kernel: vsock: Keep the binding until socket destruction

A flaw was found in the Linux kernel's virtual socket protocol network driver, where an improperly timed socket unbinding could result in a use-after-free issue. This flaw allows an attacker who can create and destroy arbitrary connections on virtual connections to read or modify system memory,...

kernel: vsock: Keep the binding until socket destruction

A flaw was found in the Linux kernel's virtual socket protocol network driver, where an improperly timed socket unbinding could result in a use-after-free issue. This flaw allows an attacker who can create and destroy arbitrary connections on virtual connections to read or modify system memory,...

Important: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

CVE-2025-31930

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m incl. SIM...

kernel: vsock: Keep the binding until socket destruction

A flaw was found in the Linux kernel's virtual socket protocol network driver, where an improperly timed socket unbinding could result in a use-after-free issue. This flaw allows an attacker who can create and destroy arbitrary connections on virtual connections to read or modify system memory,...

Windows Ancillary Function Driver WinSock Privilege Escalation

The vulnerability of the Windows Ancillary Function Driver for WinSock operating systems is related to the possibility of using memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2025-31930

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m incl. SIM...

CVE-2025-31929

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions, IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions, IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions, IEC 1Ph 7.4kW Parent cable 7m incl. SIM 8EM1310-2EJ04-3GA2 All...

kernel: vsock: Fix sk_error_queue memory leak

A flaw was found in the Linux kernel's Virtual Socket vsock implementation. When zero-copy data transfers are used, completion notifications placed on a socket's error queue are not cleared when the socket is closed. A local user can exploit this flaw to trigger an uncollected memory leak,...

kernel: net: explicitly clear the sk pointer, when pf->create fails

A flaw was found in the Linux kernel's networking component. When a network socket fails to be created, a reference to a previously freed memory location, known as a "dangling pointer," is not properly cleared. This oversight could allow a local attacker with low privileges to cause the system to...

kernel: bluetooth/l2cap: sync sock recv cb and release

In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hcirxwork, where the former releases the sock and the latter accesses it without lock protection. CPU0 CPU1 ---- ----...

kernel: net: fix data-races around sk->sk_forward_alloc

A flaw was found in the Linux kernel. This vulnerability may allow a local user to cause a denial of service DoS through a system crash. A race condition occurs when concurrent threads process incoming IPv6 network traffic on a listening socket without adequate locking, leading to corrupted socke...

kernel: sock_map: avoid race between sock_map_close and sk_psock_put

A flaw was found in the Linux kernel's sockmap component. A local attacker could exploit a race condition between the sockmapclose and skpsockput functions. This race condition can lead to a null pointer dereference, which triggers a kernel warning and may result in a denial of service...

kernel: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker with low privileges could trigger a condition where the system attempts to transmit data with interrupts disabled during the ieee80211dostop function. This incorrect handling of network packet buffers SKBs can le...

kernel: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit

A flaw was found in the Linux kernel's ath9khtc Wi-Fi driver. An issue exists where the skbtrim function, used for resetting the length of a socket buffer skb before resubmitting a USB Request Block urb, can encounter an uninitialized length value in certain error conditions. A local attacker cou...

kernel: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: handle NULL sock pointer in l2capsockalloc A NULL sock pointer is passed into l2capsockalloc when it is called from l2capsocknewconnectioncb and the error handling paths should also be aware of it. Seemingly a...

kernel: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: FIX possible deadlock in rfcommskstatechange rfcommskstatechange attempts to use socklock so it must never be called with it locked but rfcommsockioctl always attempt to lock it causing the following trace:...

kernel: sock_map: Add a cond_resched() in sock_hash_free()

A flaw was found in the Linux kernel's sockmap component, which handles network-related data structures. A local user could exploit this vulnerability by destroying a sockmap with a large number of buckets. This improper resource handling can lead to a soft lockup, causing the system to become...

kernel: ppp: do not assume bh is held in ppp_channel_bridge_input()

In the Linux kernel, the following vulnerability has been resolved: ppp: do not assume bh is held in pppchannelbridgeinput Networking receive path is usually handled from BH handler. However, some protocols need to acquire the socket lock, and packets might be stored in the socket backlog is the...

kernel: mptcp: init: protect sched with rcu_read_lock

In the Linux kernel, the following vulnerability has been resolved: mptcp: init: protect sched with rcureadlock Enabling CONFIGPROVERCULIST with its dependence CONFIGRCUEXPERT creates this splat when an MPTCP socket is created: ============================= WARNING: suspicious RCU usage 6.12.0-rc...