RLSA-2026:99015 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: drm/amdkfd: hold eventmutex while checkpointing CRIU events CVE-2026-74446 kernel: drm/amdkfd: fix SMI event cross-process information leak CVE-2026-97422 kernel: drm/amd/pm: bound...

kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice

A flaw was found in the Linux kernel's smcrxsplice function within the net: smc component. This vulnerability arises from an imbalance in the lifetime management of splice entries, where page references are not properly handled before being passed to splicetopipe. This can lead to a reference cou...

kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()

A flaw was found in the Linux kernel's net/smc component. A local attacker could exploit a use-after-free vulnerability in the smcllcsrvaddlink function, where a freed memory region is improperly accessed. This can lead to memory corruption and potentially result in a denial of service DoS...

kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()

A flaw was found in the Linux kernel's net/smc component. A local attacker could exploit a use-after-free vulnerability in the smcllcsrvaddlink function, where a freed memory region is improperly accessed. This can lead to memory corruption and potentially result in a denial of service DoS...

kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

A flaw was found in the Linux kernel's Shared Memory Communications over RDMA SMC-R subsystem. A race condition allows a network socket to be released and freed while incoming messages are still being processed, leading to a use-after-free condition. A local attacker interacting with active SMC-R...

kernel: net/smc: protect clcsock lifetime in smc_getname

A flaw was found in the Linux kernel's Shared Memory Communications SMC subsystem. A race condition in the smcgetname function allows an underlying socket to be released while its address information is being retrieved. A local user can exploit this vulnerability to trigger a use-after-free...

kernel: net/smc: protect clcsock lifetime in smc_getname

A flaw was found in the Linux kernel's Shared Memory Communications SMC subsystem. A race condition in the smcgetname function allows an underlying socket to be released while its address information is being retrieved. A local user can exploit this vulnerability to trigger a use-after-free...

kernel: Revert "net/smc: Introduce TCP ULP support"

A flaw was found in the Linux kernel's TCP User-Level Protocol ULP support for SMC. This vulnerability arises when an active TCP socket is converted into an SMC socket, as the implementation attempts to modify core Virtual File System VFS structures in-place. This action violates fundamental VFS...

kernel: Revert "net/smc: Introduce TCP ULP support"

A flaw was found in the Linux kernel's TCP User-Level Protocol ULP support for SMC. This vulnerability arises when an active TCP socket is converted into an SMC socket, as the implementation attempts to modify core Virtual File System VFS structures in-place. This action violates fundamental VFS...

kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry

A flaw was found in the Linux kernel's Server Message Block over Remote Direct Memory Access SMC-Rv2 protocol implementation. The smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys functions incorrectly handle oversized LLC messages, reading beyond the intended message boundaries. This can lead to th...

ALSA-2026:99031 Moderate: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: drm/amdkfd: hold eventmutex while checkpointing CRIU events CVE-2026-74446 kernel: drm/amdkfd: fix SMI event cross-process...

Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: drm/amdkfd: hold eventmutex while checkpointing CRIU events CVE-2026-74446 kernel: drm/amdkfd: fix SMI event cross-process information leak CVE-2026-97422 kernel: drm/amd/pm: bound...

ALSA-2026:99015 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: drm/amdkfd: hold eventmutex while checkpointing CRIU events CVE-2026-74446 kernel: drm/amdkfd: fix SMI event cross-process information leak CVE-2026-97422 kernel: drm/amd/pm: bound...

RLSA-2026:95100 Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-52929 kernel: net/smc: fix UAF in smccdcrxhandler by pinning the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: smc: Fixed use-after-free in pnetfindbasendev. SyZBot reported a use-after-free of netdevice in pnetfindbasendev, which was called during connect. 0 smcpnetfindismresource retrieves skdstgetsk-dev and passes it down to...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This creates a window where smccloseactive c...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice passes RMB pages to a pipe and takes a socket reference per entry, ensuring that the smcsock remains alive until the reader finishes. However, concurrent closes trigg...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination smclgrterminate drops connslock after finding a connection in lgr-connsall, but before taking a reference on its socket. The connection is embedded in the socket, a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct using a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowloc...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/smc: free stashed qentry before overwrite in REQADDLINK to ADDLINK transition When smcllceventhandler transitions the local LLC flow from SMCLLCFLOWREQADDLINK to SMCLLCFLOWADDLINK upon receiving an ADDLINK request, it calls...