CVE-2026-90009: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

RHEL 9 : kernel (RHSA-2026:68100)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68100 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fanotify: fix false positive ...

Linux Distros Unpatched Vulnerability : CVE-2026-90010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the...

Linux Distros Unpatched Vulnerability : CVE-2026-90009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd...

USN-8761-1 linux-azure vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - PowerPC architecture; - Compute Acceleration Framework; - Drivers core;...

Astra Linux – Vulnerability in Linux, Linux 5.10

iouring UAF, Unix SCM garbage collection...

Astra Linux – Vulnerability in Linux 5.15

A use-after-free vulnerability in the Linux Kernel’s iouring system can be exploited to achieve local privilege escalation. The iofilegetfixed function lacks the presence of ctx-uringlock, which can lead to a Use-After-Free vulnerability due to a race condition where fixed files become...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring: A schedule point was added in ioaddbuffers. Looping 65535 times and making kmalloc calls can trigger soft lockups, especially with DEBUG features like KASAN. 253.536212 watchdog: BUG: Soft lockup – CPU64 stuck for 26...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iouring/net: The overflow check in iorecvmsgmshotprep has been fixed. The controllen variable is of type sizet unsigned long. Casting it to int could lead to an integer underflow. The checkaddoverflow function considers the type ...

Astra Linux – Vulnerability in Linux 5.10

In ioidentitycow of iouring.c, there is a potential way to corrupt memory due to a use after free. This could lead to a local escalation of privileges, as the exploit requires system execution privileges. User interaction is not required for exploitation. Product: Android Versions: Android kernel...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iouring: Check whether iowq is killed before queuing it. Task work can be executed after the task has gone through iouring termination—whether it’s the final taskwork run or the fallback path. In this case, task work will find th...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

There is a use-after-free in iouring in the Linux kernel. The signalfdpoll and binderpoll functions use a waitqueue whose lifetime is the current task. The waitqueue will send a POLLFREE notification to all waiters before it is freed. Unfortunately, the iouring poll does not handle POLFREE. This...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iouring: Now waits for requests to be completed before exiting. When the ring exits, cleanup is performed, and the final cancellation and waiting for requests to be completed are handled by ioringexitwork. This function is invoke...

Astra Linux – Vulnerability in Linux

An integer overflow or wrap-around vulnerability in the iouring module of the Linux kernel allows a local attacker to cause memory corruption and escalate privileges to root. This issue affects Linux Kernel versions prior to 5.4.189, as well as version 5.4.24 and later versions...

Astra Linux – Vulnerability in Linux 5.10

iouring uses workFlags to determine which identities need to be retrieved from the calling process, ensuring that they are consistent with the calling process when executing IORINGOP. Some operations lack certain types, which can lead to incorrect reference counts, potentially resulting in a...

Astra Linux – Vulnerability in Linux 5.10

A use-after-free flaw was discovered in the Linux kernel’s iouring subsystem. This flaw occurs when a user sets up a ring using IORINGSETUPIOPOLL, with multiple tasks completing submissions within that ring. This flaw allows a local user to crash the system or escalate their privileges on the...

Astra Linux – Vulnerability in Linux 5.10

There exists a use-after-free vulnerability in the Linux kernel through the iouring mechanism and the IORINGOPSPLICE operation. If the IORINGOPSPLICE operation lacks the IOWQWORKFILES flag, it indicates that the operation will not utilize current-nsproxy. As a result, its reference counter is not...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

A use-after-free vulnerability in the Linux Kernel’s iouring subsystem can be exploited to achieve local privilege escalation. Sending a iouring cancel poll request with a linked timeout can lead to a Use-after-Free UAF in a hrtimer mechanism. We recommend upgrading to the latest version of the...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership()

A flaw was found in the Linux kernel's iouring/poll component. A logic error exists in the iopollgetownership function due to an incorrect signed comparison. This flaw prevents the necessary slowpath from being triggered when the IOPOLLCANCELFLAG is set, potentially leading to unexpected behavior...