CLSA-2025-1747725447 kernel: Fix of 38 CVEs

ext4: fix OOB read when checking dotdot dir CVE-2025-37785 - wifi: iwlwifi: limit printed string from FW file CVE-2025-21905 - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpudiscoveryregbaseinit' CVE-2024-27042 - dm-crypt: don't modify the data when using authenticated encryption...

kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges

A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation LPE. This allows the attacker to gain root privileges and take full control o...

RHEL 8 : kernel (RHSA-2026:65711)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65711 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Bluetooth: hcievent: fix...

kernel: can: bcm: add locking for bcm_op runtime updates

A flaw was found in the Linux kernel's Controller Area Network CAN broadcast manager BCM. Improper locking during runtime updates of internal counters in the bcmcantx function allows a local attacker to trigger a slab-out-of-bounds read access. This vulnerability can lead to information disclosur...

kernel: can: bcm: add locking for bcm_op runtime updates

A flaw was found in the Linux kernel's Controller Area Network CAN broadcast manager BCM. Improper locking during runtime updates of internal counters in the bcmcantx function allows a local attacker to trigger a slab-out-of-bounds read access. This vulnerability can lead to information disclosur...

SUSE CVE-2026-72119

In the Linux kernel, the following vulnerability has been resolved: can: bcm: extend bcmtxlock usage for data and timer updates Stage new CAN frame content for an existing tx op into a kmalloc'd buffer and validate it there, mirroring the approach already used in bcmrxsetup. Only copy the validat...

MiracleLinux 8 : kernel-4.18.0-553.156.1.el8_10 (AXSA:2026-1750:72)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1750:72 advisory. kernel: mm/slub: avoid accessing metadata when pointer is invalid in objecterr CVE-2025-39902 kernel: drm/amdkfd: Fix out-of-bounds write in...

SUSE CVE-2026-72120

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu list annotations and operations sashiko-bot remarked the missing use of listaddrcu in bcmrx|txsetup to have a proper initialized bcmop structure when bcmprocshow traverses the bcmop's under rcureadlock. ...

SUSE CVE-2026-72121

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup when updating timer and filter content while bcmrxhandler, bcmrxtimeouthandler...

SUSE CVE-2026-72122

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix lockless bound/ifindex race and silent RXSETUP failure bcmsendmsg reads bo-ifindex and checks bo-bound before taking locksock, while bcmnotify, bcmconnect and bcmrelease all mutate both fields under that same lock...

SUSE CVE-2026-72123

In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use callrcu instead of costly synchronizercu" replaced synchronizercu in bcmdeleterxop with callrcu and introduced the RXNOAUTOTIME...

SUSE CVE-2026-72115

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

SUSE CVE-2026-72116

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix stale rx/tx ops after device removal RX: an RXSETUP update! for an existing op skipped canrxregister unconditionally, even when a concurrent NETDEVUNREGISTER had already torn down its registration op-rxregdev == NUL...

SUSE CVE-2026-72117

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix data race on rxstamp/rxifindex in bcmrxhandler For an rx op subscribed on all interfaces ifindex == 0, the same op is registered once in the shared per-netns wildcard filter list, so bcmrxhandler can run concurrentl...

SUSE CVE-2026-72114

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

SUSE CVE-2026-72118

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix CAN frame rx/tx statistics KCSAN detected a data race within the bcmrxhandler when two CAN frames have been simultaneously received and processed in a single rx op by two different CPUs. Use atomic operations with...

SUSE CVE-2026-72113

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing device refcount for CAN filter removal sashiko-bot remarked a problem with a concurrent device unregistration in isotp.c which also is present in the bcm.c code. A former fix for raw.c commit c275a176e4b6...

Oracle Linux 8 : kernel (ELSA-2026-55764)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55764 advisory. - udf: fix partition descriptor append bookkeeping Ravi Singh RHEL-179571 CVE-2026-45991 - ice: fix double-free of txbuf skb Michal Schmidt RHEL-19219...

kernel security, bug fix, and enhancement update

4.18.0-553.155.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

CVE-2026-72123

A use-after-free flaw was found in the Linux kernel's CAN BCM Broadcast Manager subsystem. During RX operation teardown, a concurrent receive handler can race and re-arm the throttle timer after the operation has been scheduled for deallocation. When the deallocation completes, the timer is still...