p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости linux-fips · Страница 103

За последние 30 дней в linux-fips опубликовано уязвимостей: 635; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 9417

  1. CVE-2026-89557

    Высокий · CVSS 7.8EPSS 0,17%Нет опубликованного исправления

    md: do overflow check for sb->bblog_shift in super_1_load()

    In the Linux kernel, the following vulnerability has been resolved: md: do overflow check for sb->bblog_shift in super_1_load() In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on- disk superblock. It is used for badblocks API badblocks_set() by the following sequence, 1930 rdev->badblocks.shift = sb->bblog_shift; 1931 for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) { 1932 u64 bb = le64_to_cpu(*bbp); 1933 int count = bb & (0x3ff); 1934 u64 sector = bb >> 10; 1935 sector <<= sb->bblog_shift; 1936 count <<= sb->bblog_shift; 1937 if (bb + 1 == 0) 19

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  2. CVE-2026-89555

    Критический · CVSS 9.8EPSS 0,69%Нет опубликованного исправления

    mpls: reload header after pskb_may_pull()

    In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label. After finding the bottom-of-stack label, it calls pskb_may_pull() before reading the inner IP header. If an skb is constructed with the inner IP header in nonlinear data and insufficient tailroom in the linear head, pskb_may_pull() calls pskb_expand_head() to replace the skb head and free the old one. This leaves hdr pointing to fr

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  3. CVE-2026-89554

    Высокий · CVSS 8.2EPSS 0,6%Нет опубликованного исправления

    mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce, backup, join_id, token and msk from the saved cookie entry when rebuilding the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it does not restore local_id, even though the SYN path saved it. subflow_ulp_clone() then reads that uninitialized field and stores it as the joined subflow's address-ID. Because the request-sock slab is SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale byte of a pr

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  4. CVE-2026-89553

    Высокий · CVSS 7.8EPSS 0,14%Нет опубликованного исправления

    nouveau/gem: reserve the bo in the info ioctl around the vma lookup

    In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free. Spotted with the help of Opus 4.6.

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  5. CVE-2026-89552

    Без оценкиEPSS 0,18%Нет опубликованного исправления

    params: fix charp corruption on allocation failure

    In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure param_set_charp() stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released before the replacement allocation succeeds. If kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter left as NULL. Failing zswap's compressor update before zswap is initialized can later trigger: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:strcmp+0x10/0x30 Call Trace: zswap_setup+0x3b1

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  6. CVE-2026-89551

    Критический · CVSS 9.8EPSS 0,51%Нет опубликованного исправления

    SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by walking the tail, pages, and head iovecs. Each per-section step uses min_t() so it never removes more bytes than that section holds, but the final accounting at the fix_len label subtracts the total bytes actually consumed from buf->len without any clamp: fix_len: buf->len -= (len - trim); When the caller has set buf->len to a value smaller than the sum of the iov_lens, (len - trim) can exceed buf->len and the unsigned subtraction wraps

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  7. CVE-2026-89550

    Критический · CVSS 9.8EPSS 0,49%Нет опубликованного исправления

    SUNRPC: svcauth_gss: enforce krb5 token minimum length

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: enforce krb5 token minimum length svcauth_gss_unwrap_priv() validates only an upper bound on the wire-supplied opaque length before handing the buffer to gss_unwrap(): if (len > xdr_stream_remaining(xdr)) goto unwrap_failed; offset = xdr_stream_pos(xdr); ... maj_stat = gss_unwrap(ctx, offset, offset + len, buf); The wire value `len` flows unchanged as the upper bound into the krb5 unwrap path, so a len in [0, 16] passes this check and is handed to gss_unwrap(). For a krb5 v2 context that lands in gss_krb5_unwrap_v2(), which

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  8. CVE-2026-89549

    Высокий · CVSS 7.5EPSS 0,71%Нет опубликованного исправления

    sunrpc: route to a populated pool in svc_pool_for_cpu()

    In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_for_cpu() svc_set_num_threads() spreads the requested threads evenly across the service's pools (base = nrservs / sv_nrpools). When a service runs fewer threads than it has pools -- e.g. an nfsd configured with fewer threads than the host has NUMA nodes while running in "pernode" or "percpu" mode -- the trailing pools are left with no threads at all. svc_xprt_enqueue() selects a pool from the CPU servicing the transport, queues the transport on that pool's sp_xprts, and only wakes a thread from the same pool. Each thread serv

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  9. CVE-2026-89548

    Высокий · CVSS 7.8EPSS 0,13%Нет опубликованного исправления

    SUNRPC: always drain cache_cleaner before destroying a cache_detail

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache_cleaner before destroying a cache_detail sunrpc_destroy_cache_detail() only cancels the global cache_cleaner delayed_work when cache_list is empty. During per-netns teardown cache_list is never empty because init_net's caches remain registered, so the cancel never fires. After unlink, the caller proceeds to cache_destroy_net() which kfrees the cache_detail while cache_clean() may still hold a dangling pointer to it. The result is a use-after-free: cache_dequeue() takes cd->queue_lock on freed memory, and cache_put() dereferences cd->cache_put a

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  10. CVE-2026-89547

    Высокий · CVSS 8.1EPSS 0,56%Нет опубликованного исправления

    SUNRPC: Check svc pool percpu counter allocation

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation __svc_create() initializes three per-pool percpu_counter stats and ignores every return value. On SMP, percpu_counter_init() fails when __alloc_percpu_gfp() cannot satisfy the allocation, leaving the failed counter with fbc->counters == NULL and its embedded raw_spinlock_t, list_head, and count never initialized. __svc_create() returns the half-constructed svc_serv to nfsd, lockd, or the NFS callback service anyway. Once that service is live, the hot-path increments in svc_xprt_enqueue(), svc_handle_xprt(), and svc_pool_wake

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  11. CVE-2026-89545

    Высокий · CVSS 7.8EPSS 0,16%Нет опубликованного исправления

    sunrpc: defer rq_argp and rq_resp free until after RCU grace period

    In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rq_argp and rq_resp free until after RCU grace period svc_rqst_free() frees rqstp->rq_argp and rqstp->rq_resp synchronously via kfree(), but defers the rqstp struct free via kfree_rcu(). After svc_exit_thread() calls list_del_rcu() and svc_rqst_free(), there is a window where RCU readers that started before list_del_rcu() can still traverse the thread list and find the rqstp. These readers (e.g. nfsd_nl_rpc_status_get_dumpit()) dereference rqstp->rq_argp, which has already been freed — a use-after-free. Fix this by moving the kfree of rq_argp and rq_resp in

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  12. CVE-2026-89544

    Высокий · CVSS 7.5EPSS 0,72%Нет опубликованного исправления

    SUNRPC: fix gssx_dec_option_array error path bugs

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded group_info, and a latent use-after-free that the leak fix would otherwise expose. gssx_dec_option_array() sets oa->count = 1 before allocating oa->data. If that allocation fails, -ENOMEM is returned with oa->count == 1 and oa->data == NULL. All other error paths jump to free_oa: which frees oa->data and NULLs it but also leaves oa->count == 1. The caller trusts the count:

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  13. CVE-2026-89543

    Без оценкиEPSS 0,21%Нет опубликованного исправления

    sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

    In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir Normal client creation goes through rpc_setup_pipedir(), which records clnt->pipefs_sb, but the mount-event path in __rpc_clnt_handle_event() calls rpc_setup_pipedir_sb() directly and never refreshes that field. The umount path also removes the directory without clearing clnt->pipefs_sb. After a late pipefs mount or any remount, rpc_clnt_remove_pipedir() compares the current superblock against a stale pipefs_sb pointer and skips cleanup, leaving pipefs dentries whose inode private data stil

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  14. CVE-2026-89542

    Критический · CVSS 9.8EPSS 0,51%Нет опубликованного исправления

    SUNRPC: harden gss_krb5_unwrap_v2 against short tokens

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN (16) bytes long, and its rotate_left() helper passes buf->len - base to xdr_buf_subsegment() without verifying that base <= buf->len. When a caller hands in a sub-16-byte token, or a token whose declared len leaves base past the end of the buffer, three distinct failures follow: gss_krb5_unwrap_v2(offset, len, buf) ptr = buf->head[0].iov_base + offset ec = *(ptr +

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  15. CVE-2026-89541

    Критический · CVSS 9.8EPSS 0,51%Нет опубликованного исправления

    SUNRPC: harden gss_unwrap_resp_priv length checks

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_unwrap_resp_priv length checks gss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with offset = (u8 *)(p) - (u8 *)head->iov_base; if (offset + opaque_len > rcv_buf->len) goto unwrap_failed; maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, offset + opaque_len, rcv_buf); Both operands are u32 and the sum is computed in u32. A reply with opaque_len near 0xffffffff makes offset + opaque_len wrap to a small value that is below rcv_buf->len, so the bound check passes and gss_unwrap() is called with en

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  16. CVE-2026-89540

    Высокий · CVSS 7.8EPSS 0,13%Нет опубликованного исправления

    sunrpc: init gssp_lock before publishing proc entry

    In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssp_lock before publishing proc entry create_use_gss_proxy_proc_entry() publishes /proc/net/rpc/use-gss-proxy via proc_create_data() before init_gssp_clnt() runs mutex_init() on sn->gssp_lock. Once the dentry is linked under proc_subdir_lock it is immediately reachable from userspace, so a write that lands in the window drives set_gssp_clnt() into mutex_lock() on a zero-initialized struct mutex. create_use_gss_proxy_proc_entry(net) proc_create_data("use-gss-proxy", ...) /* dentry live */ init_gssp_clnt(sn) mutex_init(&sn->gssp_lock)

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  17. CVE-2026-89539

    Без оценкиEPSS 0,21%Нет опубликованного исправления

    SUNRPC: reject duplicate CREDS_VALUE options

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDS_VALUE options gssx_dec_option_array() walks the wire-supplied option array and, for every entry whose name matches CREDS_VALUE, calls gssx_dec_linux_creds() on the same struct svc_cred. That helper unconditionally installs a fresh groups_alloc() result into creds->cr_group_info without releasing whatever pointer was already there: for (i = 0; i < count; i++) { ... decode name ... if (length == sizeof(CREDS_VALUE) && memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) { err = gssx_dec_linux_creds(xdr,

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  18. CVE-2026-89538

    Критический · CVSS 9.8EPSS 0,71%Нет опубликованного исправления

    SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gss_krb5_unwrap_v2() sets buf->len to a logical length, which can be much smaller than head[0].iov_len (the allocated receive-page capacity). It then calls xdr_buf_trim() with a trim length derived from the 16-bit "extra count" (ec) field in the Kerberos v2 token header. The ec field is authenticated by the post-decrypt memcmp() against the encrypted header copy, so a randomly-mutated value is rejected. However, any peer holding a valid GSS context can legitimately encrypt a token whose ec exceeds the plaintext l

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  19. CVE-2026-89537

    Критический · CVSS 9.1EPSS 0,73%Нет опубликованного исправления

    SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags byte at ptr[2], and padding at ptr[3..7], then passes ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg(). None of these accesses check read_token->len first. The minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus ctx->krb5e->cksum_len (12-24, depending on the enctype). All callers accept shorter tokens from the wire: - gss_unwrap_resp_integ() enforces only an upper bound (offset + len <= rcv_buf->len) before al

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  20. CVE-2026-89536

    Критический · CVSS 9.8EPSS 0,64%Нет опубликованного исправления

    SUNRPC: wait for in-flight client TLS handshake callback

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops that reference after calling tls_handshake_cancel(). handshake_req_cancel() returns false when handshake_complete() has already marked the request complete. In that case the completion callback can still be running, so dropping the callback-owned reference in the waiter can free the lower transport before xs_tls_handshake_done() stores xpr

    linux-fipsОперационные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →