Vulnerability-Lookup

CVE-2026-43493 (GCVE-0-2026-43493)

Vulnerability from cvelistv5 – Published: 2026-05-19 10:44 – Updated: 2026-08-05 12:28

Title

crypto: pcrypt - Fix handling of MAY_BACKLOG requests

Summary

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

8 references

URL	Tags
https://git.kernel.org/stable/c/ae7e95638d956d556…
https://git.kernel.org/stable/c/1d7f07df450bac330…
https://git.kernel.org/stable/c/76641449b28979ebd…
https://git.kernel.org/stable/c/9f1cbca178c03188e…
https://git.kernel.org/stable/c/eb34e243df57e32f4…
https://git.kernel.org/stable/c/77d55bc8675ee851e…
https://git.kernel.org/stable/c/46271895ddfb1ba41…
https://git.kernel.org/stable/c/915b692e6cb723aac…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < ae7e95638d956d556d74b9abb9e780d3bd3dcd9e (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 1d7f07df450bac3301938fbc4251f2611be4084e (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 76641449b28979ebd6c02e9598367e119e385236 (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 9f1cbca178c03188e201ed175251372149bb25f2 (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < eb34e243df57e32f4c08fa191f3602ea19076276 (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 77d55bc8675ee851ed639dc9be77325a8024cf67 (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a (git) Affected: 5a1436beec5744029f3ac90b6fe71a698dcd6155 , < 915b692e6cb723aac658c25eb82c58fd81235110 (git)	guessed
Linux	Linux	Affected: 2.6.34 Unaffected: 0 , < 2.6.34 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.140 , ≤ 6.6.* (semver) Unaffected: 6.12.86 , ≤ 6.12.* (semver) Unaffected: 6.18.27 , ≤ 6.18.* (semver) Unaffected: 7.0.4 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/pcrypt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae7e95638d956d556d74b9abb9e780d3bd3dcd9e",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "1d7f07df450bac3301938fbc4251f2611be4084e",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "76641449b28979ebd6c02e9598367e119e385236",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "9f1cbca178c03188e201ed175251372149bb25f2",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "eb34e243df57e32f4c08fa191f3602ea19076276",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "77d55bc8675ee851ed639dc9be77325a8024cf67",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            },
            {
              "lessThan": "915b692e6cb723aac658c25eb82c58fd81235110",
              "status": "affected",
              "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/pcrypt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - Fix handling of MAY_BACKLOG requests\n\nMAY_BACKLOG requests can return EBUSY.  Handle them by checking\nfor that value and filtering out EINPROGRESS notifications."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - pcrypt AEAD can sit under network-facing kernel crypto consumers such as kTLS/TIPC that process peer-supplied records or packets. In the highest reasonable deployment, a remote peer can drive the vulnerable encrypt/decrypt path through network traffic.\nAC:L - The trigger is child crypto backlog behavior under `CRYPTO_TFM_REQ_MAY_BACKLOG`; an attacker can induce queue pressure with concurrent requests or traffic. There is no race that depends on conditions outside the attacker\u0027s control.\nPR:N - The network-facing path requires no kernel privileges from the remote peer. The local AF_ALG AEAD path also has no capability gate, but the higher-severity network scenario is defensible.\nUI:N - No victim interaction is required once the affected crypto consumer is configured. The attacker only sends data or submits crypto requests.\nS:U - The bug corrupts kernel crypto/request state within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other scope-changing boundary crossing.\nC:H - Mishandling `-EBUSY` can complete and free the request while the child request remains queued, leading to use-after-free on later callbacks. A kernel UAF is reasonably exploitable for high-impact information disclosure.\nI:H - The stale callback reuses freed request/padata memory and can drive list operations and completion paths on attacker-reclaimed objects. This is memory corruption with a plausible path to arbitrary write or control-flow corruption.\nA:H - At minimum, the premature completion and later queued callback can dereference or manipulate freed kernel memory. That can produce kernel oops/panic or list corruption, giving high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:16.602Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae7e95638d956d556d74b9abb9e780d3bd3dcd9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d7f07df450bac3301938fbc4251f2611be4084e"
        },
        {
          "url": "https://git.kernel.org/stable/c/76641449b28979ebd6c02e9598367e119e385236"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f1cbca178c03188e201ed175251372149bb25f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb34e243df57e32f4c08fa191f3602ea19076276"
        },
        {
          "url": "https://git.kernel.org/stable/c/77d55bc8675ee851ed639dc9be77325a8024cf67"
        },
        {
          "url": "https://git.kernel.org/stable/c/46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a"
        },
        {
          "url": "https://git.kernel.org/stable/c/915b692e6cb723aac658c25eb82c58fd81235110"
        }
      ],
      "title": "crypto: pcrypt - Fix handling of MAY_BACKLOG requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43493",
    "datePublished": "2026-05-19T10:44:25.402Z",
    "dateReserved": "2026-05-01T14:12:56.013Z",
    "dateUpdated": "2026-08-05T12:28:16.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43493",
      "date": "2026-09-30",
      "epss": "0.00755",
      "percentile": "0.53374"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-22T01:39:49.000Z",
      "cve": "CVE-2026-43493",
      "id": "msrc_CVE-2026-43493",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "crypto: pcrypt - Fix handling of MAY_BACKLOG requests",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43493.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "crypto/pcrypt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ae7e95638d956d556d74b9abb9e780d3bd3dcd9e",
                    "status": "affected",
                    "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1d7f07df450bac3301938fbc4251f2611be4084e",
                    "status": "affected",
                    "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "76641449b28979ebd6c02e9598367e119e385236",
                    "status": "affected",
                    "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9f1cbca178c03188e201ed175251372149bb25f2",
                    "status": "affected",
                    "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eb34e243df57e32f4c08fa191f3602ea19076276",
                    "status": "affected",
                    "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "77d55bc8675ee851ed639dc9be77325a8024cf67",
                    "status": "affected",
                    "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a",
                    "status": "affected",
                    "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "915b692e6cb723aac658c25eb82c58fd81235110",
                    "status": "affected",
                    "version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "crypto/pcrypt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.34"
                  },
                  {
                    "lessThan": "2.6.34",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.258",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.209",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.175",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.140",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.86",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.27",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B07D4ABF-AED6-4ADB-A7DE-7A990429D41B",
                    "versionEndExcluding": "5.10.258",
                    "versionStartIncluding": "2.6.34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4",
                    "versionEndExcluding": "5.15.209",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA",
                    "versionEndExcluding": "6.1.175",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D",
                    "versionEndExcluding": "6.6.140",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "55DA1C62-9991-451E-B8A8-E0004E00F789",
                    "versionEndExcluding": "6.12.86",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A10AC84F-C058-47D5-85B4-E6E51A613B74",
                    "versionEndExcluding": "6.18.27",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3",
                    "versionEndExcluding": "7.0.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - Fix handling of MAY_BACKLOG requests\n\nMAY_BACKLOG requests can return EBUSY.  Handle them by checking\nfor that value and filtering out EINPROGRESS notifications."
          }
        ],
        "id": "CVE-2026-43493",
        "lastModified": "2026-06-26T17:30:15.903",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-05-19T12:16:19.020",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1d7f07df450bac3301938fbc4251f2611be4084e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/76641449b28979ebd6c02e9598367e119e385236"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/77d55bc8675ee851ed639dc9be77325a8024cf67"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/915b692e6cb723aac658c25eb82c58fd81235110"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9f1cbca178c03188e201ed175251372149bb25f2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ae7e95638d956d556d74b9abb9e780d3bd3dcd9e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/eb34e243df57e32f4c08fa191f3602ea19076276"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-10T03:34:59+00:00",
      "cve": "CVE-2026-43493",
      "id": "CVE-2026-43493",
      "initial_release_date": "2026-05-19T00:00:00+00:00",
      "product_status:fixed": "762",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43493.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:13:42Z",
      "cve": "CVE-2026-43493",
      "id": "CVE-2026-43493",
      "initial_release_date": "2026-05-20T02:28:25Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "649",
      "product_status:known_not_affected": "17",
      "product_status:recommended": "380",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43493",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43493.json",
      "version": "12"
    }
  }
}

RHSA-2026:64770

Vulnerability from csaf_redhat - Published: 2026-09-08 02:09 - Updated: 2026-09-29 16:54

Summary

Red Hat Security Advisory: kernel-rt security update

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-43493.

CVE-2026-43493

A flaw was found in the Linux kernel's `pcrypt` component. This vulnerability involves how the system handles certain requests, specifically `MAY_BACKLOG` requests, which can indicate a temporary busy state. If not properly managed, the system's processing of these requests could lead to resource exhaustion or instability.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 30 products

https://access.redhat.com/errata/RHSA-2026:64770

Open the full advisory

RHSA-2026:66000

Vulnerability from csaf_opensuse - Published: 2026-09-09 15:22 - Updated: 2026-09-29 16:54

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-43493.

CVE-2026-43493

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 120 products

https://access.redhat.com/errata/RHSA-2026:66000

Open the full advisory

RHSA-2026:66180

Vulnerability from csaf_opensuse - Published: 2026-09-10 00:39 - Updated: 2026-09-30 15:17

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Severity

Important

Scope

17 vulnerabilities in this advisory, including CVE-2026-43493.

CVE-2026-43493

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 303 products

https://access.redhat.com/errata/RHSA-2026:66180

Open the full advisory

RLSA-2026:57251 (CVE-2026-43206)

Vulnerability from osv_rocky – Published: 2026-08-21 12:07 – Updated: 2026-09-04 12:13 – Source website

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)
kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)
kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)
kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)
kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)
kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)
kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)
kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)
kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)
kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)
kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

Bug Fix(es) and Enhancement(s):

CLONE - Rocky Linux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:Rocky Linux-223954)
vhost: reset the vring metadata cache on vring reconfiguration [rhel-10.2.z] (JIRA:Rocky Linux-224545)
cifs: periodic IO errors when rename races with lease break [rhel-10.2.z] (JIRA:Rocky Linux-235459)
cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10.2.z] (JIRA:Rocky Linux-235812)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:57251	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2482124	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502329	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2495950	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502422	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2479812	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467202	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507135	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482113	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467156	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492719	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2506790	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513470	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482558	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502443	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502188	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492403	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502321	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2508504	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507042	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507216	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502463	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492768	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2495941	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502449	REPORT
	https://access.redhat.com/errata/RHSA-2026:57251	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:10",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-10-riscv64\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:6.12.0-211.49.1.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:57251"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)\n\n* kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)\n\n* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)\n\n* kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)\n\n* kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)\n\n* kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)\n\n* kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)\n\n* kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)\n\n* kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)\n\n* kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)\n\n* kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)\n\n* kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)\n\n* kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)\n\n* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)\n\n* kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)\n\n* kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)\n\n* kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017)\n\n* kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)\n\n* kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)\n\n* kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)\n\n* kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)\n\n* kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)\n\n* kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)\n\n* kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)\n\nBug Fix(es) and Enhancement(s):\n\n* CLONE - Rocky Linux 10.2.z xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (JIRA:Rocky Linux-223954)\n\n* vhost: reset the vring metadata cache on vring reconfiguration [rhel-10.2.z] (JIRA:Rocky Linux-224545)\n\n* cifs: periodic IO errors when rename races with lease break [rhel-10.2.z] (JIRA:Rocky Linux-235459)\n\n* cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-10.2.z] (JIRA:Rocky Linux-235812)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:57251",
  "modified": "2026-09-04T12:13:19.866601Z",
  "published": "2026-08-21T12:07:48.154734Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:57251"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482124"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502329"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495950"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502422"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479812"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467202"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507135"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482113"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467156"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492719"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506790"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513470"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482558"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502443"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502188"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492403"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502321"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508504"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507042"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507216"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492768"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495941"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502449"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:57251"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-43206",
    "CVE-2026-43237",
    "CVE-2026-43493",
    "CVE-2026-45878",
    "CVE-2026-45991",
    "CVE-2026-46185",
    "CVE-2026-52991",
    "CVE-2026-53136",
    "CVE-2026-53143",
    "CVE-2026-53329",
    "CVE-2026-53356",
    "CVE-2026-53374",
    "CVE-2026-63879",
    "CVE-2026-63884",
    "CVE-2026-63886",
    "CVE-2026-63888",
    "CVE-2026-63952",
    "CVE-2026-64017",
    "CVE-2026-64219",
    "CVE-2026-64379",
    "CVE-2026-64382",
    "CVE-2026-64386",
    "CVE-2026-64560",
    "CVE-2026-68388"
  ]
}

RLSA-2026:64770 (CVE-2026-43493)

Vulnerability from osv_rocky – Published: 2026-09-09 06:02 – Updated: 2026-09-23 06:12 – Source website

Summary

Important: kernel-rt security update

Details

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:64770	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2479812	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492329	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502361	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2510892	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513373	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2516731	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2517046	REPORT
	https://access.redhat.com/errata/RHSA-2026:64770	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:8",
        "name": "kernel-rt",
        "purl": "pkg:rpm/rocky-linux/kernel-rt?distro=rocky-linux-8\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "NFV"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:4.18.0-553.160.1.rt7.501.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:64770"
  },
  "details": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)\n\n* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)\n\n* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)\n\n* kernel: rhashtable: clear stale iter-\u003ep on table restart (CVE-2026-64563)\n\n* kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)\n\n* kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)\n\n* kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:64770",
  "modified": "2026-09-23T06:12:45.411363Z",
  "published": "2026-09-09T06:02:22.608167Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:64770"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479812"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492329"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502361"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510892"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513373"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516731"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517046"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:64770"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel-rt security update",
  "upstream": [
    "CVE-2026-43493",
    "CVE-2026-53002",
    "CVE-2026-64007",
    "CVE-2026-64563",
    "CVE-2026-68343",
    "CVE-2026-72129",
    "CVE-2026-74480"
  ]
}

RLSA-2026:66180 (CVE-2026-43133)

Vulnerability from osv_rocky – Published: 2026-09-11 12:05 – Updated: 2026-09-25 12:14 – Source website

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)
kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330)
kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366)
kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)
kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)
kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

Bug Fix(es) and Enhancement(s):

KSM to deduplicate only zero pages [rhel-9.8.z] (JIRA:Rocky Linux-249161)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:66180	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2467065	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2468102	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2479812	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2481936	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482566	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2484456	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2486463	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2486999	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492329	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492811	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492841	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2501252	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502394	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2510892	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2511932	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2516731	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2517046	REPORT
	https://access.redhat.com/errata/RHSA-2026:66180	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:9",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-9\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:5.14.0-687.46.1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:66180"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)\n\n* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)\n\n* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)\n\n* kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)\n\n* kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)\n\n* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)\n\n* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)\n\n* kernel: Revert \"net/smc: Introduce TCP ULP support\" (CVE-2026-46330)\n\n* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)\n\n* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)\n\n* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)\n\n* kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366)\n\n* kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)\n\n* kernel: rhashtable: clear stale iter-\u003ep on table restart (CVE-2026-64563)\n\n* kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)\n\n* kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)\n\n* kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)\n\nBug Fix(es) and Enhancement(s):\n\n* KSM to deduplicate only zero pages [rhel-9.8.z] (JIRA:Rocky Linux-249161)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:66180",
  "modified": "2026-09-25T12:14:06.605480Z",
  "published": "2026-09-11T12:05:26.835797Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:66180"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467065"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468102"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479812"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481936"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482566"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484456"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486999"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492329"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492811"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492841"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501252"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502394"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510892"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511932"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516731"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517046"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:66180"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-43133",
    "CVE-2026-43339",
    "CVE-2026-43493",
    "CVE-2026-46015",
    "CVE-2026-46149",
    "CVE-2026-46266",
    "CVE-2026-46306",
    "CVE-2026-46330",
    "CVE-2026-53002",
    "CVE-2026-53223",
    "CVE-2026-53275",
    "CVE-2026-53366",
    "CVE-2026-64034",
    "CVE-2026-64563",
    "CVE-2026-64597",
    "CVE-2026-72129",
    "CVE-2026-74480"
  ]
}

SUSE-SU-2026:23066-1

Vulnerability from csaf_suse - Published: 2026-08-11 20:56 - Updated: 2026-09-30 11:15

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-43493.

CVE-2026-43493

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 8 products

Open the full advisory

SUSE-SU-2026:23068-1

Vulnerability from csaf_suse - Published: 2026-08-11 21:26 - Updated: 2026-09-30 11:15

Summary

Security update for the Linux Kernel

Severity

Important

Scope

894 vulnerabilities in this advisory, including CVE-2026-43493.

CVE-2026-43493

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 28 products

Open the full advisory

SUSE-SU-2026:23193-1

Vulnerability from csaf_suse - Published: 2026-08-18 18:56 - Updated: 2026-09-30 15:56

Summary

Security update for the Linux Kernel

Severity

Important

Scope

648 vulnerabilities in this advisory, including CVE-2026-43493.

CVE-2026-43493

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 7 products

Open the full advisory

SUSE-SU-2026:23194-1

Vulnerability from csaf_suse - Published: 2026-08-18 19:48 - Updated: 2026-09-30 15:56

Summary

Security update for the Linux Kernel

Severity

Important

Scope

647 vulnerabilities in this advisory, including CVE-2026-43493.

CVE-2026-43493

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Recommended: 14 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-43493 (GCVE-0-2026-43493)

RHSA-2026:64770

RHSA-2026:66000

RHSA-2026:66180

RLSA-2026:57251 (CVE-2026-43206)

RLSA-2026:64770 (CVE-2026-43493)

RLSA-2026:66180 (CVE-2026-43133)

SUSE-SU-2026:23066-1

SUSE-SU-2026:23068-1

SUSE-SU-2026:23193-1

SUSE-SU-2026:23194-1

Tags

Sightings

Nomenclature

Related by attack behaviour