356115 matches found
RLSA-2026:93413 Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Kernel: Denial of Service in network socket error handling CVE-2026-22977 kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache CVE-2026-46174 kernel: i2c...
RLSA-2026:93412 Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-52929 kernel: ipv6: sit: reload inner IPv6 header after GSO offloads CVE-2026-53228 kernel: ipvs: clear the svc scheduler pt...
CVE-2026-99269 sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
In the Linux kernel, the following vulnerability has been resolved: schedext: Wait for SCXOPSSDISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue and hasn't cleared SCXOPSSDISPATCHING. The DSQ consume and...
EUVD-2026-115794
In the Linux kernel, the following vulnerability has been resolved: schedext: Wait for SCXOPSSDISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue and hasn't cleared SCXOPSSDISPATCHING. The DSQ consume and...
CVE-2026-99269
The Linux kernel is affected by a vulnerability in sched_ext where a task can be found on a non-local DSQ while the dispatching CPU is still executing ops.dequeue() and has not yet cleared SCX_OPSS_DISPATCHING . This occurs because the DSQ consume and move paths do not wait for the dispatch to fi...
CVE-2026-99269 sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
In the Linux kernel, the following vulnerability has been resolved: schedext: Wait for SCXOPSSDISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue and hasn't cleared SCXOPSSDISPATCHING. The DSQ consume and...
EUVD-2026-115793
In the Linux kernel, the following vulnerability has been resolved: iouring: wake ring pollers for local taskwork With IORINGSETUPDEFERTASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for events. For an application that finds out via...
EUVD-2026-115792
In the Linux kernel, the following vulnerability has been resolved: iouring/napi: make stale entries time out after 60s With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined a...
EUVD-2026-115791
In the Linux kernel, the following vulnerability has been resolved: iouring/zcrx: fix buffer offsets in areas above 4GB iozcrxqueuecqe computes the offset of the buffer in its area from netiovidx, which is an unsigned int, so the shift is done in 32 bits and only the result is widened to the u64...
CVE-2026-99268
The Linux kernel contains a vulnerability in the io_uring subsystem related to how local task work wakes ring pollers. When using IORING_SETUP_DEFER_TASKRUN, completions are queued as local work and only become CQEs when the submitter enters the kernel. A logic issue occurs where the ->poll_wq...
CVE-2026-99267
The Linux kernel is affected by a vulnerability in the io_uring/napi component where stale NAPI IDs are not properly dropped from the list used by busy polls. The root cause is an incorrect timeout calculation: the code uses SEC_CONVERSION instead of the actual jiffies per second, resulting in a ...
CVE-2026-99266
The Linux kernel is affected by a vulnerability in the io_uring/zcrx component. The root cause is that io_zcrx_queue_cqe() computes buffer offsets using net_iov_idx(), which is an unsigned int . This causes shifts to occur in 32 bits before being widened to u64 . In areas larger than 4GB (up to 1...
EUVD-2026-115790
In the Linux kernel, the following vulnerability has been resolved: iouring/openclose: keep the lock in iopipefixed iopipefixed installs both ends of the pipe in the fixed file table, drops -uringlock, and copies the slot numbers to the application. If that faults, it takes the lock again and...
EUVD-2026-115789
In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't retry recv on uncommitted buffers Commit 41b70df5b38b "iouring/net: commit partial buffers on retry" commits ring provided buffers when a receive is going to be retried after a partial transfer, so that another...
CVE-2026-99265
The Linux kernel contains a vulnerability in io_uring/openclose related to the io_pipe_fixed() function. The issue occurs because the ->uring_lock is dropped before copying slot numbers to the application; if the copy faults, the error path re-acquires the lock and removes content from slots t...