after-free. Per kernel CVSS guidance, UAFs are scored as High confidentiality impact because they can be developed into kernel memory disclosure primitives.\nI:H - The stale `net_device` pointer can be reused after free by kernel readers/writers and may reach function-pointer-bearing netdev paths. Per guidance, a use-after-free is scored as High integrity impact because heap reuse can enable arbitrary write or code execution.\nA:H - The bug can at minimum crash or oops the kernel through NULL/stale `vport-\u003edev` dereferences and has related observed OVS netdev lifetime splats. A kernel UAF also warrants High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:24.631Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9d56aced21fb9c104e8a3f3be9b21fbafe448ffc"
        },
        {
          "url": "https://git.kernel.org/stable/c/42f0d3d81209654c08ffdde5a34b9b92d2645896"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbe7bd722bfaea36aab3da6cc60fb4a05c644643"
        },
        {
          "url": "https://git.kernel.org/stable/c/98b726ab5e2a4811e27c28e4d041f75bba147eab"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8c56a3fc5d879c0928f207a756b0f067f06c6a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/6931d21f87bc6d657f145798fad0bf077b82486c"
        }
      ],
      "title": "openvswitch: defer tunnel netdev_put to RCU release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31678",
    "datePublished": "2026-04-25T08:46:54.476Z",
    "dateReserved": "2026-03-09T15:48:24.130Z",
    "dateUpdated": "2026-10-19T18:56:04.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63920 (GCVE-0-2026-63920)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-10-19 20:17

Title

ipv6: validate extension header length before copying to cmsg

Summary

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting the on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length. The length was validated only at parse time (ipv6_parse_hopopts(), etc.). An nftables payload-write expression can rewrite hdrlen after parsing and before the skb reaches recvmsg; the write itself is in-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040 bytes from an 8-byte header. nftables is reachable from an unprivileged user namespace, so this is an unprivileged slab-out-of-bounds read: BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540 put_cmsg+0x3ac/0x540 udpv6_recvmsg+0xca0/0x1250 sock_recvmsg+0xdf/0x190 ____sys_recvmsg+0x1b1/0x620 Add ipv6_get_exthdr_len() which validates that at least two bytes are accessible before reading the hdrlen field, then checks the computed length against skb_tail_pointer(skb), returning 0 on failure. Extension headers are kept in the linear skb area by pskb_may_pull() during input, so skb_tail_pointer() is the correct bound. Use ipv6_get_exthdr_len() at all non-AH call sites: the five standalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR) and the three standard cases in the extension-header walk loop (DSTOPTS, ROUTING, default). AH retains an inline bounds check because its length formula differs ((ptr[1]+2)<<2). The walk loop also gets a pre-read bounds check at the top to validate ptr before any case accesses ptr[0] or ptr[1]. When the walk loop detects a corrupted header, return from the function instead of continuing to process later socket options.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:33 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/81394827dfb72772c…
https://git.kernel.org/stable/c/931b4a1f13408c250…
https://git.kernel.org/stable/c/08464413e628803bd…
https://git.kernel.org/stable/c/a29768d56eb3798c0…
https://git.kernel.org/stable/c/0d330eff318c0f44d…
https://git.kernel.org/stable/c/a35daeabb43368623…
https://git.kernel.org/stable/c/eb18a1b1644e4cad9…
https://git.kernel.org/stable/c/dd433671fef381fda…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 81394827dfb72772c50d0ae3bdfa094428a5d76d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 931b4a1f13408c2507719890f78f7227c34a0282 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 08464413e628803bd10cb1df68d0138665f2f885 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a29768d56eb3798c052ad3281b05596e695a17af (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0d330eff318c0f44d4fb0ad2c2aef38f87f24c90 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a35daeabb433686234b010ebf7b53778dbd6c9b8 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < eb18a1b1644e4cad978df2131e2bb9a2e6886992 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dd433671fef381fdaf7b530c631e6b782d66e224 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63920",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:33:23.448048Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:17:56.265Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/datagram.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81394827dfb72772c50d0ae3bdfa094428a5d76d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "931b4a1f13408c2507719890f78f7227c34a0282",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "08464413e628803bd10cb1df68d0138665f2f885",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a29768d56eb3798c052ad3281b05596e695a17af",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0d330eff318c0f44d4fb0ad2c2aef38f87f24c90",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a35daeabb433686234b010ebf7b53778dbd6c9b8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "eb18a1b1644e4cad978df2131e2bb9a2e6886992",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "dd433671fef381fdaf7b530c631e6b782d66e224",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/datagram.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: validate extension header length before copying to cmsg\n\nip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}\ncmsgs (and their IPV6_2292* legacy counterparts) by trusting the\non-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.\nThe length was validated only at parse time (ipv6_parse_hopopts(),\netc.).  An nftables payload-write expression can rewrite hdrlen after\nparsing and before the skb reaches recvmsg; the write itself is\nin-bounds but put_cmsg() then reads up to ((hdrlen+1) \u003c\u003c 3) = 2040\nbytes from an 8-byte header.  nftables is reachable from an\nunprivileged user namespace, so this is an unprivileged\nslab-out-of-bounds read:\n\n  BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540\n   put_cmsg+0x3ac/0x540\n   udpv6_recvmsg+0xca0/0x1250\n   sock_recvmsg+0xdf/0x190\n   ____sys_recvmsg+0x1b1/0x620\n\nAdd ipv6_get_exthdr_len() which validates that at least two bytes\nare accessible before reading the hdrlen field, then checks the\ncomputed length against skb_tail_pointer(skb), returning 0 on\nfailure.  Extension headers are kept in the linear skb area by\npskb_may_pull() during input, so skb_tail_pointer() is the correct\nbound.\n\nUse ipv6_get_exthdr_len() at all non-AH call sites: the five\nstandalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR)\nand the three standard cases in the extension-header walk loop\n(DSTOPTS, ROUTING, default).  AH retains an inline bounds check\nbecause its length formula differs ((ptr[1]+2)\u003c\u003c2).\n\nThe walk loop also gets a pre-read bounds check at the top to\nvalidate ptr before any case accesses ptr[0] or ptr[1].\n\nWhen the walk loop detects a corrupted header, return from the\nfunction instead of continuing to process later socket options."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls (nftables netlink to install a payload-set rule, setsockopt for IPV6_RECV* options, and recvmsg). Although the trigger packet is received over IPv6, the mandatory nftables corruption step is classified as Local per kernel guidance.\nAC:L - The attacker fully controls the nftables payload-set rule, the on-wire extension header, socket receive options, and the recvmsg call, making the slab out-of-bounds read reliably reproducible without races or external conditions.\nPR:L - An unprivileged local user can create a user+network namespace, obtain CAP_NET_ADMIN there, configure nftables, open a UDPv6/raw socket with extension-header cmsg options, and trigger the bug without real root in the initial namespace.\nUI:N - No victim interaction is required; the attacker can send the crafted IPv6 datagram and call recvmsg on their own socket to trigger the out-of-bounds read.\nS:U - Impact is confined to kernel memory disclosure and potential kernel instability within the same kernel security domain; it does not cross a VM/host or IOMMU boundary.\nC:H - put_cmsg() can copy up to 2040 bytes past the actual extension header into userspace ancillary data, leaking adjacent slab/kernel memory (confirmed by KASAN slab-out-of-bounds in put_cmsg).\nI:N - The bug is an out-of-bounds read that copies kernel data to userspace; it does not modify kernel memory, corrupt control structures, or provide a write primitive.\nA:H - The out-of-bounds slab read can provoke a KASAN fault/kernel oops during put_cmsg(), and repeated triggering can deny availability of the affected system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:14.814Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81394827dfb72772c50d0ae3bdfa094428a5d76d"
        },
        {
          "url": "https://git.kernel.org/stable/c/931b4a1f13408c2507719890f78f7227c34a0282"
        },
        {
          "url": "https://git.kernel.org/stable/c/08464413e628803bd10cb1df68d0138665f2f885"
        },
        {
          "url": "https://git.kernel.org/stable/c/a29768d56eb3798c052ad3281b05596e695a17af"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d330eff318c0f44d4fb0ad2c2aef38f87f24c90"
        },
        {
          "url": "https://git.kernel.org/stable/c/a35daeabb433686234b010ebf7b53778dbd6c9b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb18a1b1644e4cad978df2131e2bb9a2e6886992"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd433671fef381fdaf7b530c631e6b782d66e224"
        }
      ],
      "title": "ipv6: validate extension header length before copying to cmsg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63920",
    "datePublished": "2026-07-19T14:55:22.813Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-10-19T20:17:56.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68108 (GCVE-0-2026-68108)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-10-19 20:58

Title

drm/amdgpu/vce: fix integer overflow in image size

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions (e.g. 65536×65536) cause 32-bit integer overflow, wrapping the calculated buffer size to 0. This bypasses validation and allows GPU firmware to perform out-of-bound memory access. The fix uses 64-bit arithmetic to detect overflow and rejects invalid dimensions before they reach the hardware. V2: remove redundant check V3: modify max height value V4: remove size64 (cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:43 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

6 references

URL	Tags
https://git.kernel.org/stable/c/893db20383800cfe9…
https://git.kernel.org/stable/c/a07430abd556de370…
https://git.kernel.org/stable/c/a6d7065b91a147909…
https://git.kernel.org/stable/c/7eebef042c12dfe05…
https://git.kernel.org/stable/c/00c311a13d2252668…
https://git.kernel.org/stable/c/186bfdc4e26d019b2…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c , < 893db20383800cfe92e638705984eebb13bc81a5 (git) Affected: f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c , < a07430abd556de3707adfcadcc60db3fa64e4b2b (git) Affected: f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c , < a6d7065b91a14790980ce6f4960db0ca8c3c9940 (git) Affected: f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c , < 7eebef042c12dfe0568593ee6a8926d16505925e (git) Affected: f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c , < 00c311a13d225266800c712f2b7db2711c6897de (git) Affected: f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c , < 186bfdc4e26d019b2e7570cb121964a1d89b2e5b (git)
Linux	Linux	Affected: 4.2 Unaffected: 0 , < 4.2 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68108",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:43:59.908598Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:58:51.134Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "893db20383800cfe92e638705984eebb13bc81a5",
              "status": "affected",
              "version": "f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c",
              "versionType": "git"
            },
            {
              "lessThan": "a07430abd556de3707adfcadcc60db3fa64e4b2b",
              "status": "affected",
              "version": "f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c",
              "versionType": "git"
            },
            {
              "lessThan": "a6d7065b91a14790980ce6f4960db0ca8c3c9940",
              "status": "affected",
              "version": "f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c",
              "versionType": "git"
            },
            {
              "lessThan": "7eebef042c12dfe0568593ee6a8926d16505925e",
              "status": "affected",
              "version": "f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c",
              "versionType": "git"
            },
            {
              "lessThan": "00c311a13d225266800c712f2b7db2711c6897de",
              "status": "affected",
              "version": "f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c",
              "versionType": "git"
            },
            {
              "lessThan": "186bfdc4e26d019b2e7570cb121964a1d89b2e5b",
              "status": "affected",
              "version": "f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vce: fix integer overflow in image size\n\nFix a security vulnerability where malicious VCE command streams\nwith oversized dimensions (e.g. 65536\u00d765536) cause 32-bit integer\noverflow, wrapping the calculated buffer size to 0. This bypasses\nvalidation and allows GPU firmware to perform out-of-bound memory\naccess.\n\nThe fix uses 64-bit arithmetic to detect overflow and rejects\ninvalid dimensions before they reach the hardware.\n\nV2: remove redundant check\nV3: modify max height value\nV4: remove size64\n\n(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only through the AMDGPU_CS DRM ioctl on a local render node (/dev/dri/renderD*); there is no network, adjacent-radio, or physical-device path to the VCE command-stream parser.\nAC:L - On affected AMD GPUs using physical-mode VCE parsing, an attacker fully controls the IB and can set create-command dimensions (e.g., 65536x65536) to deterministically overflow the 32-bit size to zero without races or uncontrollable layout conditions.\nPR:L - Exploitation requires only unprivileged local access to the amdgpu DRM render node; AMDGPU_CS is gated by DRM_AUTH|DRM_RENDER_ALLOW with no root, DRM-master, or non-namespace capability requirement.\nUI:N - No victim interaction is needed beyond the attacker submitting crafted VCE command buffers through their own render-node context; no third party must open files or take other actions.\nS:C - Bypassing size-based BO relocation/validation lets VCE firmware DMA outside the intended buffer boundaries, crossing the GPU memory-isolation boundary that kernel validation is meant to enforce on GART/VRAM mappings.\nC:H - With validation defeated, VCE firmware can read arbitrarily beyond undersized encode/context/MV buffers, exposing other GPU-accessible memory including GTT-mapped system memory and adjacent VRAM allocations.\nI:H - The same out-of-bounds VCE firmware accesses enable arbitrary writes to GPU-mapped memory beyond validated buffers, providing memory-corruption primitives suitable for privilege escalation or control-flow influence.\nA:H - Oversized VCE operations against undersized buffers can trigger GPU page faults, engine hangs, GPU resets, or broader system disruption that the attacker can repeat via further command submissions."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:29:22.109Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/893db20383800cfe92e638705984eebb13bc81a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a07430abd556de3707adfcadcc60db3fa64e4b2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6d7065b91a14790980ce6f4960db0ca8c3c9940"
        },
        {
          "url": "https://git.kernel.org/stable/c/7eebef042c12dfe0568593ee6a8926d16505925e"
        },
        {
          "url": "https://git.kernel.org/stable/c/00c311a13d225266800c712f2b7db2711c6897de"
        },
        {
          "url": "https://git.kernel.org/stable/c/186bfdc4e26d019b2e7570cb121964a1d89b2e5b"
        }
      ],
      "title": "drm/amdgpu/vce: fix integer overflow in image size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68108",
    "datePublished": "2026-08-10T11:58:25.241Z",
    "dateReserved": "2026-07-30T09:28:09.368Z",
    "dateUpdated": "2026-10-19T20:58:51.134Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68236 (GCVE-0-2026-68236)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:01 – Updated: 2026-10-19 20:58

Title

drm/amd/display: set new_stream to NULL after release

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a later error (e.g., color management failure) triggers the fail label, the error path calls dc_stream_release() again on the same dangling pointer, causing a double release and potential use-after-free. Fix this by setting new_stream to NULL after the initial release. (cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:46 UTC

CWE

CWE-415 - Double Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/92b7c6e3a1546c6db…
https://git.kernel.org/stable/c/bf9c06c70f496f1ba…
https://git.kernel.org/stable/c/01ba5b36898d6258f…
https://git.kernel.org/stable/c/ba8bf1dcbb44773e7…
https://git.kernel.org/stable/c/5182e442e61397d44…
https://git.kernel.org/stable/c/679f23f0a3606afce…
https://git.kernel.org/stable/c/0676fecbb5242aa22…
https://git.kernel.org/stable/c/9fa26b9eed6195bf8…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f , < 92b7c6e3a1546c6db868b07e93fa6fb950d1d3a0 (git) Affected: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f , < bf9c06c70f496f1ba4474caf95c69696c828340e (git) Affected: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f , < 01ba5b36898d6258f584269537cc49e7b05cf7c6 (git) Affected: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f , < ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76 (git) Affected: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f , < 5182e442e61397d446c36995b8f5676942d35b82 (git) Affected: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f , < 679f23f0a3606afcef1ffabd72222f00a54ad9e3 (git) Affected: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f , < 0676fecbb5242aa22c057e78326d6d6041db034c (git) Affected: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f , < 9fa26b9eed6195bf840f39ac183b9a6237548755 (git)
Linux	Linux	Affected: 4.15 Unaffected: 0 , < 4.15 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68236",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:46:01.329903Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-415",
                "description": "CWE-415 Double Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:58:57.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "92b7c6e3a1546c6db868b07e93fa6fb950d1d3a0",
              "status": "affected",
              "version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
              "versionType": "git"
            },
            {
              "lessThan": "bf9c06c70f496f1ba4474caf95c69696c828340e",
              "status": "affected",
              "version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
              "versionType": "git"
            },
            {
              "lessThan": "01ba5b36898d6258f584269537cc49e7b05cf7c6",
              "status": "affected",
              "version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
              "versionType": "git"
            },
            {
              "lessThan": "ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76",
              "status": "affected",
              "version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
              "versionType": "git"
            },
            {
              "lessThan": "5182e442e61397d446c36995b8f5676942d35b82",
              "status": "affected",
              "version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
              "versionType": "git"
            },
            {
              "lessThan": "679f23f0a3606afcef1ffabd72222f00a54ad9e3",
              "status": "affected",
              "version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
              "versionType": "git"
            },
            {
              "lessThan": "0676fecbb5242aa22c057e78326d6d6041db034c",
              "status": "affected",
              "version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
              "versionType": "git"
            },
            {
              "lessThan": "9fa26b9eed6195bf840f39ac183b9a6237548755",
              "status": "affected",
              "version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: set new_stream to NULL after release\n\nIn dm_update_crtc_state(), the skip_modeset path releases new_stream\nvia dc_stream_release() but does not set the pointer to NULL.\n\nIf a later error (e.g., color management failure) triggers the fail\nlabel, the error path calls dc_stream_release() again on the same\ndangling pointer, causing a double release and potential use-after-free.\n\nFix this by setting new_stream to NULL after the initial release.\n\n(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the DRM atomic modeset ioctl (DRM_IOCTL_MODE_ATOMIC) on a local /dev/dri/card* node of an AMD GPU; there is no network or remote input path into dm_update_crtc_state().\nAC:L - A single atomic commit that requests a mode change while attaching a wrong-sized DEGAMMA_LUT blob deterministically drives amdgpu_dm_check_crtc_color_mgmt() to -EINVAL and hits the double dc_stream_release(); no race and no uncontrolled precondition, and TEST_ONLY commits let the attacker repeat it freely to groom the heap.\nPR:L - The atomic ioctl is gated only by DRM master on the card node, which any unprivileged local user on a graphical seat or an unused VT can hold; no CAP_SYS_ADMIN or root is needed.\nUI:N - The attacker performs the whole sequence with its own ioctl calls; no action by another user or administrator is required, and TEST_ONLY commits do not even disturb the display.\nS:U - The corrupted dc_stream_state and the resulting freed-memory reuse stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The extra kref_put() frees the dc_stream_state while the CRTC state and the DC context still reference it; reading through those dangling pointers after the slab is reallocated leaks adjacent kernel object contents and pointers, and the attacker can spray to control what lands there.\nI:H - The reference-count underflow yields a use-after-free/double-free: subsequent kref_put() writes into reallocated slab memory and dc_stream_free() kfree()s an attacker-influenced update_scratch pointer, giving write and arbitrary-free primitives usable for privilege escalation.\nA:H - Even without exploitation the premature free causes dereference of freed stream/sink/link structures during atomic state unwind, producing a kernel oops or panic and killing the display pipeline; it can be triggered repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:55:40.750Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/92b7c6e3a1546c6db868b07e93fa6fb950d1d3a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf9c06c70f496f1ba4474caf95c69696c828340e"
        },
        {
          "url": "https://git.kernel.org/stable/c/01ba5b36898d6258f584269537cc49e7b05cf7c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76"
        },
        {
          "url": "https://git.kernel.org/stable/c/5182e442e61397d446c36995b8f5676942d35b82"
        },
        {
          "url": "https://git.kernel.org/stable/c/679f23f0a3606afcef1ffabd72222f00a54ad9e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0676fecbb5242aa22c057e78326d6d6041db034c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fa26b9eed6195bf840f39ac183b9a6237548755"
        }
      ],
      "title": "drm/amd/display: set new_stream to NULL after release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68236",
    "datePublished": "2026-08-10T12:01:01.114Z",
    "dateReserved": "2026-07-30T09:28:09.376Z",
    "dateUpdated": "2026-10-19T20:58:57.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68278 (GCVE-0-2026-68278)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:01 – Updated: 2026-08-23 12:46

Title

drm/dp/mst: fix buffer overflows in sideband chunk accumulation

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken directly from the DP sideband header. If a device sends msg_len=0, curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() writes 255 bytes into msg[], both far out of bounds. 2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks until curchunk_idx reaches curchunk_len, writing up to 15 bytes past the end of chunk[] into msg[]. 3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], so the memcpy can spill into adjacent struct fields. All three are reachable from any DP MST device that can forge sideband reply messages on a physical connection.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/ef2ecb6cf268debf3…
https://git.kernel.org/stable/c/d4e05dedb252ed3e5…
https://git.kernel.org/stable/c/4d5109075a787de28…
https://git.kernel.org/stable/c/53937a2787d29c7a4…
https://git.kernel.org/stable/c/ef0dbcc200c3389f1…
https://git.kernel.org/stable/c/1e5827839ad0ceb00…
https://git.kernel.org/stable/c/a6366b551079c79bf…
https://git.kernel.org/stable/c/55bd5e685bda455b9…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ad7f8a1f9ced7f049f9b66d588723f243a7034cd , < ef2ecb6cf268debf3890df99fea01b6452dcf78e (git) Affected: ad7f8a1f9ced7f049f9b66d588723f243a7034cd , < d4e05dedb252ed3e540a0c9be511e427f098110a (git) Affected: ad7f8a1f9ced7f049f9b66d588723f243a7034cd , < 4d5109075a787de28c9e89940f9dee45269f91fa (git) Affected: ad7f8a1f9ced7f049f9b66d588723f243a7034cd , < 53937a2787d29c7a460e984dc4f20ff6ac91dc65 (git) Affected: ad7f8a1f9ced7f049f9b66d588723f243a7034cd , < ef0dbcc200c3389f1f781ab181932a97e54b51af (git) Affected: ad7f8a1f9ced7f049f9b66d588723f243a7034cd , < 1e5827839ad0ceb0079d1560c321fa3656b54f21 (git) Affected: ad7f8a1f9ced7f049f9b66d588723f243a7034cd , < a6366b551079c79bf7bdbadd74c97358bcfe2d58 (git) Affected: ad7f8a1f9ced7f049f9b66d588723f243a7034cd , < 55bd5e685bda455b9b50c835f8c8442d52a344a3 (git)
Linux	Linux	Affected: 3.17 Unaffected: 0 , < 3.17 (semver) Unaffected: 5.10.266 , ≤ 5.10.* (semver) Unaffected: 5.15.217 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/display/drm_dp_mst_topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef2ecb6cf268debf3890df99fea01b6452dcf78e",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "d4e05dedb252ed3e540a0c9be511e427f098110a",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "4d5109075a787de28c9e89940f9dee45269f91fa",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "53937a2787d29c7a460e984dc4f20ff6ac91dc65",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "ef0dbcc200c3389f1f781ab181932a97e54b51af",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "1e5827839ad0ceb0079d1560c321fa3656b54f21",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "a6366b551079c79bf7bdbadd74c97358bcfe2d58",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "55bd5e685bda455b9b50c835f8c8442d52a344a3",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/display/drm_dp_mst_topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp/mst: fix buffer overflows in sideband chunk accumulation\n\ndrm_dp_sideband_append_payload() has three related bugs when processing\ndevice-provided sideband reply data:\n\n1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken\n   directly from the DP sideband header. If a device sends msg_len=0,\n   curchunk_len is set to zero. The condition (curchunk_idx \u003e= curchunk_len)\n   is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).\n   drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()\n   writes 255 bytes into msg[], both far out of bounds.\n\n2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is\n   only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks\n   until curchunk_idx reaches curchunk_len, writing up to 15 bytes past\n   the end of chunk[] into msg[].\n\n3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to\n   msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256],\n   so the memcpy can spill into adjacent struct fields.\n\nAll three are reachable from any DP MST device that can forge sideband\nreply messages on a physical connection."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:15.450Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef2ecb6cf268debf3890df99fea01b6452dcf78e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4e05dedb252ed3e540a0c9be511e427f098110a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d5109075a787de28c9e89940f9dee45269f91fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/53937a2787d29c7a460e984dc4f20ff6ac91dc65"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef0dbcc200c3389f1f781ab181932a97e54b51af"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e5827839ad0ceb0079d1560c321fa3656b54f21"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6366b551079c79bf7bdbadd74c97358bcfe2d58"
        },
        {
          "url": "https://git.kernel.org/stable/c/55bd5e685bda455b9b50c835f8c8442d52a344a3"
        }
      ],
      "title": "drm/dp/mst: fix buffer overflows in sideband chunk accumulation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68278",
    "datePublished": "2026-08-10T12:01:54.285Z",
    "dateReserved": "2026-07-30T09:28:09.379Z",
    "dateUpdated": "2026-08-23T12:46:15.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68409 (GCVE-0-2026-68409)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-10-19 21:09

Title

wifi: mac80211: defer link RX stats percpu free to RCU

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head); The RX fast path reads link_sta under rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the pointer. The container stays alive from the kfree_rcu, so the read still works. But the percpu block it points to is already freed. This needs uses_rss. That is when pcpu_rx_stats exists. The full STA teardown frees the deflink stats only after synchronize_net(). The link removal path had no such barrier. The race is hard to win in practice, but the free should still wait for RCU. Free the link together with its data from a single RCU callback, so the percpu block is reclaimed only after readers drain.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:48 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/2aa1789880fa5e410…
https://git.kernel.org/stable/c/a03fceae0c65b31ce…
https://git.kernel.org/stable/c/aa2eb62525188269c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c71420db653aba30a234d1e4cf86dde376e604fa , < 2aa1789880fa5e41049b0f6a74a4fc2fa1997610 (git) Affected: c71420db653aba30a234d1e4cf86dde376e604fa , < a03fceae0c65b31ce31840dac5e26684ceecb65b (git) Affected: c71420db653aba30a234d1e4cf86dde376e604fa , < aa2eb62525188269cdd402a583b9a8ed94657ff0 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68409",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:48:24.807491Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:09:09.046Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/sta_info.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2aa1789880fa5e41049b0f6a74a4fc2fa1997610",
              "status": "affected",
              "version": "c71420db653aba30a234d1e4cf86dde376e604fa",
              "versionType": "git"
            },
            {
              "lessThan": "a03fceae0c65b31ce31840dac5e26684ceecb65b",
              "status": "affected",
              "version": "c71420db653aba30a234d1e4cf86dde376e604fa",
              "versionType": "git"
            },
            {
              "lessThan": "aa2eb62525188269cdd402a583b9a8ed94657ff0",
              "status": "affected",
              "version": "c71420db653aba30a234d1e4cf86dde376e604fa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/sta_info.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: defer link RX stats percpu free to RCU\n\nsta_remove_link() frees a removed MLO link\u0027s RX stats percpu buffer right\naway, but defers only the link container to RCU:\n\n\tsta_info_free_link(\u0026alloc-\u003einfo);\n\tkfree_rcu(alloc, rcu_head);\n\nThe RX fast path reads link_sta under rcu_read_lock and writes the percpu\nstats. A reader that resolved link_sta before the removal keeps the\npointer. The container stays alive from the kfree_rcu, so the read still\nworks. But the percpu block it points to is already freed. This needs\nuses_rss. That is when pcpu_rx_stats exists.\n\nThe full STA teardown frees the deflink stats only after\nsynchronize_net(). The link removal path had no such barrier. The race is\nhard to win in practice, but the free should still wait for RCU.\n\nFree the link together with its data from a single RCU callback, so the\npercpu block is reclaimed only after readers drain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The race is driven entirely over the air: the RX fast path writing the freed percpu stats is fed by received 802.11 data frames, and the link removal that frees them is triggered by AP-originated ML reconfiguration/association-response handling in ieee80211_ml_reconf_work(). A rogue AP or frame injector within radio range of the victim station suffices, so this is adjacent (Wi-Fi) rather than routable network access.\nAC:L - The attacker controls both sides of the race \u2014 it supplies the RX traffic stream that dereferences link_sta and writes pcpu_rx_stats, and it triggers the MLO link removal that frees that percpu block \u2014 and can repeat link add/remove cycles indefinitely under high packet rates spread across many CPUs by RSS. No condition outside the attacker\u0027s influence is needed beyond a mainstream RSS-capable MLO driver (iwlwifi, ath11k/ath12k).\nPR:N - No privileges or accounts on the victim system are required; the frames come from the peer AP, and a rogue AP or spoofed ML reconfiguration/data frames reach the code with no authorization on the target host.\nUI:N - Frame reception, MLO link reconfiguration and station link teardown are all handled automatically by mac80211 with no action by the device\u0027s user.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The freed percpu block can be reallocated to other subsystems, and the RX path continues reading fields such as last_signal, chains and counters from it, so attacker-influenced reuse of that memory can expose kernel data; per use-after-free scoring this is treated as high confidentiality impact.\nI:H - The RX fast path performs repeated writes (last_rx, last_rate, fragments, packets, chain_signal_last) into the already-freed percpu allocation, corrupting whatever percpu data is reallocated there \u2014 an attacker-timed write primitive into arbitrary recycled kernel state.\nA:H - Writing through a freed percpu pointer from the RX hot path corrupts kernel allocator state and unrelated percpu data, readily producing oopses or panics; KASAN-instrumented kernels report the use-after-free outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:04:59.807Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610"
        },
        {
          "url": "https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0"
        }
      ],
      "title": "wifi: mac80211: defer link RX stats percpu free to RCU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68409",
    "datePublished": "2026-08-10T12:04:29.238Z",
    "dateReserved": "2026-07-30T09:28:09.390Z",
    "dateUpdated": "2026-10-19T21:09:09.046Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80887 (GCVE-0-2026-80887)

Vulnerability from cvelistv5 – Published: 2026-09-04 17:11 – Updated: 2026-09-04 17:11

Title

drm/vmwgfx: use check_add_overflow for shader size+offset bound

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overflow for shader size+offset bound vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size + (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/1bbe7751f5ebac383…
https://git.kernel.org/stable/c/d3f44438aa805270a…
https://git.kernel.org/stable/c/cfd163169af3be56e…
https://git.kernel.org/stable/c/5c725901908eb1e52…
https://git.kernel.org/stable/c/54d56d5b42d2e4c72…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 1bbe7751f5ebac383405ef29a66622d65bd505d3 (git) Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < d3f44438aa805270aaead3b6840ccaea0f4c11f9 (git) Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < cfd163169af3be56eaef113c680ea251f0d09189 (git) Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 5c725901908eb1e52a16fc0e2373cb761df42d21 (git) Affected: 668b206601c5f5063e03b76784a0d3024fa2b249 , < 54d56d5b42d2e4c72ba6e365e9774da90698aa22 (git)
Linux	Linux	Affected: 6.4 Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_shader.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1bbe7751f5ebac383405ef29a66622d65bd505d3",
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "versionType": "git"
            },
            {
              "lessThan": "d3f44438aa805270aaead3b6840ccaea0f4c11f9",
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "versionType": "git"
            },
            {
              "lessThan": "cfd163169af3be56eaef113c680ea251f0d09189",
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "versionType": "git"
            },
            {
              "lessThan": "5c725901908eb1e52a16fc0e2373cb761df42d21",
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "versionType": "git"
            },
            {
              "lessThan": "54d56d5b42d2e4c72ba6e365e9774da90698aa22",
              "status": "affected",
              "version": "668b206601c5f5063e03b76784a0d3024fa2b249",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_shader.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: use check_add_overflow for shader size+offset bound\n\nvmw_shader_define() validates the user-supplied shader window against\nits backing buffer with\n\n\t(u64)buffer-\u003etbo.base.size \u003c (u64)size + (u64)offset\n\ndrm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is\nnear U64_MAX the unsigned addition wraps and the resulting tiny value\npasses the check.  The unbounded offset is then stored in\nres-\u003eguest_memory_offset and forwarded to host SVGA shader-create\ncommands.\n\nUse check_add_overflow() to detect the wrap and compare the resulting\nendpoint against the buffer size."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T17:11:04.063Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1bbe7751f5ebac383405ef29a66622d65bd505d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3f44438aa805270aaead3b6840ccaea0f4c11f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfd163169af3be56eaef113c680ea251f0d09189"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c725901908eb1e52a16fc0e2373cb761df42d21"
        },
        {
          "url": "https://git.kernel.org/stable/c/54d56d5b42d2e4c72ba6e365e9774da90698aa22"
        }
      ],
      "title": "drm/vmwgfx: use check_add_overflow for shader size+offset bound",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80887",
    "datePublished": "2026-09-04T17:11:04.063Z",
    "dateReserved": "2026-08-26T14:34:25.799Z",
    "dateUpdated": "2026-09-04T17:11:04.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89811 (GCVE-0-2026-89811)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:30 – Updated: 2026-10-19 08:53

Title

drm/amdkfd: Add TLB flush after MES queue eviction/suspension

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add TLB flush after MES queue eviction/suspension MES (Micro Engine Scheduler) does not perform heavy-weight TLB invalidation after unmapping queues, unlike HWS which does this automatically. This causes a race condition where in-flight DMA descriptors can access memory that has been unmapped, leading to page faults and GPU queue hangs during SVM page migration. The issue manifests as KFDSVMRangeTest.MultiThreadMigrationTest failures on gfx1151 (Strix Point) with XNACK mode 1 enabled - the GPU compute queue hangs with packets submitted but never consumed. Add kfd_flush_tlb() calls after MES queue removal in two locations: - evict_process_queues_cpsch(): after all queues removed during eviction - suspend_queues(): after debug/criu queue suspension (with mem_fence barrier) This ensures all in-flight memory accesses from unmapped queues are flushed before memory is freed or migrated. (cherry picked from commit f5c4f88e0f9c45a8fb9dfac0c1df726c95e41b77)

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6992 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/e230c546ed9374183…
https://git.kernel.org/stable/c/6aae545c87087e4dc…
https://git.kernel.org/stable/c/94e25cb6ab7f4f025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cc009e613de6560eb499f8bc92c80a737752cb30 , < e230c546ed93741833ab5babb0b202f9c2052b45 (git) Affected: cc009e613de6560eb499f8bc92c80a737752cb30 , < 6aae545c87087e4dc96e205452243813bfa73ba2 (git) Affected: cc009e613de6560eb499f8bc92c80a737752cb30 , < 94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4 (git)
Linux	Linux	Affected: 5.19 Unaffected: 0 , < 5.19 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.5 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e230c546ed93741833ab5babb0b202f9c2052b45",
              "status": "affected",
              "version": "cc009e613de6560eb499f8bc92c80a737752cb30",
              "versionType": "git"
            },
            {
              "lessThan": "6aae545c87087e4dc96e205452243813bfa73ba2",
              "status": "affected",
              "version": "cc009e613de6560eb499f8bc92c80a737752cb30",
              "versionType": "git"
            },
            {
              "lessThan": "94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4",
              "status": "affected",
              "version": "cc009e613de6560eb499f8bc92c80a737752cb30",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Add TLB flush after MES queue eviction/suspension\n\nMES (Micro Engine Scheduler) does not perform heavy-weight TLB\ninvalidation after unmapping queues, unlike HWS which does this\nautomatically. This causes a race condition where in-flight DMA\ndescriptors can access memory that has been unmapped, leading to page\nfaults and GPU queue hangs during SVM page migration.\n\nThe issue manifests as KFDSVMRangeTest.MultiThreadMigrationTest\nfailures on gfx1151 (Strix Point) with XNACK mode 1 enabled - the GPU\ncompute queue hangs with packets submitted but never consumed.\n\nAdd kfd_flush_tlb() calls after MES queue removal in two locations:\n- evict_process_queues_cpsch(): after all queues removed during eviction\n- suspend_queues(): after debug/criu queue suspension (with mem_fence barrier)\n\nThis ensures all in-flight memory accesses from unmapped queues are\nflushed before memory is freed or migrated.\n\n(cherry picked from commit f5c4f88e0f9c45a8fb9dfac0c1df726c95e41b77)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local /dev/kfd paths: AMDKFD_IOC_CREATE_QUEUE plus SVM/userptr activity (AMDKFD_IOC_SVM, munmap of USERPTR BOs) or KFD_IOC_DBG_TRAP_SUSPEND_QUEUES, which call evict_process_queues_cpsch()/suspend_queues(); there is no network, adjacent-wireless, or physical-device path.\nAC:L - The attacker controls both sides of the race: they keep DMA in flight on their own MES compute/SDMA queues while concurrently forcing eviction or suspend via SVM migration, userptr MMU notifiers, TTM pressure, or self-debug suspend, matching the MultiThreadMigrationTest trigger with no victim timing or uncontrollable layout required.\nPR:L - kfd_open() and the CREATE_QUEUE/SVM/DBG_TRAP ioctls perform no capability checks; a local unprivileged user with typical render/video-group access to /dev/kfd and /dev/dri/renderD* on desktops, ROCm nodes, and multi-tenant AMD GPU clouds is sufficient, not init-namespace root.\nUI:N - The attacker opens their own KFD and DRM render-node descriptors, submits compute work, and triggers queue eviction or suspend in that same process; no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:C - MES queue removal omits the heavyweight PASID TLB invalidation HWS performs, so in-flight GPU DMA can use stale GPUVM translations to physical pages after they are unmapped, freed, or migrated, bypassing the GPUVM/PASID DMA isolation boundary that is supposed to confine GPU access.\nC:H - In-flight GPU DMA through stale GPUVM TLB entries can read physical pages after they leave the process mapping and are recycled to the page allocator, kernel, or another process, giving an arbitrary memory-disclosure primitive.\nI:H - The same stale translations allow GPU DMA writes into those recycled physical pages, enabling arbitrary memory corruption and control-flow hijacking through a device DMA write primitive.\nA:H - The issue is documented to cause GPU page faults and compute-queue hangs (packets submitted but never consumed), which can stall the shared GPU and force amdgpu reset, denying compute service to all co-located workloads."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:53:05.614Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e230c546ed93741833ab5babb0b202f9c2052b45"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aae545c87087e4dc96e205452243813bfa73ba2"
        },
        {
          "url": "https://git.kernel.org/stable/c/94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4"
        }
      ],
      "title": "drm/amdkfd: Add TLB flush after MES queue eviction/suspension",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89811",
    "datePublished": "2026-09-16T10:30:44.274Z",
    "dateReserved": "2026-09-11T19:38:34.768Z",
    "dateUpdated": "2026-10-19T08:53:05.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:82806

CVE-2026-31678 (GCVE-0-2026-31678)

CVE-2026-63920 (GCVE-0-2026-63920)

CVE-2026-68108 (GCVE-0-2026-68108)

CVE-2026-68236 (GCVE-0-2026-68236)

CVE-2026-68278 (GCVE-0-2026-68278)

CVE-2026-68409 (GCVE-0-2026-68409)

CVE-2026-80887 (GCVE-0-2026-80887)

CVE-2026-89811 (GCVE-0-2026-89811)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour