Vulnerability-Lookup

CVE-2026-31663 (GCVE-0-2026-31663)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:45 – Updated: 2026-09-18 12:04

Title

xfrm: hold dev ref until after transport_finish NF_HOOK

Summary

In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The skb->dev pointer is then used inside NF_HOOK and its okfn, which can race with device teardown. Remove the dev_put from the async resumption entry and instead drop the reference after the NF_HOOK call in transport_finish, using a saved device pointer since NF_HOOK may consume the skb. This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn. For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-826 - Premature Release of Resource During Expected Lifetime

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/4236c30b437b80f67…
https://git.kernel.org/stable/c/0f451b43c88bf2b9c…
https://git.kernel.org/stable/c/5002beda5cac69d52…
https://git.kernel.org/stable/c/1c428b03840094410…
https://access.redhat.com/security/cve/CVE-2026-31663	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2461462	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:67471	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68570	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68531	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68532	vendor-advisoryx_refsource_REDHAT

Impacted products

9 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: acf568ee859f098279eadf551612f103afdacb4e , < 4236c30b437b80f673b9e08c8fae38b8d471ac9e (git) Affected: acf568ee859f098279eadf551612f103afdacb4e , < 0f451b43c88bf2b9c038b414be580efee42e031b (git) Affected: acf568ee859f098279eadf551612f103afdacb4e , < 5002beda5cac69d522dc54da0d5d463ed9c963d2 (git) Affected: acf568ee859f098279eadf551612f103afdacb4e , < 1c428b03840094410c5fb6a5db30640486bbbfcb (git) Affected: 69895c5ea0ca2e8d7de1e6d36965d0ab9730787f (git) Affected: 833760100588acfb267dac4d6a02ab9931237739 (git) Affected: e095ecaec6d94aa2156cceb98a85d409b51190f3 (git) Affected: 3.2.100 , < 3.3 (semver) Affected: 3.16.55 , < 3.17 (semver) Affected: 4.14.24 , < 4.15 (semver)	guessed
Linux	Linux	Affected: 4.15 Unaffected: 0 , < 4.15 (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.23 , ≤ 6.18.* (semver) Unaffected: 6.19.13 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)	guessed
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.55.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.164.1.rt7.505.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.164.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.49.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.55.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.164.1.rt7.505.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.164.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.49.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s `xfrm` (IP eXtensible FRamework) subsystem. This vulnerability involves a race condition where a network device\u0027s reference is released too early during packet processing after asynchronous cryptography. This premature release can lead to the system attempting to access a deallocated device, potentially causing a system crash (Denial of Service)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Moderate"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-826",
                "description": "Premature Release of Resource During Expected Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T12:04:43.702Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-31663"
          },
          {
            "name": "RHBZ#2461462",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461462"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31663.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67471"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:68570"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:68531"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:68532"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:67471: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:68570: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:68531: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:68532: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: xfrm: hold dev ref until after transport_finish NF_HOOK",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/xfrm4_input.c",
            "net/ipv6/xfrm6_input.c",
            "net/xfrm/xfrm_input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4236c30b437b80f673b9e08c8fae38b8d471ac9e",
              "status": "affected",
              "version": "acf568ee859f098279eadf551612f103afdacb4e",
              "versionType": "git"
            },
            {
              "lessThan": "0f451b43c88bf2b9c038b414be580efee42e031b",
              "status": "affected",
              "version": "acf568ee859f098279eadf551612f103afdacb4e",
              "versionType": "git"
            },
            {
              "lessThan": "5002beda5cac69d522dc54da0d5d463ed9c963d2",
              "status": "affected",
              "version": "acf568ee859f098279eadf551612f103afdacb4e",
              "versionType": "git"
            },
            {
              "lessThan": "1c428b03840094410c5fb6a5db30640486bbbfcb",
              "status": "affected",
              "version": "acf568ee859f098279eadf551612f103afdacb4e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69895c5ea0ca2e8d7de1e6d36965d0ab9730787f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "833760100588acfb267dac4d6a02ab9931237739",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e095ecaec6d94aa2156cceb98a85d409b51190f3",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.100",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.55",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.24",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/xfrm4_input.c",
            "net/ipv6/xfrm6_input.c",
            "net/xfrm/xfrm_input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.100",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.55",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold dev ref until after transport_finish NF_HOOK\n\nAfter async crypto completes, xfrm_input_resume() calls dev_put()\nimmediately on re-entry before the skb reaches transport_finish.\nThe skb-\u003edev pointer is then used inside NF_HOOK and its okfn,\nwhich can race with device teardown.\n\nRemove the dev_put from the async resumption entry and instead\ndrop the reference after the NF_HOOK call in transport_finish,\nusing a saved device pointer since NF_HOOK may consume the skb.\nThis covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip\nthe okfn.\n\nFor non-transport exits (decaps, gro, drop) and secondary\nasync return points, release the reference inline when\nasync is set."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The complete attacker-controlled path requires a local unprivileged user to create a user/net namespace, configure transport-mode XFRM state, send traffic, and tear down the namespace/device in parallel.\nAC:L - The race is attacker-controlled in the user-namespace scenario: the attacker controls packet injection and device/netns teardown and can repeat the sequence reliably.\nPR:L - XFRM and rtnetlink setup require CAP_NET_ADMIN, but these checks are against the network namespace user_ns and are reachable after unshare -Urn by an unprivileged local user.\nUI:N - No victim action is required once the attacker can run local code and create the namespace setup.\nS:U - The vulnerable component and impacted resource are the kernel itself; this is a standard kernel memory-safety issue rather than a VM or hardware boundary escape.\nC:H - This is a net_device use-after-free, and freed kernel heap objects can potentially be reclaimed and abused for kernel memory disclosure.\nI:H - Use-after-free in kernel networking code can potentially be shaped into control-flow or data-structure corruption, so high integrity impact is appropriate.\nA:H - The issue was reproduced as a KASAN slab-use-after-free in the async XFRM reinject path and can crash the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:13.957Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4236c30b437b80f673b9e08c8fae38b8d471ac9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f451b43c88bf2b9c038b414be580efee42e031b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5002beda5cac69d522dc54da0d5d463ed9c963d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c428b03840094410c5fb6a5db30640486bbbfcb"
        }
      ],
      "title": "xfrm: hold dev ref until after transport_finish NF_HOOK",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31663",
    "datePublished": "2026-04-24T14:45:13.239Z",
    "dateReserved": "2026-03-09T15:48:24.129Z",
    "dateUpdated": "2026-09-18T12:04:43.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31663",
      "date": "2026-09-25",
      "epss": "0.00133",
      "percentile": "0.02294"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-23T01:45:56.000Z",
      "cve": "CVE-2026-31663",
      "id": "msrc_CVE-2026-31663",
      "initial_release_date": "2026-04-26T01:04:24.000Z",
      "product_status:known_affected": "13",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "xfrm: hold dev ref until after transport_finish NF_HOOK",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-31663.json",
      "version": "17"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv4/xfrm4_input.c",
                  "net/ipv6/xfrm6_input.c",
                  "net/xfrm/xfrm_input.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4236c30b437b80f673b9e08c8fae38b8d471ac9e",
                    "status": "affected",
                    "version": "acf568ee859f098279eadf551612f103afdacb4e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0f451b43c88bf2b9c038b414be580efee42e031b",
                    "status": "affected",
                    "version": "acf568ee859f098279eadf551612f103afdacb4e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5002beda5cac69d522dc54da0d5d463ed9c963d2",
                    "status": "affected",
                    "version": "acf568ee859f098279eadf551612f103afdacb4e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1c428b03840094410c5fb6a5db30640486bbbfcb",
                    "status": "affected",
                    "version": "acf568ee859f098279eadf551612f103afdacb4e",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "69895c5ea0ca2e8d7de1e6d36965d0ab9730787f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "833760100588acfb267dac4d6a02ab9931237739",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "e095ecaec6d94aa2156cceb98a85d409b51190f3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3.3",
                    "status": "affected",
                    "version": "3.2.100",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.17",
                    "status": "affected",
                    "version": "3.16.55",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "affected",
                    "version": "4.14.24",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv4/xfrm4_input.c",
                  "net/ipv6/xfrm6_input.c",
                  "net/xfrm/xfrm_input.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.15"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.94",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.23",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          },
          {
            "affectedData": [
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:10.2"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 10",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:6.12.0-211.55.1.el10_2",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:enterprise_linux:8::nfv"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel-rt",
                "product": "Red Hat Enterprise Linux 8",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:4.18.0-553.164.1.rt7.505.el8_10",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:8"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 8",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:4.18.0-553.164.1.el8_10",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:enterprise_linux:9",
                  "cpe:/o:redhat:enterprise_linux:9"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 9",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "0:5.14.0-687.49.1.el9_8",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:6"
                ],
                "defaultStatus": "unaffected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 6",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:7"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel",
                "product": "Red Hat Enterprise Linux 7",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:7"
                ],
                "defaultStatus": "affected",
                "packageName": "kernel-rt",
                "product": "Red Hat Enterprise Linux 7",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/o:redhat:enterprise_linux:9"
                ],
                "defaultStatus": "unaffected",
                "packageName": "kernel-rt",
                "product": "Red Hat Enterprise Linux 9",
                "vendor": "Red Hat"
              }
            ],
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6B10F87F-6387-4CE3-9159-D77EB163C9AD",
                    "versionEndExcluding": "3.3",
                    "versionStartIncluding": "3.2.100",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C9F9D919-846F-4FDC-882F-B49219EA19E9",
                    "versionEndExcluding": "3.17",
                    "versionStartIncluding": "3.16.55",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4C6AA567-92EC-46CF-9ED1-2B04B2B29BFB",
                    "versionEndExcluding": "4.15",
                    "versionStartIncluding": "4.14.24",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "45125EC8-B49D-48DD-92B9-2E4D1295531E",
                    "versionEndExcluding": "6.18.23",
                    "versionStartIncluding": "4.15.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1490EF9B-9080-481C-8D22-1306AAE664E4",
                    "versionEndExcluding": "6.19.13",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:4.15:-:*:*:*:*:*:*",
                    "matchCriteriaId": "3B4D39AF-668B-442B-8085-639A6D4FA5AC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold dev ref until after transport_finish NF_HOOK\n\nAfter async crypto completes, xfrm_input_resume() calls dev_put()\nimmediately on re-entry before the skb reaches transport_finish.\nThe skb-\u003edev pointer is then used inside NF_HOOK and its okfn,\nwhich can race with device teardown.\n\nRemove the dev_put from the async resumption entry and instead\ndrop the reference after the NF_HOOK call in transport_finish,\nusing a saved device pointer since NF_HOOK may consume the skb.\nThis covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip\nthe okfn.\n\nFor non-transport exits (decaps, gro, drop) and secondary\nasync return points, release the reference inline when\nasync is set."
          }
        ],
        "id": "CVE-2026-31663",
        "lastModified": "2026-09-18T13:17:45.590",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-04-24T15:16:45.947",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0f451b43c88bf2b9c038b414be580efee42e031b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1c428b03840094410c5fb6a5db30640486bbbfcb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4236c30b437b80f673b9e08c8fae38b8d471ac9e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5002beda5cac69d522dc54da0d5d463ed9c963d2"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:67471"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:68531"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:68532"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/errata/RHSA-2026:68570"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://access.redhat.com/security/cve/CVE-2026-31663"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461462"
          },
          {
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31663.json"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-826"
              }
            ],
            "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-17T15:00:49+00:00",
      "cve": "CVE-2026-31663",
      "id": "CVE-2026-31663",
      "initial_release_date": "2026-04-24T00:00:00+00:00",
      "product_status:fixed": "762",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "36",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xfrm: hold dev ref until after transport_finish NF_HOOK",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31663.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:54:55Z",
      "cve": "CVE-2026-31663",
      "id": "CVE-2026-31663",
      "initial_release_date": "2026-04-25T01:36:40Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "748",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "382",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31663",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31663.json",
      "version": "16"
    }
  }
}

RHSA-2026:68532

Vulnerability from csaf_redhat - Published: 2026-09-17 07:12 - Updated: 2026-09-25 22:55

Summary

Red Hat Security Advisory: kernel-rt security update

Severity

Important

Scope

23 vulnerabilities in this advisory, including CVE-2026-31663.

CVE-2026-31663

A flaw was found in the Linux kernel's `xfrm` (IP eXtensible FRamework) subsystem. This vulnerability involves a race condition where a network device's reference is released too early during packet processing after asynchronous cryptography. This premature release can lead to the system attempting to access a deallocated device, potentially causing a system crash (Denial of Service).

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 30 products

https://access.redhat.com/errata/RHSA-2026:68532

Open the full advisory

RHSA-2026:68570

Vulnerability from csaf_opensuse - Published: 2026-09-17 14:39 - Updated: 2026-09-25 22:55

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Scope

31 vulnerabilities in this advisory, including CVE-2026-31663.

CVE-2026-31663

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 303 products

https://access.redhat.com/errata/RHSA-2026:68570

Open the full advisory

RLSA-2026:67471 (CVE-2025-40149)

Vulnerability from osv_rocky – Published: 2026-09-16 12:09 – Updated: 2026-09-26 06:14 – Source website

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)
kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)
kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)
kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)
kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)
kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)
kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)
kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)
kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)
kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)
kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)
kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

Bug Fix(es) and Enhancement(s):

[rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:Rocky Linux-245035)
RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:Rocky Linux-255233)
[Rocky Linux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255348)
[usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [Rocky Linux-10.2.z] (JIRA:Rocky Linux-256731)
RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:Rocky Linux-256890)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:67471	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2414466	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2425039	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2454867	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2460699	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2461451	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2461462	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2461525	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2461575	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467084	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2468192	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2468244	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482566	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492095	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492747	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492771	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492779	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2497035	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502320	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502368	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502412	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502434	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502490	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513452	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513477	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2517010	REPORT
	https://access.redhat.com/errata/RHSA-2026:67471	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:10",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-10\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:6.12.0-211.55.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:67471"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)\n\n* kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)\n\n* kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)\n\n* kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)\n\n* kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)\n\n* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)\n\n* kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)\n\n* kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)\n\n* kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)\n\n* kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)\n\n* kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)\n\n* kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)\n\n* kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)\n\n* kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)\n\n* kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)\n\n* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)\n\n* kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)\n\n* kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)\n\n* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)\n\n* kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)\n\n* kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)\n\n* kernel: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (CVE-2026-68426)\n\n* kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)\n\nBug Fix(es) and Enhancement(s):\n\n* [rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling  (JIRA:Rocky Linux-245035)\n\n* RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:Rocky Linux-255233)\n\n* [Rocky Linux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255348)\n\n* [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [Rocky Linux-10.2.z] (JIRA:Rocky Linux-256731)\n\n* RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:Rocky Linux-256890)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:67471",
  "modified": "2026-09-26T06:14:41.706633Z",
  "published": "2026-09-16T12:09:37.746677Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:67471"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414466"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425039"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454867"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460699"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461451"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461462"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461525"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461575"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467084"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468192"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468244"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482566"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492095"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492747"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492771"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492779"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497035"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502320"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502368"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502412"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502434"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502490"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513452"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513477"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517010"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:67471"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2025-40149",
    "CVE-2025-68745",
    "CVE-2026-23466",
    "CVE-2026-31479",
    "CVE-2026-31539",
    "CVE-2026-31566",
    "CVE-2026-31656",
    "CVE-2026-31663",
    "CVE-2026-43248",
    "CVE-2026-43368",
    "CVE-2026-43370",
    "CVE-2026-46149",
    "CVE-2026-52924",
    "CVE-2026-53131",
    "CVE-2026-53239",
    "CVE-2026-53246",
    "CVE-2026-53361",
    "CVE-2026-63889",
    "CVE-2026-63917",
    "CVE-2026-63919",
    "CVE-2026-63921",
    "CVE-2026-64111",
    "CVE-2026-68264",
    "CVE-2026-68426",
    "CVE-2026-74556"
  ]
}

RLSA-2026:68531 (CVE-2026-23103)

Vulnerability from osv_rocky – Published: 2026-09-19 06:01 – Updated: 2026-09-26 06:14 – Source website

Summary

Important: kernel security update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:68531	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2436771	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2461462	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467135	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2468102	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2484456	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2486463	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492112	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492295	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492733	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492741	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492747	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492770	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492779	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492792	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492811	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492841	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502363	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502368	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502412	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502434	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513218	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513477	REPORT
	https://access.redhat.com/errata/RHSA-2026:68531	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:8",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-8\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:4.18.0-553.164.1.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:68531"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)\n\n* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)\n\n* kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)\n\n* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)\n\n* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)\n\n* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)\n\n* kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)\n\n* kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)\n\n* kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)\n\n* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)\n\n* kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)\n\n* kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)\n\n* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)\n\n* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)\n\n* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)\n\n* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)\n\n* kernel: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)\n\n* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)\n\n* kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)\n\n* kernel: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (CVE-2026-68426)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:68531",
  "modified": "2026-09-26T06:14:21.738328Z",
  "published": "2026-09-19T06:01:07.228044Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:68531"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436771"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461462"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467135"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468102"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484456"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492112"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492295"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492733"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492741"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492747"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492770"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492779"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492792"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492811"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492841"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502363"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502368"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502412"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502434"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513218"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513477"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:68531"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security update",
  "upstream": [
    "CVE-2026-23103",
    "CVE-2026-31663",
    "CVE-2026-43233",
    "CVE-2026-43339",
    "CVE-2026-46266",
    "CVE-2026-46306",
    "CVE-2026-52920",
    "CVE-2026-53075",
    "CVE-2026-53131",
    "CVE-2026-53176",
    "CVE-2026-53192",
    "CVE-2026-53223",
    "CVE-2026-53228",
    "CVE-2026-53239",
    "CVE-2026-53268",
    "CVE-2026-53275",
    "CVE-2026-63917",
    "CVE-2026-63919",
    "CVE-2026-63921",
    "CVE-2026-64002",
    "CVE-2026-68143",
    "CVE-2026-68426"
  ]
}

RLSA-2026:68532 (CVE-2026-23103)

Vulnerability from osv_rocky – Published: 2026-09-19 06:02 – Updated: 2026-09-26 06:14 – Source website

Summary

Important: kernel-rt security update

Details

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:68532	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2436771	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2461462	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467135	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2468102	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2484456	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2486463	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492112	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492295	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492733	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492741	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492747	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492770	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492779	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492792	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492811	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492841	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502363	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502368	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502412	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502434	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513218	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513477	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2516599	REPORT
	https://access.redhat.com/errata/RHSA-2026:68532	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:8",
        "name": "kernel-rt",
        "purl": "pkg:rpm/rocky-linux/kernel-rt?distro=rocky-linux-8\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "NFV"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:4.18.0-553.164.1.rt7.505.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:68532"
  },
  "details": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)\n\n* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)\n\n* kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)\n\n* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)\n\n* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)\n\n* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)\n\n* kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)\n\n* kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)\n\n* kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)\n\n* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)\n\n* kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)\n\n* kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)\n\n* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)\n\n* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)\n\n* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)\n\n* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)\n\n* kernel: ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)\n\n* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)\n\n* kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)\n\n* kernel: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (CVE-2026-68426)\n\n* kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:68532",
  "modified": "2026-09-26T06:14:35.924670Z",
  "published": "2026-09-19T06:02:23.579834Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:68532"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436771"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461462"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467135"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468102"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484456"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492112"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492295"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492733"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492741"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492747"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492770"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492779"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492792"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492811"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492841"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502363"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502368"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502412"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502434"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513218"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513477"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516599"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:68532"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel-rt security update",
  "upstream": [
    "CVE-2026-23103",
    "CVE-2026-31663",
    "CVE-2026-43233",
    "CVE-2026-43339",
    "CVE-2026-46266",
    "CVE-2026-46306",
    "CVE-2026-52920",
    "CVE-2026-53075",
    "CVE-2026-53131",
    "CVE-2026-53176",
    "CVE-2026-53192",
    "CVE-2026-53223",
    "CVE-2026-53228",
    "CVE-2026-53239",
    "CVE-2026-53268",
    "CVE-2026-53275",
    "CVE-2026-63917",
    "CVE-2026-63919",
    "CVE-2026-63921",
    "CVE-2026-64002",
    "CVE-2026-68143",
    "CVE-2026-68426",
    "CVE-2026-72298"
  ]
}

RLSA-2026:68570 (CVE-2026-23172)

Vulnerability from osv_rocky – Published: 2026-09-19 12:04 – Updated: 2026-09-26 06:14 – Source website

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)
kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)
kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)
kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)
kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)
kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)
kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)
kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)
kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)
kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)
kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)
kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)
kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)
kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)
kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)
kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)
kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)
kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

Bug Fix(es) and Enhancement(s):

gfs2: filesystem withdrawal rework [rhel-9.8.z] (JIRA:Rocky Linux-252540)
The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [rhel-9.8.z] (JIRA:Rocky Linux-252544)
gfs2: Get rid of sd_async_glock_wait [rhel-9.8.z] (JIRA:Rocky Linux-253986)
[Rocky Linux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255217)
[usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [rhel-9.8.z] (JIRA:Rocky Linux-256733)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:68570	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2439924	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2461462	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482098	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482127	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482550	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482618	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492436	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492741	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492742	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492750	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492779	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492792	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502295	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502347	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502368	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502412	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502434	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502438	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502575	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502580	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502596	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2511448	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513165	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513171	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513271	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513286	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513477	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2516490	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2516599	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2516679	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2516684	REPORT
	https://access.redhat.com/errata/RHSA-2026:68570	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:9",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-9\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:5.14.0-687.49.1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:68570"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)\n\n* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)\n\n* kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)\n\n* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)\n\n* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)\n\n* kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)\n\n* kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)\n\n* kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)\n\n* kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)\n\n* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)\n\n* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)\n\n* kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)\n\n* kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)\n\n* kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)\n\n* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)\n\n* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)\n\n* kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)\n\n* kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)\n\n* kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)\n\n* kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)\n\n* kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)\n\n* kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)\n\n* kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)\n\n* kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)\n\n* kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)\n\n* kernel: xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment (CVE-2026-68426)\n\n* kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)\n\n* kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)\n\n* kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)\n\n* kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)\n\nBug Fix(es) and Enhancement(s):\n\n* gfs2: filesystem withdrawal rework [rhel-9.8.z] (JIRA:Rocky Linux-252540)\n\n* The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [rhel-9.8.z] (JIRA:Rocky Linux-252544)\n\n* gfs2: Get rid of sd_async_glock_wait [rhel-9.8.z] (JIRA:Rocky Linux-253986)\n\n* [Rocky Linux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255217)\n\n* [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [rhel-9.8.z] (JIRA:Rocky Linux-256733)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:68570",
  "modified": "2026-09-26T06:14:39.366100Z",
  "published": "2026-09-19T12:04:58.550496Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:68570"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439924"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461462"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482098"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482127"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482550"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482618"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492436"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492741"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492742"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492750"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492779"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492792"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502295"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502347"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502368"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502412"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502434"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502438"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502575"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502580"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502596"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511448"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513165"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513171"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513271"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513286"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513477"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516490"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516599"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516679"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516684"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:68570"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-23172",
    "CVE-2026-31663",
    "CVE-2026-45910",
    "CVE-2026-46043",
    "CVE-2026-46114",
    "CVE-2026-46133",
    "CVE-2026-52971",
    "CVE-2026-53176",
    "CVE-2026-53192",
    "CVE-2026-53193",
    "CVE-2026-53196",
    "CVE-2026-53239",
    "CVE-2026-63869",
    "CVE-2026-63913",
    "CVE-2026-63917",
    "CVE-2026-63919",
    "CVE-2026-63921",
    "CVE-2026-64029",
    "CVE-2026-64174",
    "CVE-2026-64175",
    "CVE-2026-64176",
    "CVE-2026-64582",
    "CVE-2026-68128",
    "CVE-2026-68159",
    "CVE-2026-68200",
    "CVE-2026-68363",
    "CVE-2026-68426",
    "CVE-2026-72003",
    "CVE-2026-72102",
    "CVE-2026-72243",
    "CVE-2026-72298"
  ]
}

SUSE-SU-2026:22742-1

Vulnerability from csaf_suse - Published: 2026-07-21 08:27 - Updated: 2026-09-16 20:05

Summary

Security update for the Linux Kernel

Severity

Important

Scope

255 vulnerabilities in this advisory, including CVE-2026-31663.

CVE-2026-31663

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Recommended: 8 products

Open the full advisory

SUSE-SU-2026:22769-1

Vulnerability from csaf_suse - Published: 2026-07-21 08:27 - Updated: 2026-09-16 20:05

Summary

Security update for the Linux Kernel

Severity

Important

Scope

255 vulnerabilities in this advisory, including CVE-2026-31663.

CVE-2026-31663

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Recommended: 28 products

Open the full advisory

SUSE-SU-2026:22812-1

Vulnerability from csaf_suse - Published: 2026-07-21 08:27 - Updated: 2026-09-16 20:06

Summary

Security update for the Linux Kernel

Severity

Important

Scope

255 vulnerabilities in this advisory, including CVE-2026-31663.

CVE-2026-31663

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Recommended: 9 products

Open the full advisory

SUSE-SU-2026:22835-1

Vulnerability from csaf_suse - Published: 2026-07-21 08:27 - Updated: 2026-09-16 20:06

Summary

Security update for the Linux Kernel

Severity

Important

Scope

255 vulnerabilities in this advisory, including CVE-2026-31663.

CVE-2026-31663

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Recommended: 114 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-31663 (GCVE-0-2026-31663)

RHSA-2026:68532

RHSA-2026:68570

RLSA-2026:67471 (CVE-2025-40149)

RLSA-2026:68531 (CVE-2026-23103)

RLSA-2026:68532 (CVE-2026-23103)

RLSA-2026:68570 (CVE-2026-23172)

SUSE-SU-2026:22742-1

SUSE-SU-2026:22769-1

SUSE-SU-2026:22812-1

SUSE-SU-2026:22835-1

Tags

Sightings

Nomenclature

Related by attack behaviour