p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости linux-realtime-6.8 · Страница 95

За последние 30 дней в linux-realtime-6.8 опубликовано уязвимостей: 634; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 9456

  1. CVE-2026-89782

    Высокий · CVSS 8.4EPSS 0,18%Нет опубликованного исправления

    fs/ntfs3: reject restart table growth beyond U16_MAX entries

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16_MAX entries During $LogFile replay, log_replay() indexes the transaction table by the transact_id taken from the log record header. check_log_rec() only verifies that transact_id is non-zero and properly aligned, not its magnitude, so a crafted image can request an arbitrarily large index. alloc_rsttbl_from_idx() grows the table to cover that index via extend_rsttbl(), which passes the new entry count to init_rsttbl(): rt = init_rsttbl(esize, used + add); used + add is computed as u32 but init_rsttbl() takes a u16, and t

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  2. CVE-2026-89781

    Высокий · CVSS 8.4EPSS 0,18%Нет опубликованного исправления

    fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() read_log_rec_buf() copies a log record into a caller buffer starting at u32 off = lsn_to_page_off(log, lsn) + log->record_header_len; log->record_header_len (and log->data_off, used for the following pages) comes verbatim from the on-disk restart area and is only checked for 8-byte alignment in is_rst_area_valid(), so off can exceed log->page_size. "tail = log->page_size - off" then underflows and memcpy() reads past the page_size-sized buffer returned by read_log_page(), spilling adjacent slab memory into the replay

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  3. CVE-2026-89780

    Без оценкиEPSS 0,22%Нет опубликованного исправления

    net: qualcomm: rmnet: restore skb->dev on deaggregated frames

    In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb->dev on deaggregated frames rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns skb->dev = ep->egress_dev only on the data path, but a MAP command frame is dispatched to rmnet_map_command() before that, so rmnet_map_send_ack() runs netif_tx_lock(skb->dev) on a NULL device. An unprivileged user reaches this by unsharing a user+net namespace, creating an rmnet link over a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS, and writing an aggregated frame

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  4. CVE-2026-89779

    Критический · CVSS 9.1EPSS 0,7%Нет опубликованного исправления

    fs/ntfs3: validate ef->size covers the record's name and value

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef->size covers the record's name and value When an EA record has a non-zero ef->size, ntfs_read_ea() only checks that the record fits in the remaining buffer (ea_size > bytes), not that ef->size is large enough to hold the record's own name_len + 1 + elength. A crafted image can pass validation with, e.g., ef->size = 24 but elength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of the undersized record, reading past the kmalloc(info->size) allocation and leaking heap memory to userspace via getxattr(): BUG: KASAN: slab-out-of-bounds in

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  5. CVE-2026-89778

    Критический · CVSS 9.8EPSS 0,7%Нет опубликованного исправления

    isofs: fix out-of-bounds page array access on empty zisofs block

    In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofs_uncompress_block()'s empty-block fast path returns pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the decompression path which returns bytes produced relative to poffset. zisofs_fill_pages() uses that return to advance its page cursor, so when the zisofs block size is below PAGE_SIZE and a sub-page block leaves poffset partway into a page, a following empty block over-counts and advances pages[] one element past its end, after which "if (poffset && *pages)" reads pages[1] out of bounds. ro

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  6. CVE-2026-89777

    Высокий · CVSS 8.8EPSS 0,16%Нет опубликованного исправления

    vfio/pci: clear vdev->msi_perm after freeing it on init failure

    In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM; ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ } When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed la

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  7. CVE-2026-89776

    Без оценкиEPSS 0,21%Нет опубликованного исправления

    vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

    In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLA_BINARY with only a maximum length, so validate_nla() accepts a payload shorter than the address. The GROUP consumer reads it with nla_get_in_addr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing kernel memory. Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects any GROUP/

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  8. CVE-2026-89774

    Высокий · CVSS 8.8EPSS 0,4%Нет опубликованного исправления

    Bluetooth: SCO: hold sk properly in sco_conn_ready

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is currently accessed without either, and without checking parent->sk_state: [Task 1] [Task 2] sco_sock_release sco_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) sco_sock_kill(sk) UA

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  9. CVE-2026-81010

    Высокий · CVSS 7.8Нет опубликованного исправления

    UBUNTU-CVE-2026-81010

    In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: honor task_work cancellation io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originating task. The fallback runs from a kworker and io_uring marks such task work as canceled through tw.cancel. io_waitid_cb() currently ignores tw.cancel and calls __do_wait(). waitid is task-context dependent: __do_wait() performs child lookup relative to current, and the retry path also uses current->signal->wait_chldexit. If the callback runs from the fallback kworker, current is therefore not the task that submi

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  10. CVE-2026-89771

    Высокий · CVSS 7.8EPSS 0,12%Нет опубликованного исправления

    ring-buffer: Fix subbuf resize race with ring buffer readers

    In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start(), while it can simultaneously be resized with ring_buffer_subbuf_order_set(). Instead of trace_buffer::subbuf_size, use bpage::order in ring_buffer_read_start() and ring_buffer_read_page(). In ring_buffer_read_start(), even with resize_disabled, there is still a possibility of a race with a buffer modification. Hold the trace_buffer mutex to synchronise with any pending ring buffer order modification. trace_buffer::

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  11. CVE-2026-89765

    Без оценкиEPSS 0,2%Нет опубликованного исправления

    timers/itimer: Zero-init old itimerval before copy to userspace

    In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct __kernel_old_timeval contains a four-byte hole after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit. put_itimerval() fills only the named fields in a stack-allocated __kernel_old_itimerval and copies the entire object to userspace, so getitimer() can expose the two padding holes. Zero-initialize the aggregate before assigning the fields so implicit padding is deterministic before it crosses the user/kernel boundary.

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  12. CVE-2026-89763

    Высокий · CVSS 7.8EPSS 0,12%Нет опубликованного исправления

    KEYS: trusted: Fix TPM teardown ordering

    In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key_type_lookup() holds key_types_sem for reading until the key operation finishes, while unregister_key_type() takes it for writing. It therefore provides the synchronization point that must precede backend teardown. The current order permits this interleaving: CPU 0 CPU 1 trusted_tpm_exit() key_type_lookup("trusted") put_device(&chip->dev) trusted_tp

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  13. CVE-2026-89762

    Высокий · CVSS 7.8EPSS 0,12%Нет опубликованного исправления

    apparmor: fix cred UAF caused by begin_current_label_crit_section()

    In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begin_current_label_crit_section() AppArmor's begin_current_label_crit_section() is a scary function called from lots of LSM hooks (in particular VFS/socket-related ones) that checks if the label referenced by the current creds is marked FLAG_STALE, and if so, attempts to use aa_replace_current_label() to replace the creds with an updated version that uses a new label. The first problem with this is that it would directly lead to UAF of `struct cred` if anything in the kernel takes a pointer to the current creds and accesses these past a se

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  14. CVE-2026-89761

    Высокий · CVSS 7.8EPSS 0,12%Нет опубликованного исправления

    apparmor: fix out-of-bounds write when null terminating a label vec

    In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the terminator goes to vec[n], so the caller has to provide room for n + 1 entries. aa_label_strn_parse() sets up its vector with vec_setup(profile, vec, len, gfp) and then calls aa_vec_unique(vec, len, VEC_FLAG_TERMINATE), but vec_setup() does not reserve the terminator entry. Up to LOCAL_VEC_ENTRIES it uses the local array of LOCAL_VEC_ENTRIES poi

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  15. CVE-2026-89759

    Средний · CVSS 5.7EPSS 0,2%Нет опубликованного исправления

    mm/kmemleak: avoid soft lockup when scanning task stacks

    In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3. kmemleak_scan() scans every task stack under one rcu_read_lock() with no reschedule point, which can trip the soft lockup watchdog on hosts with very many threads. That prints the following message, depending on the workload+host configuration: watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [kmemleak:537] scan_block kmemleak_scan kmemleak_scan_thread kthread Patch 1 walks the tasks with find_ge_pid() so the

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  16. CVE-2026-89757

    Средний · CVSS 5.8EPSS 0,21%Нет опубликованного исправления

    mm/mglru: fix and remove redundant unevictable folio handling

    In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix and remove redundant unevictable folio handling sort_folio() has a shortcut for moving folios that are no longer evictable but are still sitting on a generation list. However, this shortcut is buggy. It does not follow the PG_lru usage convention, and it has a more serious issue. Unevictable folios are not threaded on lists[LRU_UNEVICTABLE], so that folio->lru can be reused to hold folio->mlock_count (see the comment in lruvec_init()). Hence lruvec_add_folio() skips the list_add() for them, and every other place that turns a folio unevictable initialises m

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  17. CVE-2026-89756

    Низкий · CVSS 2EPSS 0,2%Нет опубликованного исправления

    mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()

    In the Linux kernel, the following vulnerability has been resolved: mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() migrate_pages_batch() unmaps each folio before moving it, and every unmap runs the mmu_notifier invalidate callbacks. On KVM hosts try_to_migrate() ends up in kvm_mmu_notifier_invalidate_range_start() -> tdp_mmu_zap_leafs(), which is expensive, so unmapping a large batch keeps the CPU busy for a long time. The loop already calls cond_resched(), but on PREEMPTION kernels that is a no-op, and involuntary preemption is not a Tasks-RCU quiescent state. A long batch therefore never reports a quiescent stat

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  18. CVE-2026-89755

    Высокий · CVSS 7.8EPSS 0,16%Нет опубликованного исправления

    mm/migrate_device: clear stale mapping after freeing swapcache

    In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap() succeeds, the folio is removed from the swap cache, but the saved mapping still points to swap_space. Passing the stale mapping to folio_migrate_mapping() makes it use the mapped-folio path for a folio that is no longer in swapcache. It can then operate on swap_space.i_pages with invalid reference accounting, eventually triggering a folio reference count BUG. After a successful split, nr still contains t

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  19. CVE-2026-89753

    Без оценкиEPSS 0,18%Нет опубликованного исправления

    mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()

    In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() I am seeing some rcu_tasks stalls in the Meta fleet during reclaim. INFO: rcu_tasks detected stalls on tasks: 0000000088620d09: .. nvcsw: 6735/6735 holdout: 1 idle_cpu: -1/8 task:GlobalCPUThread state:R running task pid:2552016 tgid:2524552 Call Trace: shrink_lruvec mem_cgroup_iter shrink_node do_try_to_free_pages try_to_free_pages __alloc_frozen_pages_noprof alloc_pages_noprof pte_alloc_one __pte_alloc handle_mm_fault Nothing promises direct reclaim returns in bounded ti

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  20. CVE-2026-89752

    Без оценкиEPSS 0,18%Нет опубликованного исправления

    mm: memcg: stop reclaim when a limit update is superseded

    In the Linux kernel, the following vulnerability has been resolved: mm: memcg: stop reclaim when a limit update is superseded kernfs serializes file operations only per open file, so separate open files can update the same memory.high or memory.max file concurrently. Both handlers store the new limit before synchronous reclaim, but continue to use the writer's local target in the reclaim loop. If another writer raises or removes the limit, the first writer can continue reclaiming toward a stale target. For memory.max, this can leave the writer looping indefinitely once reclaim retries are exhausted. The OOM path sees sufficient margin u

    linux-realtime-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →