CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2025:1738663660)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2025:1738663660 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2024:1731431059)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2024:1731431059 advisory. - A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way...

PT-2026-116715

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt work after releasing the WDT IRQ airoha npu remove calls cancel work sync on each core's wdt work, but the watchdog IRQ that queues it is requested with devm request irq and is freed only after .remov...

PT-2026-116760

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOU ATTR IPPROTO on FOU ENCAP DIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOU ATTR IPPROTO." added NLA POLICY MINNLA U8, 1 to fou nl policyFOU ATTR IPPROTO, which rejects an explicitly supplied FOU ATTR...

PT-2026-116774

In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc mac hdr init failure In llc conn ac resend i xxx x set 0 or send rr, if llc mac hdr init fails, kfree skbskb is called instead of kfree skbnskb. This leaks the newly allocated nskb, reads from th...

PT-2026-116780

In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfp net ipsec rx drops the XArray lock before taking a reference to the xfrm state it found. The delete path can erase the entry and drop the last state reference in that interval. R...

PT-2026-116799

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in accept queue lifecycle In nfc llcp socket release, sockets and listener accept queues are walked under the local sockets rwlock and bh lock sock. However, bh lock sock does not synchronise against...

PT-2026-116821

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bnep rx frame and bnep ctrl frame net/bluetooth/bnep/core.c, use ps...

PT-2026-116825

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtio gpu vram create errors virtio gpu vram create frees the object with a bare kfreevram on both error paths after drm gem private object init has run, and on the second one after drm gem...

PT-2026-117085

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Introduce task struct-sched cache grp to fix UAF Add a sched cache grp pointer to task struct so that scheduler code can access the cache group directly via the task, without going through mm-sched cache grp. This...

PT-2026-116676

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2cap data rcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefo...

PT-2026-116699

In the Linux kernel, the following vulnerability has been resolved: nfc: trf7970a: power down on startup RX gain failure trf7970a startup powers up the device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up. Probe's...

PT-2026-116749

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix permanent hang when flushing the kprobe optimizer Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized never returns. The writer sleeps in D state forever with kprobe sysctl mutex held, ...

PT-2026-116756

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current pwq deref in flush dependency check check flush dependency uses current wq worker to determine whether the caller is a workqueue worker and then dereferences worker-current pwq to test whether the...

PT-2026-116767

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

PT-2026-116772

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofs kill sb When autofs fill super fails before clearing AUTOFS SBI CATATONIC for example, when find get pid fails on an invalid pgrp mount option, or when an fs context is closed...

PT-2026-116783

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530 remove common disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is on...

PT-2026-116798

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfc genl llc sdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfc llcp send snl sdr...

PT-2026-116810

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skb pointer if linear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. Th...

PT-2026-116653

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A range check was missing in the proc dointvec ms jiffies minmax function within the sysctl component. This occurred because a previous update to replace the SYSCTL INT CONV CUSTOM macro...