RLSA-2026:95212 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-52929 kernel: net/smc: fix UAF in smccdcrxhandler by pinning the socket CVE-2026-64541 kernel: sctp: clear newtransport when...

kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

A flaw was found in the Linux kernel's Shared Memory Communications over RDMA SMC-R subsystem. A race condition allows a network socket to be released and freed while incoming messages are still being processed, leading to a use-after-free condition. A local attacker interacting with active SMC-R...

kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

A flaw was found in the Linux kernel's Shared Memory Communications over RDMA SMC-R subsystem. A race condition allows a network socket to be released and freed while incoming messages are still being processed, leading to a use-after-free condition. A local attacker interacting with active SMC-R...

kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

A flaw was found in the Linux kernel's Shared Memory Communications over RDMA SMC-R subsystem. A race condition allows a network socket to be released and freed while incoming messages are still being processed, leading to a use-after-free condition. A local attacker interacting with active SMC-R...

ALSA-2026:95212 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-52929 kernel: net/smc: fix UAF in smccdcrxhandler by pinning the socket CVE-2026-64541 kernel: sctp: clear newtransport when...

ALSA-2026:95100 Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-52929 kernel: net/smc: fix UAF in smccdcrxhandler by pinning the...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-52929 kernel: net/smc: fix UAF in smccdcrxhandler by pinning the socket CVE-2026-64541 kernel: sctp: clear newtransport when...

Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-52929 kernel: net/smc: fix UAF in smccdcrxhandler by pinning the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This creates a window where smccloseactive c...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: smc: Fixed use-after-free in pnetfindbasendev. SyZBot reported a use-after-free of netdevice in pnetfindbasendev, which was called during connect. 0 smcpnetfindismresource retrieves skdstgetsk-dev and passes it down to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice passes RMB pages to a pipe and takes a socket reference per entry, ensuring that the smcsock remains alive until the reader finishes. However, concurrent closes trigg...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination smclgrterminate drops connslock after finding a connection in lgr-connsall, but before taking a reference on its socket. The connection is embedded in the socket, a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct using a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowloc...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: free stashed qentry before overwrite in REQADDLINK to ADDLINK transition When smcllceventhandler transitions the local LLC flow from SMCLLCFLOWREQADDLINK to SMCLLCFLOWADDLINK upon receiving an ADDLINK request, it calls...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection remains alive while the CDC slot is fetched: sockhold&smc-sk;...

CVE-2026-99032

A flaw was found in the Linux kernel's Shared Memory Communications SMC subsystem. A race condition in the smcgetname function allows an underlying socket to be released while its address information is being retrieved. A local user can exploit this vulnerability to trigger a use-after-free...

kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice

A flaw was found in the Linux kernel's smcrxsplice function within the net: smc component. This vulnerability arises from an imbalance in the lifetime management of splice entries, where page references are not properly handled before being passed to splicetopipe. This can lead to a reference cou...

AZL-110891 CVE-2026-99032 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smcgetname smcgetname dereferences smc-clcsock without holding clcsockreleaselock. Link-group termination can release the CLC socket through smccloseactiveabort while the SMC socket is still...

UBUNTU-CVE-2026-99032

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smcgetname smcgetname dereferences smc-clcsock without holding clcsockreleaselock. Link-group termination can release the CLC socket through smccloseactiveabort while the SMC socket is still...

CVE-2026-99032 net/smc: protect clcsock lifetime in smc_getname

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smcgetname smcgetname dereferences smc-clcsock without holding clcsockreleaselock. Link-group termination can release the CLC socket through smccloseactiveabort while the SMC socket is still...