kernel: ipv6: exthdrs: refresh nh after handling HAO option

A flaw was found in the Linux kernel's IPv6 extension header processing. When processing the Home Address Option HAO, the cached network header pointer may become invalid if the packet's memory is reallocated. This can lead to incorrect parsing of subsequent IPv6 Type-Length-Value TLV options,...

kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable

A flaw was found in the Linux kernel's netfilter synproxy module. When handling TCP timestamp options, a stale pointer can be used after memory reallocation. This can result in memory corruption, where data is written to a freed memory area, or lead to packets being sent with an incorrect checksu...

kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

A flaw was found in the Linux kernel. A race condition exists in the xfrm policy handling, specifically within the xfrmpolicybyselctx function. This flaw allows for a use-after-free vulnerability, where memory is accessed after it has been released. This can lead to system instability or a denial...

kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing

A flaw was found in the Linux kernel's Soft RoCE RDMA/rxe driver. An unauthenticated remote attacker can send a specially crafted UDP packet with an unknown opcode to trigger an out-of-bounds read. This vulnerability can lead to a kernel panic, effectively causing a Denial of Service DoS on the...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink()

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface vti6 component. An unprivileged local user, particularly within a user namespace, could exploit a vulnerability related to incorrect network namespace handling during the movement of a vti6 tunnel. This issue can lead to a kerne...

kernel: ipv6: validate extension header length before copying to cmsg

A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure...

kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface VTI module. When a VTI tunnel device is moved to a different network environment, an unprivileged user in a separate user space can manipulate tunnel parameters. This manipulation could allow the user to intercept or redirect...

cve-2022-49186-research

CVE-2022-49186: Linuxカーネル権限昇格研究 概要 CVE-2022-49186に対するセキュリティ研究と概念実証エクスプロイト。これはViscontiクロックドライバのLinuxカーネル脆弱性で、配列オーバーフローによりローカル権限昇格を可能にします。 脆弱性の詳細 タイプ : 符号付きから符号なしへの変換による配列オーバーフロー CVSSスコア : 7.8 高 影響 : rootへのローカル権限昇格 影響を受けるバージョン : Linuxカーネル5.17.0 - 5.17.1 リポジトリの内容 CVE-2022-49186.pdf - 完全な研究論文...

CVE-2026-98355

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access subsystem. When connection path initialization fails in the RDMA Transport RTRS driver, error cleanup routines invoke event tracing before the associated object name is set. This issue leads to a null pointer dereference,...

CVE-2026-98354

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem. A remote attacker can trigger a Denial of Service DoS by repeatedly sending Management Datagrams MADs containing an invalid partition key PKey. Because the kernel does not properly track and free allocated receive...

CVE-2026-98353

A flaw was found in the Linux kernel's erdma Elastic Remote Direct Memory Access driver. A local user could cause a Denial of Service DoS through a system deadlock during concurrent queue creation and hardware interrupt handling. Because internal queue updates do not use interrupt-safe locking, a...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

kernel: netfilter: flowtable: publish GC-visible tuple last

A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...

kernel: linux/dim: Fix divide by 0 in RDMA DIM

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem. A divide-by-zero error can occur within the Dynamic Interrupt Moderation DIM mechanism when comparing statistics that evaluate to a zero value. A local attacker can trigger this issue during network operations to...

kernel: ip6_gre: Use cached t->net in ip6erspan_changelink()

A flaw was found in the Linux kernel's ip6gre module. An unprivileged user could exploit this vulnerability by migrating a network device, causing the ip6erspanchangelink function to incorrectly handle network namespace references. This error leads to a use-after-free condition when the original...

kernel: netfilter: conntrack: remove sprintf usage

A flaw was found in the Linux kernel's netfilter conntrack module. This vulnerability arises from the use of sprintf and insufficient buffer sizing in the manglecontentlen function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue t...

kernel: zram: fix use-after-free in zram_bvec_write_partial()

A flaw was found in the Linux kernel, specifically within the zram module. This vulnerability is a use-after-free error, where the system attempts to use a piece of memory after it has been freed. This occurs when the zrambvecwritepartial function allows an asynchronous read to write into a page...

kernel: i2c: stub: Reject I2C block transfers with invalid length

A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...

kernel: net: qrtr: restrict socket creation to the initial network namespace

A flaw was found in the Linux kernel's QRTR Qualcomm IPC Router networking component. An unprivileged local attacker can create a QRTR socket in a separate network namespace. Due to improper handling of global state variables, this allows the attacker to send datagrams and control-plane messages ...