RLSA-2026:63129

kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064)
kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)
kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)
kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185)
kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)
kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)
kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)
kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)
kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)
kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)
kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)
kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)
kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)
kernel: smb: client: fix query directory replay double-free (CVE-2026-64387)
kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)
kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)
kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)
kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)
kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)
kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)
kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166)
kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145)
kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)
kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)

Bug Fix(es) and Enhancement(s):

[Rocky Linux 9] TPM becomes completely unresponsive and requires a full reboot to clear [rhel-9.8.z] (JIRA:Rocky Linux-213940)
RT scheduler livelock caused by missing backport of 94894c9c477e [rhel-9.8.z] (JIRA:Rocky Linux-240634)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Database specific

{
    "license":  "CC-BY-4.0",
    "license_url":  "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory":  "RHSA-2026:63129"
}

References

Credits

- Rocky Enterprise Software Foundation
- Red Hat

Affected packages

Rocky Linux:9 / kernel

Package

Name: kernel
Purl: pkg:rpm/rocky-linux/kernel?distro=rocky-linux-9&epoch=0

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

0:5.14.0-687.44.1.el9_8

Database specific

Show details

{
    "yum_repository":  "BaseOS"
}

Database specific

source

"https://storage.googleapis.com/resf-osv-data/RLSA-2026:63129.json"