OESA-2026-3452

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3452

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-3452.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2026-3452

Upstream

CVE-2026-63860

CVE-2026-64546

Published

2026-08-20T09:58:33Z

Modified

2026-08-20T10:15:29.565888697Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

kernel security update

Details

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Prefer NLANULSTRING

These attributes are evaluated as c-string (passed to strcmp), but NLA_STRING doesn't check for the presence of a \0 terminator.

Either this needs to switch to nlastrcmp() and needs to adjust printf fmt specifier to not use plain %s, or this needs to use NLANUL_STRING.

As the code has been this way for long time, it seems to me that userspace does include the terminating nul, even tough its not enforced so far, and thus NLANULSTRING use is the simpler solution.(CVE-2026-63860)

In the Linux kernel, the following vulnerability has been resolved:

drm/edid: fix OOB read in drmparsetiled_block()

drmparsetiledblock() casts the DisplayID block to a struct displayidtiledblock and reads the full fixed layout up to tile->topologyid[7] without checking block->numbytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATABLOCKTILEDDISPLAY, or DATABLOCK2TILEDDISPLAYTOPOLOGY for v2.0) with a small numbytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read.

Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drmparsevesamsodata() already does.

BUG: KASAN: slab-out-of-bounds in drmedidconnectorupdate Read of size 2 at addr ffff888010077700 by task exploit/147 dumpstacklvl (lib/dumpstack.c:94 ...) printreport (mm/kasan/report.c:378 ...) kasanreport (mm/kasan/report.c:595) drmedidconnectorupdate (drivers/gpu/drm/drmedid.c:7581) bochsconnectorhelpergetmodes (drivers/gpu/drm/tiny/bochs.c:574) drmhelperprobesingleconnectormodes (drivers/gpu/drm/drmprobehelper.c:426) statusstore (drivers/gpu/drm/drmsysfs.c:219) ... vfswrite (fs/readwrite.c:595 fs/readwrite.c:688) ksyswrite (fs/readwrite.c:740)(CVE-2026-64546)

Database specific

{
    "severity": "Medium"
}

References

Affected packages

openEuler:20.03-LTS-SP4 / kernel

Package

Name: kernel
Purl: pkg:rpm/openEuler/kernel&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.19.90-2608.4.0.0386.oe2003sp4

Ecosystem specific

{
    "x86_64": [
        "bpftool-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "bpftool-debuginfo-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "kernel-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "kernel-debuginfo-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "kernel-debugsource-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "kernel-devel-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "kernel-source-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "kernel-tools-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "kernel-tools-debuginfo-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "kernel-tools-devel-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "perf-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "perf-debuginfo-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "python2-perf-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "python2-perf-debuginfo-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "python3-perf-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm",
        "python3-perf-debuginfo-4.19.90-2608.4.0.0386.oe2003sp4.x86_64.rpm"
    ],
    "src": [
        "kernel-4.19.90-2608.4.0.0386.oe2003sp4.src.rpm"
    ],
    "aarch64": [
        "bpftool-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "bpftool-debuginfo-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "kernel-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "kernel-debuginfo-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "kernel-debugsource-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "kernel-devel-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "kernel-source-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "kernel-tools-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "kernel-tools-debuginfo-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "kernel-tools-devel-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "perf-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "perf-debuginfo-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "python2-perf-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "python2-perf-debuginfo-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "python3-perf-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm",
        "python3-perf-debuginfo-4.19.90-2608.4.0.0386.oe2003sp4.aarch64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-3452.json"