badepoll-selinux-disabler

badepoll-selinux-disabler Standalone extraction of the SELinux-disabling stage from the CVE-2026-43074 eventpoll UAF exploit. It races the eventpoll loop-depth check epgetupwardsdepthproc to write a zero into selinuxstate.enforcing, switching the device to Permissive via a single-byte kernel writ...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43074)

In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, epfree in eventpoll.c will kfree the epi-ep eventpoll struct while it still being used by another concurrent thread. Defer the kfree to an RCU...

Unbreakable Enterprise kernel security update

5.15.0-325.221.6.4 - ipv4: free inetopt and ireqopt after an RCU grace period Eric Dumazet Orabug: 40167661 CVE-2026-98432 - ipv4: validate checksumstart before completing checksum Michael S. Tsirkin Orabug: 40167656 CVE-2026-99999 - netfilter: nfnetlinkqueue: unbreak SCTP traffic Antonio Ojea...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: eventpoll: Fixed semi-unbounded recursion. Ensured that epoll instances never form a graph with more than EPMAXNESTS+1 links. Currently, eploopcheckproc ensures that the graph is free of loops and performs some recursion depth...

Unbreakable Enterprise kernel security update

5.15.0-325.221.6.2 - eventpoll: fix epremove struct eventpoll / struct file UAF Christian Brauner Orabug: 39784995 CVE-2026-46242 - eventpoll: move epifget up Christian Brauner Orabug: 39784995 - eventpoll: rename epremovesafe back to epremove Christian Brauner Orabug: 39784995 - eventpoll: drop...

K000163626: Multiple Linux kernel vulnerabilities

Security Advisory Description CVE-2026-46242 In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix epremove struct eventpoll / struct file UAF epremove via epremovefile cleared file-fep under file-flock but then kept using @file inside the critical section isfileepoll...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: aio: Fixed a use-after-free issue due to missing POLFREE handling. signalfdpoll and binderpoll are special because they use a waitqueue whose lifetime is the current task, rather than the struct file as is normally the case. This...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: eventpoll: Deferring the epfree function in eventpoll.c to an RCU callback during a grace period. In certain situations, epfree in eventpoll.c will free the epi-ep structure while it is still being used by another concurrent...

Rocky Linux 10.0 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_18318)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202518318 advisory. kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush CVE-2025-38351 kernel: sunrpc: fix client side handling of tls alerts...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_17760)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202517760 advisory. kernel: HID: core: Harden s32ton against conversion to 0 bits CVE-2025-38556 kernel: eventpoll: Fix semi-unbounded recursion CVE-2025-38614 kernel: ALSA:...

kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF

A flaw was found in the Linux kernel's eventpoll mechanism. A Use-After-Free UAF vulnerability, where the system attempts to access memory after it has been freed, can occur during the removal of a file. A local attacker could exploit this race condition to corrupt memory, potentially leading to...

kernel: eventpoll: defer struct eventpoll free to RCU grace period

A flaw was found in the Linux kernel's eventpoll component. In certain situations, the epfree function in eventpoll.c can prematurely free the eventpoll data structure while it is still being used by another concurrent thread. This use-after-free UAF vulnerability could allow a local attacker to...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: eventpoll: Fixed an UAF Use-After-Free in epremovestruct eventpoll, struct file. epremove via epremovefile clears file-fep under file-flock, but then continues using @file within the critical section isfileepoll, hlistdelrcu,...

ROS-20260916-73-0009

The vulnerability of the mutexunlock function in the eventpoll component of Linux operating systems is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to trigger a service failure...

SUSE-SU-2026:23439-1 Security update for the Linux Kernel RT (Live Patch 26 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-49.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie bsc1270023 - CVE-2026-53246: sctp: validate cached peer INIT chunk length in...

SUSE-SU-2026:23381-1 Security update for the Linux Kernel RT (Live Patch 26 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-49.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie bsc1270023 - CVE-2026-53246: sctp: validate cached peer INIT chunk length in...

SUSE-SU-2026:23417-1 Security update for the Linux Kernel (Live Patch 20 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-43.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie bsc1270023 - CVE-2026-53246: sctp: validate cached peer INIT chunk length in...

SUSE SLES15 Security Update : kernel (Live Patch 17 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3780-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3780-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.63 fixes various security issues: The following security issues were fixed: -...

SUSE SLES15 Security Update : kernel RT (Live Patch 15 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3699-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3699-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.54 fixes various security issues: The following security issues were fixed: -...

ANT-2026-CM0TCREP · torvalds/linux · Use-After-Free

use-after-free high CVE-2026-43074 Severity Claude high · Security research firm - · Maintainer high REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-CM0TCREP: UAF in epgetupwardsdepthproc giving unprivileged LPE During epollctlA, EPOLLCTLADD, B, the nesting-depth check...