RLSA-2026:57251 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: drm/amdkfd: Fix out-of-bounds write in kfdeventpageset CVE-2026-43206 kernel: drm/amdgpu: Refactor amdgpugemvaioctl for Handling Last Fence Update and Timeline Management v4 CVE-2026-4323...

CVE-2026-74444

A flaw was found in the Linux kernel's drm/vmwgfx driver. A local attacker could exploit an issue in the vmwcmddraw function by providing a specially crafted DRAWPRIMITIVES header with an undersized value. This can lead to an out-of-bounds read of kernel memory, potentially allowing for informati...

CVE-2026-74577

A flaw was found in the Linux kernel's Multiprotocol Label Switching MPLS networking component. When processing an RTMGETROUTE request, the mplsgetroute function fails to initialize a specific byte in the response message. This oversight allows a local user to obtain a single byte of uninitialize...

CVE-2026-74575

A flaw was found in the Thunderbolt XDomain driver of the Linux kernel. A race condition can occur during the removal of a Thunderbolt cross-domain device XDomain. This allows a delayed work item to be queued after its cancellation but before the XDomain object is freed, leading to a use-after-fr...

CVE-2026-74552

A flaw was found in the Linux kernel's hwmon lm90 driver. A local user can trigger a null pointer dereference by reading sysfs attributes before the driver's registration is complete. This can lead to a system crash, resulting in a denial of service...

CVE-2026-74548

A flaw was found in the forcedeth component of the Linux kernel. The nvremove function frees the per-CPU txrxstats before unregisternetdev completes. This timing issue allows other functions, such as ndogetstats64, the NAPI/xmit data path, and nvclose/drain, to access the freed memory, leading to...

CVE-2026-74540

A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A use-after-free UAF vulnerability exists in the l2capleconnectrsp function, where a channel can be freed while still being referenced. This can be triggered by a remote disconnect,...

CVE-2026-74534

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. A race condition between isoconndel and isochandel functions can lead to a double-put of isoconn objects. This can result in a Use-After-Free UAF vulnerability, potentially allowing an attacker to cause a denial of service or achieve...

CVE-2026-74523

A flaw was found in the Linux kernel's qede network driver. When a qede Network Interface Card NIC with VXLAN/GENEVE tunnel ports experiences a transmit TX timeout, a deadlock can occur in the driver's recovery process. This deadlock prevents the system's networking control plane from responding,...

CVE-2026-74466

A flaw was found in the Linux kernel's s390/zcrypt component. Under specific conditions, a user-controlled domain value, derived from CCA or EP11 ioctl structures, is used as an array index without a proper speculation barrier. This oversight could allow for speculative memory reads, potentially...

CVE-2026-74463

A flaw was found in the Linux kernel's i2c: jz4780 driver. A severe deadlock can occur between the Common Clock Framework CCF and the I2C adapter lock. This happens when an I2C-controlled clock generator client is registered or modified, and a concurrent I2C transfer attempts to acquire a lock...

CVE-2026-74457

A flaw was found in the Linux kernel's peakusb module. A malicious USB device could send a specially crafted payload, leading to a heap out-of-bounds read. This vulnerability can cause a kernel panic, resulting in a Denial of Service DoS for the affected system...

CVE-2026-74449

A flaw was found in the display driver component of the Linux kernel. A local attacker could exploit a vulnerability related to how the system handles display settings, specifically when processing certain display configurations. This could lead to a system crash, resulting in a Denial of Service...

CVE-2026-74556

A flaw was found in the Linux kernel's libiscsitcp component. A remote attacker, acting as a malicious iSCSI target, could send a specially crafted iSCSI SCSI Command Response ISCSIOPSCSICMDRSP with an oversized data segment. This could lead to a buffer overflow in a fixed-size buffer, potentiall...

CVE-2026-74443

A flaw was found in the Linux kernel's drm/vmwgfx component. A local attacker could exploit a vulnerability in the vmwcmddma function, where an undersized header in a Direct Memory Access DMA command body causes a pointer to underflow. This allows the attacker to overwrite authenticated fields of...

CVE-2026-74572

A flaw was found in the Linux kernel's btrfs zoned filesystem. A local user could trigger a deadlock when metadata writeback and transaction commit operations occur simultaneously. This deadlock causes the system to hang, leading to a Denial of Service DoS...

CVE-2026-74462

A flaw was found in the Linux kernel's i.MX I2C driver. During system suspend and resume, a time window exists where I2C controller resources may be disabled or not yet restored. If a workqueue triggers an I2C transfer during this period, the driver attempts to access unavailable hardware...

CVE-2026-74567

A flaw was found in the Linux kernel's key management subsystem. An unprivileged local attacker could exploit an out-of-bounds read vulnerability in the keyringgetkeychunk function. By providing specially crafted keys, the attacker can cause the system to read beyond its intended memory boundarie...

CVE-2026-74441

A flaw was found in the Linux kernel's USB Type-C UCSI driver. This vulnerability arises from a timing issue during the unregistration of USB Type-C ports, where certain operations can race against the destruction of internal work queues. A local attacker could exploit this race condition to...

CVE-2026-74553

A flaw was found in the Linux kernel's hwmon hardware monitoring subsystem, specifically within the nct6775-core driver. This vulnerability arises from incorrect handling of temperature registers for the NCT6116 chip, where the driver attempts to access more registers than are available. This...