Vulnerability-Lookup

RHSA-2026:59737

Vulnerability from csaf_redhat - Published: 2026-08-26 04:08 - Updated: 2026-08-26 09:46

Summary

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Severity

Important

Notes

Topic: An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189) * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277) * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276) Bug Fix(es) and Enhancement(s): * [RHEL-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:RHEL-178088) * SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-8.10.z] (JIRA:RHEL-222800) * ss core dumped when there is an SCTP session [rhel-8.10.z] (JIRA:RHEL-212400) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-52924

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending specially crafted SCTP packets. This could lead to a system crash, causing a Denial of Service (DoS).

7.0 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-63886

A flaw was found in the Linux kernel's iSCSI target functionality. This vulnerability allows a remote attacker to cause a buffer overflow by sending a specially crafted Challenge-Handshake Authentication Authentication Protocol (CHAP) response. The system fails to validate the length of the BASE64-encoded CHAP response before decoding it, leading to memory corruption. This could potentially lead to a denial of service or other unpredictable system behavior.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-805 - Buffer Access with Incorrect Length Value

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-63913

A flaw was found in the Linux kernel's netfilter conntrack TCP state machine. A remote attacker can exploit this vulnerability by sending a specially crafted sequence of TCP (Transmission Control Protocol) packets, specifically a SYN (synchronize) packet followed by an RST (reset) packet with an invalid sequence number. This improper handling of the RST packet can prematurely terminate an active Network Address Translation (NAT) entry, making connection teardown easier than intended and potentially leading to a denial of service for affected connections.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-358 - Improperly Implemented Security Check for Standard

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-64189

A flaw was found in the Linux kernel's netfilter ipset component. A race condition exists between the `ip_set_list` resize operation and dump operations. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated. A successful exploitation of this flaw could result in a kernel panic, effectively causing a Denial of Service (DoS) on the system.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2026-64191

A flaw was found in the Linux kernel's `i2c-stub` driver. A local user with access to the `/dev/i2c-*` device can exploit this vulnerability by issuing an I2C System Management Bus (SMBus) input/output control (ioctl) command with a specially crafted block transfer length. This invalid length can cause the driver to read or write beyond the allocated buffer, leading to a stack-out-of-bounds error and a system crash, resulting in a Denial of Service (DoS).

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-64276

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. This vulnerability occurs because the driver incorrectly allocates memory for a keymap, leading to an out-of-bounds memory access. A local user with access to a specially crafted input device could exploit this to read or write to unauthorized memory regions. This could result in information disclosure or potentially allow for further system compromise.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-64277

A flaw was found in the Linux kernel's `synaptics-rmi4` input driver. The `rmi_f3a_map_gpios()` function incorrectly allocates memory for the `gpio_key_map`, making it smaller than required. This allows a device reporting a specific `gpio_count` value to trigger an out-of-bounds read, leading to information disclosure by leaking adjacent slab memory to user space. Additionally, a local user with access to the `evdev` node can exploit this vulnerability to perform out-of-bounds writes with caller-controlled values, which may lead to further system compromise.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-64320

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memory, leading to information disclosure of kernel pointers. This vulnerability could also cause a denial of service by crashing the target host.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 30 products

Product	Version	Remediation
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix
Unresolved product id: RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

References

51 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:59737	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492095	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502329	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502438	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502872	external
https://bugzilla.redhat.com/show_bug.cgi?id=2502889	external
https://bugzilla.redhat.com/show_bug.cgi?id=2507061	external
https://bugzilla.redhat.com/show_bug.cgi?id=2507290	external
https://bugzilla.redhat.com/show_bug.cgi?id=2507301	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-52924	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492095	external
https://www.cve.org/CVERecord?id=CVE-2026-52924	external
https://nvd.nist.gov/vuln/detail/CVE-2026-52924	external
https://lore.kernel.org/linux-cve-announce/202606…	external
https://access.redhat.com/security/cve/CVE-2026-63886	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502329	external
https://www.cve.org/CVERecord?id=CVE-2026-63886	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63886	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-63913	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502438	external
https://www.cve.org/CVERecord?id=CVE-2026-63913	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63913	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64189	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502889	external
https://www.cve.org/CVERecord?id=CVE-2026-64189	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64189	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64191	self
https://bugzilla.redhat.com/show_bug.cgi?id=2502872	external
https://www.cve.org/CVERecord?id=CVE-2026-64191	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64191	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64276	self
https://bugzilla.redhat.com/show_bug.cgi?id=2507301	external
https://www.cve.org/CVERecord?id=CVE-2026-64276	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64276	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64277	self
https://bugzilla.redhat.com/show_bug.cgi?id=2507290	external
https://www.cve.org/CVERecord?id=CVE-2026-64277	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64277	external
https://lore.kernel.org/linux-cve-announce/202607…	external
https://access.redhat.com/security/cve/CVE-2026-64320	self
https://bugzilla.redhat.com/show_bug.cgi?id=2507061	external
https://www.cve.org/CVERecord?id=CVE-2026-64320	external
https://nvd.nist.gov/vuln/detail/CVE-2026-64320	external
https://lore.kernel.org/linux-cve-announce/202607…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for kernel-rt is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)\n\n* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)\n\n* kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)\n\n* kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)\n\n* kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)\n\n* kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)\n\n* kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)\n\n* kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)\n\nBug Fix(es) and Enhancement(s):\n\n* [RHEL-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:RHEL-178088)\n\n* SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-8.10.z] (JIRA:RHEL-222800)\n\n* ss core dumped when there is an SCTP session [rhel-8.10.z] (JIRA:RHEL-212400)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:59737",
        "url": "https://access.redhat.com/errata/RHSA-2026:59737"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2492095",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492095"
      },
      {
        "category": "external",
        "summary": "2502329",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502329"
      },
      {
        "category": "external",
        "summary": "2502438",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502438"
      },
      {
        "category": "external",
        "summary": "2502872",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502872"
      },
      {
        "category": "external",
        "summary": "2502889",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502889"
      },
      {
        "category": "external",
        "summary": "2507061",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507061"
      },
      {
        "category": "external",
        "summary": "2507290",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507290"
      },
      {
        "category": "external",
        "summary": "2507301",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507301"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59737.json"
      }
    ],
    "title": "Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2026-08-26T09:46:24+00:00",
      "generator": {
        "date": "2026-08-26T09:46:24+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:59737",
      "initial_release_date": "2026-08-26T04:08:57+00:00",
      "revision_history": [
        {
          "date": "2026-08-26T04:08:57+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-26T04:08:57+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-26T09:46:24+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux NFV (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux NFV (v. 8)",
                  "product_id": "NFV-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux RT (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux RT (v. 8)",
                  "product_id": "RT-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::realtime"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
                "product": {
                  "name": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
                  "product_id": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@4.18.0-553.158.1.rt7.499.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-core@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-core@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-devel@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-kvm@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-modules@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-modules-extra@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-devel@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-kvm@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-modules@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-modules-extra@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-debuginfo@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_id": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo-common-x86_64@4.18.0-553.158.1.rt7.499.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src"
        },
        "product_reference": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8)",
          "product_id": "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "NFV-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src"
        },
        "product_reference": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64 as a component of Red Hat Enterprise Linux RT (v. 8)",
          "product_id": "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        },
        "product_reference": "kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
        "relates_to_product_reference": "RT-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-52924",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-06-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492095"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s Stream Control Transmission Protocol (SCTP) implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending specially crafted SCTP packets. This could lead to a system crash, causing a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: sctp: purge outqueue on stale COOKIE-ECHO handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A use after free can occur in the SCTP stale COOKIE-ECHO handling path when a Stale Cookie ERROR rolls an association back from COOKIE_ECHOED to COOKIE_WAIT while user data is already queued or bundled with COOKIE-ECHO. The stream update path can free the old stream state, while scheduler cached state such as stream out_curr or queued transmit state can still reference the freed sctp_stream_out entry. Later SCTP dequeue paths such as FCFS, RR, or PRIO may dereference the stale stream state and crash the kernel. The issue is network reachable but AC:H is used because the trigger depends on a specific association setup and stale cookie rollback sequence. Impact is remote denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-52924"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492095",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492095"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-52924",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-52924"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-52924",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52924"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026062431-CVE-2026-52924-9f0b@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026062431-CVE-2026-52924-9f0b@gregkh/T"
        }
      ],
      "release_date": "2026-06-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T04:08:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59737"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: sctp: purge outqueue on stale COOKIE-ECHO handling"
    },
    {
      "cve": "CVE-2026-63886",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "discovery_date": "2026-07-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2502329"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s iSCSI target functionality. This vulnerability allows a remote attacker to cause a buffer overflow by sending a specially crafted Challenge-Handshake Authentication Authentication Protocol (CHAP) response. The system fails to validate the length of the BASE64-encoded CHAP response before decoding it, leading to memory corruption. This could potentially lead to a denial of service or other unpredictable system behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63886"
        },
        {
          "category": "external",
          "summary": "RHBZ#2502329",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502329"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63886",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63886"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63886",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63886"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63886-48e4@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026071940-CVE-2026-63886-48e4@gregkh/T"
        }
      ],
      "release_date": "2026-07-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T04:08:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59737"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode"
    },
    {
      "cve": "CVE-2026-63913",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-07-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2502438"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s netfilter conntrack TCP state machine. A remote attacker can exploit this vulnerability by sending a specially crafted sequence of TCP (Transmission Control Protocol) packets, specifically a SYN (synchronize) packet followed by an RST (reset) packet with an invalid sequence number. This improper handling of the RST packet can prematurely terminate an active Network Address Translation (NAT) entry, making connection teardown easier than intended and potentially leading to a denial of service for affected connections.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63913"
        },
        {
          "category": "external",
          "summary": "RHBZ#2502438",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502438"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63913",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63913"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63913",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63913"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026071946-CVE-2026-63913-9646@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026071946-CVE-2026-63913-9646@gregkh/T"
        }
      ],
      "release_date": "2026-07-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T04:08:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59737"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check"
    },
    {
      "cve": "CVE-2026-64189",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2502889"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s netfilter ipset component. A race condition exists between the `ip_set_list` resize operation and dump operations. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated. A successful exploitation of this flaw could result in a kernel panic, effectively causing a Denial of Service (DoS) on the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: netfilter: ipset: fix race between dump and ip_set_list resize",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-64189"
        },
        {
          "category": "external",
          "summary": "RHBZ#2502889",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502889"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-64189",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64189"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64189",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64189"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026072051-CVE-2026-64189-b911@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026072051-CVE-2026-64189-b911@gregkh/T"
        }
      ],
      "release_date": "2026-07-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T04:08:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59737"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: netfilter: ipset: fix race between dump and ip_set_list resize"
    },
    {
      "cve": "CVE-2026-64191",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-07-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2502872"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s `i2c-stub` driver. A local user with access to the `/dev/i2c-*` device can exploit this vulnerability by issuing an I2C System Management Bus (SMBus) input/output control (ioctl) command with a specially crafted block transfer length. This invalid length can cause the driver to read or write beyond the allocated buffer, leading to a stack-out-of-bounds error and a system crash, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: i2c: stub: Reject I2C block transfers with invalid length",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-64191"
        },
        {
          "category": "external",
          "summary": "RHBZ#2502872",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502872"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-64191",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64191"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64191",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64191"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026072052-CVE-2026-64191-42fe@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026072052-CVE-2026-64191-42fe@gregkh/T"
        }
      ],
      "release_date": "2026-07-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T04:08:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59737"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: i2c: stub: Reject I2C block transfers with invalid length"
    },
    {
      "cve": "CVE-2026-64276",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-07-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507301"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s synaptics-rmi4 input driver. This vulnerability occurs because the driver incorrectly allocates memory for a keymap, leading to an out-of-bounds memory access. A local user with access to a specially crafted input device could exploit this to read or write to unauthorized memory regions. This could result in information disclosure or potentially allow for further system compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-64276"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507301",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507301"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-64276",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64276"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64276",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64276"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026072501-CVE-2026-64276-b80d@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026072501-CVE-2026-64276-b80d@gregkh/T"
        }
      ],
      "release_date": "2026-07-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T04:08:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59737"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count"
    },
    {
      "cve": "CVE-2026-64277",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-07-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507290"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s `synaptics-rmi4` input driver. The `rmi_f3a_map_gpios()` function incorrectly allocates memory for the `gpio_key_map`, making it smaller than required. This allows a device reporting a specific `gpio_count` value to trigger an out-of-bounds read, leading to information disclosure by leaking adjacent slab memory to user space. Additionally, a local user with access to the `evdev` node can exploit this vulnerability to perform out-of-bounds writes with caller-controlled values, which may lead to further system compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-64277"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507290",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507290"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-64277",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64277"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64277",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64277"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026072501-CVE-2026-64277-34e2@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026072501-CVE-2026-64277-34e2@gregkh/T"
        }
      ],
      "release_date": "2026-07-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T04:08:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59737"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count"
    },
    {
      "cve": "CVE-2026-64320",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-07-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507061"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memory, leading to information disclosure of kernel pointers. This vulnerability could also cause a denial of service by crashing the target host.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
          "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-64320"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507061",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507061"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-64320",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64320"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64320",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64320"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026072511-CVE-2026-64320-4b43@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026072511-CVE-2026-64320-4b43@gregkh/T"
        }
      ],
      "release_date": "2026-07-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-26T04:08:57+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59737"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-kvm-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "NFV-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.src",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-core-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-debuginfo-common-x86_64-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-devel-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64",
            "RT-8.10.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:4.18.0-553.158.1.rt7.499.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page"
    }
  ]
}

CVE-2026-52924 (GCVE-0-2026-52924)

Vulnerability from cvelistv5 – Published: 2026-06-24 07:14 – Updated: 2026-08-26 12:04

Title

sctp: purge outqueue on stale COOKIE-ECHO handling

Summary

In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

CWE

CWE-825 - Expired Pointer Dereference

Assigner

Linux mitre root

References

14 references

URL	Tags
https://git.kernel.org/stable/c/84b7a319105db2f91…
https://git.kernel.org/stable/c/f46e1d1a758878f0d…
https://git.kernel.org/stable/c/3c0741a441a7df709…
https://git.kernel.org/stable/c/2afc9e684dc7fecf7…
https://git.kernel.org/stable/c/1d4652f677906a644…
https://git.kernel.org/stable/c/a6207349e703cfc04…
https://git.kernel.org/stable/c/83ade59e5da365f4b…
https://git.kernel.org/stable/c/e374b22e9b07b72a2…
https://access.redhat.com/security/cve/CVE-2026-52924	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2492095	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:59723	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59821	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59737	vendor-advisoryx_refsource_REDHAT

Impacted products

9 products

Vendor	Product	Version
Linux	Linux	Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < 84b7a319105db2f917ccdcf502bdc866082b1285 (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8 (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < 3c0741a441a7df7099d7ca6a64a6a0de09c677c8 (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < 2afc9e684dc7fecf73db1edc937ebbc47b4b68dc (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < 1d4652f677906a64487c13f9ace54b0eb263b5d0 (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < a6207349e703cfc04756a4d16dec9176135813a5 (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < 83ade59e5da365f4bf8bce72c5a38774202b442f (git) Affected: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 , < e374b22e9b07b72a25909621464ff74096151bfb (git)
Linux	Linux	Affected: 4.15 Unaffected: 0 , < 4.15 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.158.1.rt7.499.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.158.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.42.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.158.1.rt7.499.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.158.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.42.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Stream Control Transmission Protocol (SCTP) implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending specially crafted SCTP packets. This could lead to a system crash, causing a Denial of Service (DoS)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Moderate"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-825",
                "description": "Expired Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T12:04:46.663Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-52924"
          },
          {
            "name": "RHBZ#2492095",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492095"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52924.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59723"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59821"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59737"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:59723: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59821: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59737: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: sctp: purge outqueue on stale COOKIE-ECHO handling",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "84b7a319105db2f917ccdcf502bdc866082b1285",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "3c0741a441a7df7099d7ca6a64a6a0de09c677c8",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "2afc9e684dc7fecf73db1edc937ebbc47b4b68dc",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "1d4652f677906a64487c13f9ace54b0eb263b5d0",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "a6207349e703cfc04756a4d16dec9176135813a5",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "83ade59e5da365f4bf8bce72c5a38774202b442f",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            },
            {
              "lessThan": "e374b22e9b07b72a25909621464ff74096151bfb",
              "status": "affected",
              "version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sm_statefuns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: purge outqueue on stale COOKIE-ECHO handling\n\nsctp_stream_update() is only invoked when the association is moved into\nCOOKIE_WAIT during association setup/reconfiguration. In this path, the\noutbound stream scheduler state (stream-\u003eout_curr) is expected to be\nclean, since no user data should have been transmitted yet unless the\nstate machine has already partially progressed.\n\nHowever, a corner case exists in sctp_sf_do_5_2_6_stale(): when a\nStale Cookie ERROR is received, the association is rolled back from\nCOOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already\nhave been queued and even bundled with the COOKIE-ECHO chunk.\n\nDuring the rollback, sctp_stream_update() frees the old stream table\nand installs a new one, but it does not invalidate stream-\u003eout_curr.\nAs a result, out_curr may still point to a freed sctp_stream_out\nentry from the previous stream state.\n\nLater, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on\nstream-\u003eout_curr-\u003eext, which can lead to use-after-free once the old\nstream state has been released via sctp_stream_free().\n\nThis results in crashes such as (reported by Yuqi):\n\n  BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140\n  Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312\n  CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted\n     7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)\n   sctp_sched_fcfs_dequeue+0x13a/0x140\n   sctp_outq_flush+0x1603/0x33e0\n   sctp_do_sm+0x31c9/0x5d30\n   sctp_assoc_bh_rcv+0x392/0x6f0\n   sctp_inq_push+0x1db/0x270\n   sctp_rcv+0x138d/0x3c10\n\nFix this by fully purging the association outqueue when handling the\nStale Cookie case. This ensures all pending transmit and retransmit\nstate is dropped, and any scheduler cached pointers are invalidated,\nmaking it safe to rebuild stream state during COOKIE_WAIT restart.\n\nUpdating only stream-\u003eout_curr would be insufficient, since queued\nand retransmittable data would still reference the old stream state and\ntrigger later use-after-free in dequeue paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable SCTP state-machine path is reached by received SCTP packets, specifically an ERROR chunk with a Stale Cookie cause sent by the remote SCTP peer during COOKIE_ECHOED handling.\nAC:L - A malicious SCTP peer can drive the required handshake state and send the stale-cookie ERROR; no race or hard-to-control kernel condition is required once data has been queued for COOKIE-ECHO bundling.\nPR:N - The triggering packet is accepted from the network after SCTP verification-tag checks, but those are protocol state checks rather than authentication or privileges. No local account or administrative capability is required for a remote peer.\nUI:N - Exploitation does not require a human user action; it can occur during normal SCTP association setup and data transmission with a malicious peer.\nS:U - The impact is within the Linux kernel networking stack on the same system and does not cross a separate security authority such as a hypervisor or sandbox boundary.\nC:H - The bug leaves stream-\u003eout_curr pointing at freed stream state, creating a use-after-free in scheduler dequeue paths. Per kernel CVSS guidance, use-after-free memory corruption can be leveraged for high confidentiality impact.\nI:H - The stale pointer use-after-free is kernel heap memory corruption and may be exploitable beyond a crash via heap manipulation. Per the required guidance, UAFs warrant high integrity impact.\nA:H - The reported failure is a KASAN slab-use-after-free in SCTP dequeue leading to a kernel crash/oops. This provides high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:45.688Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/84b7a319105db2f917ccdcf502bdc866082b1285"
        },
        {
          "url": "https://git.kernel.org/stable/c/f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c0741a441a7df7099d7ca6a64a6a0de09c677c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2afc9e684dc7fecf73db1edc937ebbc47b4b68dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d4652f677906a64487c13f9ace54b0eb263b5d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6207349e703cfc04756a4d16dec9176135813a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/83ade59e5da365f4bf8bce72c5a38774202b442f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e374b22e9b07b72a25909621464ff74096151bfb"
        }
      ],
      "title": "sctp: purge outqueue on stale COOKIE-ECHO handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52924",
    "datePublished": "2026-06-24T07:14:18.646Z",
    "dateReserved": "2026-06-09T07:44:35.368Z",
    "dateUpdated": "2026-08-26T12:04:46.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63886 (GCVE-0-2026-63886)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:54 – Updated: 2026-08-05 12:36

Title

scsi: target: iscsi: Validate CHAP_R length before base64 decode

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passes chap_r directly to chap_base64_decode() without checking whether the input length could produce more than digest_size bytes of output. chap_base64_decode() writes to the destination unconditionally as long as there is input to consume. With MAX_RESPONSE_LENGTH set to 128 and the "0b" prefix stripped by extract_param(), up to 127 base64 characters can reach the decoder. 127 characters decode to 95 bytes. For SHA-256 (digest_size=32) this overflows client_digest by 63 bytes; for MD5 (digest_size=16) the overflow is 79 bytes. The length check at line 344 fires after the write has already happened. The HEX branch in the same switch statement already validates the length up front. Apply the same approach to the BASE64 branch: strip trailing base64 padding characters, then reject any input whose data length exceeds DIV_ROUND_UP(digest_size * 4, 3) before calling the decoder. Stripping trailing '=' before the comparison handles both padded and unpadded encodings. chap_base64_decode() already returns early on '=', so the full original string is still passed to the decoder unchanged. The mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is kzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at CHAP_CHALLENGE_STR_LEN characters, so at most CHAP_CHALLENGE_STR_LEN-1 base64 characters reach the decoder. The maximum decoded size, DIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than CHAP_CHALLENGE_STR_LEN, so no overflow is possible there. A comment is added at the call site to document this.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/82454e6f21e56ea9a…
https://git.kernel.org/stable/c/edd06675a02376ea8…
https://git.kernel.org/stable/c/bf154c657828ed053…
https://git.kernel.org/stable/c/4a3a19c98a8207ad0…
https://git.kernel.org/stable/c/c04e8579935612020…
https://git.kernel.org/stable/c/85db7391310b1304d…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1e5733883421495908f3b90d9d807663038b4136 , < 82454e6f21e56ea9a0a9de7d0ff7e1dfb83e34d6 (git) Affected: 1e5733883421495908f3b90d9d807663038b4136 , < edd06675a02376ea8347dba7c29ad982ba5b36ee (git) Affected: 1e5733883421495908f3b90d9d807663038b4136 , < bf154c657828ed05399bca5d98cf1611bb048b12 (git) Affected: 1e5733883421495908f3b90d9d807663038b4136 , < 4a3a19c98a8207ad08bec554703d90f2c34a8cc6 (git) Affected: 1e5733883421495908f3b90d9d807663038b4136 , < c04e85799356120209b351a148ac2db888d5ffd9 (git) Affected: 1e5733883421495908f3b90d9d807663038b4136 , < 85db7391310b1304d2dc8ae3b0b12105a9567147 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "82454e6f21e56ea9a0a9de7d0ff7e1dfb83e34d6",
              "status": "affected",
              "version": "1e5733883421495908f3b90d9d807663038b4136",
              "versionType": "git"
            },
            {
              "lessThan": "edd06675a02376ea8347dba7c29ad982ba5b36ee",
              "status": "affected",
              "version": "1e5733883421495908f3b90d9d807663038b4136",
              "versionType": "git"
            },
            {
              "lessThan": "bf154c657828ed05399bca5d98cf1611bb048b12",
              "status": "affected",
              "version": "1e5733883421495908f3b90d9d807663038b4136",
              "versionType": "git"
            },
            {
              "lessThan": "4a3a19c98a8207ad08bec554703d90f2c34a8cc6",
              "status": "affected",
              "version": "1e5733883421495908f3b90d9d807663038b4136",
              "versionType": "git"
            },
            {
              "lessThan": "c04e85799356120209b351a148ac2db888d5ffd9",
              "status": "affected",
              "version": "1e5733883421495908f3b90d9d807663038b4136",
              "versionType": "git"
            },
            {
              "lessThan": "85db7391310b1304d2dc8ae3b0b12105a9567147",
              "status": "affected",
              "version": "1e5733883421495908f3b90d9d807663038b4136",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/iscsi/iscsi_target_auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Validate CHAP_R length before base64 decode\n\nchap_server_compute_hash() allocates client_digest as\nkzalloc(chap-\u003edigest_size) and then, for BASE64-encoded responses,\npasses chap_r directly to chap_base64_decode() without checking whether\nthe input length could produce more than digest_size bytes of output.\n\nchap_base64_decode() writes to the destination unconditionally as long\nas there is input to consume. With MAX_RESPONSE_LENGTH set to 128 and\nthe \"0b\" prefix stripped by extract_param(), up to 127 base64 characters\ncan reach the decoder. 127 characters decode to 95 bytes. For SHA-256\n(digest_size=32) this overflows client_digest by 63 bytes; for MD5\n(digest_size=16) the overflow is 79 bytes.\n\nThe length check at line 344 fires after the write has already happened.\n\nThe HEX branch in the same switch statement already validates the length\nup front. Apply the same approach to the BASE64 branch: strip trailing\nbase64 padding characters, then reject any input whose data length\nexceeds DIV_ROUND_UP(digest_size * 4, 3) before calling the decoder.\n\nStripping trailing \u0027=\u0027 before the comparison handles both padded and\nunpadded encodings. chap_base64_decode() already returns early on \u0027=\u0027,\nso the full original string is still passed to the decoder unchanged.\n\nThe mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is\nkzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at\nCHAP_CHALLENGE_STR_LEN characters, so at most CHAP_CHALLENGE_STR_LEN-1\nbase64 characters reach the decoder. The maximum decoded size,\nDIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than\nCHAP_CHALLENGE_STR_LEN, so no overflow is possible there. A comment is\nadded at the call site to document this."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered by a remote iSCSI initiator sending crafted CHAP login PDUs over TCP to the in-kernel LIO iSCSI target during the network login/authentication handshake.\nAC:L - Once an iSCSI target with CHAP is reachable, an attacker can reliably trigger the overflow by sending CHAP_R with a 0b-prefixed base64 string up to 127 characters; no race or special memory layout is required.\nPR:N - The heap overflow occurs during the CHAP authentication handshake before the password hash comparison succeeds, so exploitation is reachable by an unauthenticated remote network attacker who knows a configured CHAP username.\nUI:N - Exploitation requires only the attacker initiating an iSCSI login connection and sending malicious CHAP PDUs; no action from a victim user is needed.\nS:U - Successful exploitation corrupts kernel heap memory within the same kernel security boundary, enabling denial of service or kernel privilege escalation, not a cross-boundary escape such as VM guest-to-host.\nC:H - The out-of-bounds heap write corrupts adjacent kmalloc objects and can be leveraged for arbitrary kernel memory disclosure through heap grooming, consistent with heap overflow impact guidance.\nI:H - A controlled kernel heap out-of-bounds write of up to 79 bytes past a digest-sized buffer can corrupt adjacent structures and be developed into arbitrary code execution or kernel privilege escalation.\nA:H - The overflow causes slab-out-of-bounds writes confirmed by KASAN and can crash or destabilize the kernel during login processing, constituting high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:55.369Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/82454e6f21e56ea9a0a9de7d0ff7e1dfb83e34d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/edd06675a02376ea8347dba7c29ad982ba5b36ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf154c657828ed05399bca5d98cf1611bb048b12"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a3a19c98a8207ad08bec554703d90f2c34a8cc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c04e85799356120209b351a148ac2db888d5ffd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/85db7391310b1304d2dc8ae3b0b12105a9567147"
        }
      ],
      "title": "scsi: target: iscsi: Validate CHAP_R length before base64 decode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63886",
    "datePublished": "2026-07-19T14:54:59.395Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-08-05T12:36:55.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63913 (GCVE-0-2026-63913)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37

Title

netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/2006979a15af5404b…
https://git.kernel.org/stable/c/6476c17d536dbd321…
https://git.kernel.org/stable/c/f5547bebc416d56f5…
https://git.kernel.org/stable/c/2bb6d82b586ea5a4c…
https://git.kernel.org/stable/c/f206def4e86d810f9…
https://git.kernel.org/stable/c/b98ab51c45c5608a1…
https://git.kernel.org/stable/c/d67c6adee8d1b6533…
https://git.kernel.org/stable/c/bed6e04be8e6b9133…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < 2006979a15af5404bf932a325357683c0bac1656 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < 6476c17d536dbd321c073242e762ddb2713a1238 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < f5547bebc416d56f56fb5b86dc20aabfa42165a0 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < 2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < f206def4e86d810f927ba1d8e322ea72b29bce58 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < b98ab51c45c5608a1c19ce7fd17a3032469bb83f (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < d67c6adee8d1b65330d0174c4c367faba14e80a8 (git) Affected: 9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1 , < bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a (git)
Linux	Linux	Affected: 2.6.15 Unaffected: 0 , < 2.6.15 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_proto_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2006979a15af5404bf932a325357683c0bac1656",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "6476c17d536dbd321c073242e762ddb2713a1238",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "f5547bebc416d56f56fb5b86dc20aabfa42165a0",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "f206def4e86d810f927ba1d8e322ea72b29bce58",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "b98ab51c45c5608a1c19ce7fd17a3032469bb83f",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "d67c6adee8d1b65330d0174c4c367faba14e80a8",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_proto_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.15"
            },
            {
              "lessThan": "2.6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n\nAn unintended behavior in the TCP conntrack state machine allows a\nconnection to be forced into the CLOSE state using an RST packet with an\ninvalid sequence number.\n\nSpecifically, after a SYN packet is observed, an RST with an invalid SEQ\ncan transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of\nwhether the RST corresponds to the expected reply direction. The relevant\ncode path assumes the RST is a response to an outgoing SYN, but does not\nvalidate packet direction or ensure that a matching SYN was actually sent\nin the opposite direction.\n\nAs a result, a crafted packet sequence consisting of a SYN followed by an\ninvalid-sequence RST can prematurely terminate an active NAT entry. This\nmakes connection teardown easier than intended.\n\nSo, tighten the state transition logic to ensure that RST-triggered\nCLOSE transitions only occur when the RST is a valid response to a\npreviously observed SYN in the correct direction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code runs in nf_conntrack_tcp_packet() on every TCP packet processed by netfilter conntrack via the NF_INET_PRE_ROUTING and LOCAL_OUT hooks; a remote attacker can deliver the crafted SYN+RST sequence over the network to internet-facing NAT gateways, routers, and servers with connection tracking enabled.\nAC:L - The attacker fully controls the exploit sequence (SYN to annotate last_index/last_end, then RST with matching ack_seq but invalid seq) and can time/retry at will; no race against third parties or rare memory layout is required beyond knowing or observing the target connection 4-tuple.\nPR:N - Exploitation requires only the ability to send TCP packets to a system running conntrack/NAT; no authentication, local shell access, or CAP_NET_ADMIN/netlink configuration is needed to reach the vulnerable state-transition path.\nUI:N - No victim user action (opening files, clicking links, mounting filesystems) is required; the attack is carried out entirely by sending crafted network packets to the target.\nS:U - Impact is confined to incorrect conntrack/NAT state on the same kernel/firewall security authority; it does not cross VM, container, or IOMMU boundaries to affect a separate security domain.\nC:N - This is a state-machine logic bug with no memory corruption, out-of-bounds access, use-after-free, or information disclosure; only connection-tracking metadata is affected.\nI:L - The bug causes unauthorized modification of conntrack connection state (forcing TCP_CONNTRACK_CLOSE and accelerated NAT entry teardown) rather than arbitrary memory or code execution, constituting limited integrity impact on data processed by the conntrack subsystem.\nA:H - Prematurely closing conntrack/NAT entries disrupts active TCP sessions and can be repeated against arbitrary tracked connections without authentication, causing sustained denial of service to affected network flows on NAT gateways and stateful firewalls."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:07.250Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2006979a15af5404bf932a325357683c0bac1656"
        },
        {
          "url": "https://git.kernel.org/stable/c/6476c17d536dbd321c073242e762ddb2713a1238"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5547bebc416d56f56fb5b86dc20aabfa42165a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77"
        },
        {
          "url": "https://git.kernel.org/stable/c/f206def4e86d810f927ba1d8e322ea72b29bce58"
        },
        {
          "url": "https://git.kernel.org/stable/c/b98ab51c45c5608a1c19ce7fd17a3032469bb83f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d67c6adee8d1b65330d0174c4c367faba14e80a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a"
        }
      ],
      "title": "netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63913",
    "datePublished": "2026-07-19T14:55:17.917Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-08-05T12:37:07.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64189 (GCVE-0-2026-64189)

Vulnerability from cvelistv5 – Published: 2026-07-20 16:27 – Updated: 2026-08-17 04:51

Title

netfilter: ipset: fix race between dump and ip_set_list resize

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section. A concurrent ip_set_create() can grow the array: it publishes the new array, calls synchronize_net() and then kvfree()s the old one. Since the dump paths read the array outside any RCU reader, synchronize_net() does not wait for them and the old array can be freed while they still index into it, causing a use-after-free. The dumped set itself stays pinned via set->ref_netlink, so only the array load needs protecting. Take rcu_read_lock() around it, matching ip_set_get_byname() and __ip_set_put_byindex(). BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) Read of size 8 at addr ffff88800b5c4018 by task exploit/150 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) netlink_dump (net/netlink/af_netlink.c:2325) netlink_recvmsg (net/netlink/af_netlink.c:1976) sock_recvmsg (net/socket.c:1159) __sys_recvfrom (net/socket.c:2315) ... Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7] RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698) Kernel panic - not syncing: Fatal exception

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/a7a29927795968320…
https://git.kernel.org/stable/c/1bc67c3fc98e9fc07…
https://git.kernel.org/stable/c/e8a9976b61f1bc4aa…
https://git.kernel.org/stable/c/96fbafc20ebd9a613…
https://git.kernel.org/stable/c/ff86ea9b7fdf70564…
https://git.kernel.org/stable/c/81d54c766337b923e…
https://git.kernel.org/stable/c/e8ee198bbc04a32d3…
https://git.kernel.org/stable/c/7cd9103283b26b917…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 , < a7a299277959683204d73333c32c092fd69327d4 (git) Affected: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 , < 1bc67c3fc98e9fc07032cc56afcdbc690c47d11e (git) Affected: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 , < e8a9976b61f1bc4aa7fd25fa26726dfdf2adf710 (git) Affected: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 , < 96fbafc20ebd9a613736c2998b89c539fe3042f5 (git) Affected: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 , < ff86ea9b7fdf70564e60436fbee68c96bc459943 (git) Affected: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 , < 81d54c766337b923eec26da0a13406760b091093 (git) Affected: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 , < e8ee198bbc04a32d336e79160fde980e0235b39f (git) Affected: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 , < 7cd9103283b26b917360ec99d7d2f2d761bcf1ab (git) Affected: 2f6bf7917f55f9dae913193e49672b3598620eab (git) Affected: 4.19.5 , < 4.20 (semver)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7a299277959683204d73333c32c092fd69327d4",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "1bc67c3fc98e9fc07032cc56afcdbc690c47d11e",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "e8a9976b61f1bc4aa7fd25fa26726dfdf2adf710",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "96fbafc20ebd9a613736c2998b89c539fe3042f5",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "ff86ea9b7fdf70564e60436fbee68c96bc459943",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "81d54c766337b923eec26da0a13406760b091093",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "e8ee198bbc04a32d336e79160fde980e0235b39f",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "7cd9103283b26b917360ec99d7d2f2d761bcf1ab",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2f6bf7917f55f9dae913193e49672b3598620eab",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: fix race between dump and ip_set_list resize\n\nThe release path of ip_set_dump_do() and ip_set_dump_done() read\ninst-\u003eip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw()\nof the array pointer. These run from netlink_recvmsg() without the nfnl\nmutex and without an RCU read-side critical section.\n\nA concurrent ip_set_create() can grow the array: it publishes the new\narray, calls synchronize_net() and then kvfree()s the old one. Since the\ndump paths read the array outside any RCU reader, synchronize_net() does\nnot wait for them and the old array can be freed while they still index\ninto it, causing a use-after-free.\n\nThe dumped set itself stays pinned via set-\u003eref_netlink, so only the\narray load needs protecting. Take rcu_read_lock() around it, matching\nip_set_get_byname() and __ip_set_put_byindex().\n\n  BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)\n  Read of size 8 at addr ffff88800b5c4018 by task exploit/150\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)\n   netlink_dump (net/netlink/af_netlink.c:2325)\n   netlink_recvmsg (net/netlink/af_netlink.c:1976)\n   sock_recvmsg (net/socket.c:1159)\n   __sys_recvfrom (net/socket.c:2315)\n   ...\n  Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI\n  KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7]\n  RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698)\n  Kernel panic - not syncing: Fatal exception"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable dump and resize paths are reached through local NETLINK_NETFILTER send and receive syscalls, not through remotely received packets.\nAC:L - The attacker controls both sides by issuing an ipset dump and concurrent CREATE requests that grow ip_set_list, and can repeat the race without any victim-controlled condition.\nPR:L - NFNETLINK requires CAP_NET_ADMIN in the network namespace\u0027s owning user namespace, which an unprivileged user can obtain through user and network namespaces on deployments permitting unprivileged user namespaces.\nUI:N - After obtaining local execution, the attacker can trigger both racing operations without any action by another user.\nS:U - Exploitation compromises the kernel of the same host and constitutes standard local privilege escalation rather than crossing a VM, hypervisor, or IOMMU boundary.\nC:H - Reclaiming the freed array can make the loaded struct ip_set pointer attacker-influenced, after which variant-pointer dereferences can enable kernel code execution and arbitrary memory disclosure.\nI:H - The release path performs an indirect uref callback and decrements ref_netlink through the stale pointer, providing control-flow and kernel-memory-write opportunities after heap reclamation.\nA:H - The reported use-after-free produced a general-protection fault and kernel panic, and an attacker can trigger the race repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:49.683Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7a299277959683204d73333c32c092fd69327d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bc67c3fc98e9fc07032cc56afcdbc690c47d11e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8a9976b61f1bc4aa7fd25fa26726dfdf2adf710"
        },
        {
          "url": "https://git.kernel.org/stable/c/96fbafc20ebd9a613736c2998b89c539fe3042f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff86ea9b7fdf70564e60436fbee68c96bc459943"
        },
        {
          "url": "https://git.kernel.org/stable/c/81d54c766337b923eec26da0a13406760b091093"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8ee198bbc04a32d336e79160fde980e0235b39f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cd9103283b26b917360ec99d7d2f2d761bcf1ab"
        }
      ],
      "title": "netfilter: ipset: fix race between dump and ip_set_list resize",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64189",
    "datePublished": "2026-07-20T16:27:47.767Z",
    "dateReserved": "2026-07-19T07:54:57.040Z",
    "dateUpdated": "2026-08-17T04:51:49.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64191 (GCVE-0-2026-64191)

Vulnerability from cvelistv5 – Published: 2026-07-20 16:27 – Updated: 2026-08-05 12:39

Title

i2c: stub: Reject I2C block transfers with invalid length

Summary

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avoid overrunning the chip->words[256] register array, but does not validate it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union i2c_smbus_data.block buffer (34 bytes total). The driver is a development/test tool (CONFIG_I2C_STUB=m, not built by default) that must be loaded with a chip_addr= parameter. A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing stub_xfer() to read or write past the end of the union i2c_smbus_data.block buffer: BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223) Read of size 1 at addr ffff88800abcfd92 by task exploit/81 Call Trace: <TASK> stub_xfer (drivers/i2c/i2c-stub.c:223) __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593) i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536) i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391) i2cdev_ioctl (drivers/i2c/i2c-dev.c:478) __x64_sys_ioctl (fs/ioctl.c:583) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> The bug exists because i2c-stub implements .smbus_xfer directly, bypassing the I2C_SMBUS_BLOCK_MAX validation in i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same function correctly validates against I2C_SMBUS_BLOCK_MAX, but the I2C_SMBUS_I2C_BLOCK_DATA case does not. Fix by rejecting transfers with data->block[0] == 0 or data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with both the I2C_SMBUS_BLOCK_DATA case in the same function and the I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/7e9072dbd5f2f1793…
https://git.kernel.org/stable/c/21e87f336ac6303fe…
https://git.kernel.org/stable/c/3fd225f3e4cd67ec8…
https://git.kernel.org/stable/c/1c4ffe6b4f0436548…
https://git.kernel.org/stable/c/4bd8635f28c135a08…
https://git.kernel.org/stable/c/5f4d2bd028ebb6e4c…
https://git.kernel.org/stable/c/0526931b16e5a118d…
https://git.kernel.org/stable/c/6036b5067a8199ba7…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 7e9072dbd5f2f17934751873450d2c22080ead80 (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 21e87f336ac6303fed54a69b1d0d79a23b25c8d0 (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 3fd225f3e4cd67ec8ddab1afed9da03c7c43537c (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 1c4ffe6b4f04365485ed58d64c9bb86b46fc9037 (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 4bd8635f28c135a08aac6badcd7d9b5cdb34335f (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 5f4d2bd028ebb6e4c09a9d64842546022321d4a7 (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 0526931b16e5a118d367b7bfce7d797e63f7ac69 (git) Affected: 4710317891e4824ce1510a6b5066abbd3e917750 , < 6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e (git)
Linux	Linux	Affected: 2.6.33 Unaffected: 0 , < 2.6.33 (semver) Unaffected: 5.10.260 , ≤ 5.10.* (semver) Unaffected: 5.15.211 , ≤ 5.15.* (semver) Unaffected: 6.1.177 , ≤ 6.1.* (semver) Unaffected: 6.6.144 , ≤ 6.6.* (semver) Unaffected: 6.12.95 , ≤ 6.12.* (semver) Unaffected: 6.18.37 , ≤ 6.18.* (semver) Unaffected: 7.0.14 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/i2c-stub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7e9072dbd5f2f17934751873450d2c22080ead80",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "21e87f336ac6303fed54a69b1d0d79a23b25c8d0",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "3fd225f3e4cd67ec8ddab1afed9da03c7c43537c",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "1c4ffe6b4f04365485ed58d64c9bb86b46fc9037",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "4bd8635f28c135a08aac6badcd7d9b5cdb34335f",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "5f4d2bd028ebb6e4c09a9d64842546022321d4a7",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "0526931b16e5a118d367b7bfce7d797e63f7ac69",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            },
            {
              "lessThan": "6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e",
              "status": "affected",
              "version": "4710317891e4824ce1510a6b5066abbd3e917750",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/i2c-stub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.33"
            },
            {
              "lessThan": "2.6.33",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.37",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.14",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: stub: Reject I2C block transfers with invalid length\n\nThe I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data-\u003eblock[0]\nas the transfer length. The existing check only clamps it to avoid\noverrunning the chip-\u003ewords[256] register array, but does not validate\nit against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union\ni2c_smbus_data.block buffer (34 bytes total). The driver is a\ndevelopment/test tool (CONFIG_I2C_STUB=m, not built by default)\nthat must be loaded with a chip_addr= parameter.\n\nA local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl\nwith I2C_SMBUS_I2C_BLOCK_DATA and data-\u003eblock[0] \u003e 32, causing\nstub_xfer() to read or write past the end of the union\ni2c_smbus_data.block buffer:\n\n BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)\n Read of size 1 at addr ffff88800abcfd92 by task exploit/81\n Call Trace:\n  \u003cTASK\u003e\n  stub_xfer (drivers/i2c/i2c-stub.c:223)\n  __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)\n  i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)\n  i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)\n  i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)\n  __x64_sys_ioctl (fs/ioctl.c:583)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n  \u003c/TASK\u003e\n\nThe bug exists because i2c-stub implements .smbus_xfer directly,\nbypassing the I2C_SMBUS_BLOCK_MAX validation in\ni2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same\nfunction correctly validates against I2C_SMBUS_BLOCK_MAX, but the\nI2C_SMBUS_I2C_BLOCK_DATA case does not.\n\nFix by rejecting transfers with data-\u003eblock[0] == 0 or\ndata-\u003eblock[0] \u003e I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with\nboth the I2C_SMBUS_BLOCK_DATA case in the same function and the\nI2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached by a local process issuing I2C_SMBUS ioctls on an i2c-stub /dev/i2c-* character device; it is neither remotely nor physically reachable.\nAC:L - Once i2c-stub is loaded, the attacker controls the address, direction, length, and register contents, making the corruption deterministic without a race. The non-default module configuration defines the vulnerable deployment rather than complicating exploitation within it.\nPR:L - The attacker needs unprivileged local access to the applicable /dev/i2c-* node, but no capability or namespace-specific administrative privilege is checked anywhere along the ioctl path.\nUI:N - After the vulnerable adapter is configured, exploitation requires only attacker-issued ioctls and no action by another user.\nS:U - The corruption occurs within the host kernel and represents conventional local privilege escalation, without crossing a separate virtualization or hardware security authority.\nC:H - An oversized block write reads up to 222 bytes beyond the 34-byte stack union and persists those bytes in attacker-readable stub registers, enabling substantial kernel-stack disclosure.\nI:H - An oversized block read writes up to 222 attacker-chosen bytes beyond the stack union because the attacker can prepopulate the stub registers, enabling control-data corruption and potential kernel code execution.\nA:H - The controlled stack overwrite can corrupt stack canaries, return state, or other control data, causing a repeatable kernel oops or panic even when code execution is unsuccessful."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:59.861Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7e9072dbd5f2f17934751873450d2c22080ead80"
        },
        {
          "url": "https://git.kernel.org/stable/c/21e87f336ac6303fed54a69b1d0d79a23b25c8d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fd225f3e4cd67ec8ddab1afed9da03c7c43537c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c4ffe6b4f04365485ed58d64c9bb86b46fc9037"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bd8635f28c135a08aac6badcd7d9b5cdb34335f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f4d2bd028ebb6e4c09a9d64842546022321d4a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0526931b16e5a118d367b7bfce7d797e63f7ac69"
        },
        {
          "url": "https://git.kernel.org/stable/c/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e"
        }
      ],
      "title": "i2c: stub: Reject I2C block transfers with invalid length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64191",
    "datePublished": "2026-07-20T16:27:51.120Z",
    "dateReserved": "2026-07-19T07:54:57.040Z",
    "dateUpdated": "2026-08-05T12:39:59.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64276 (GCVE-0-2026-64276)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52

Title

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

Summary

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() iterates the full f30->gpioled_count (device query register, range 0..31) and dereferences gpioled_key_map[i], and input->keycodemax is set to the full gpioled_count while input->keycode points at the 6-entry allocation. A device that reports gpioled_count > 6 with GPIO support enabled therefore causes an out-of-bounds read on the attention interrupt and out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, which bound the index only against keycodemax. This is the same defect as the F3A handler, which was copied from F30. Size the keymap for the full gpioled_count; the mapping loop still assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6…
https://git.kernel.org/stable/c/d162a1ead7de404d8…
https://git.kernel.org/stable/c/f0be9eba946e9200b…
https://git.kernel.org/stable/c/26c895928d7118436…
https://git.kernel.org/stable/c/4e3689c26854356f4…
https://git.kernel.org/stable/c/e849c6f51e6877104…
https://git.kernel.org/stable/c/bfe622efecd4ff0a7…
https://git.kernel.org/stable/c/d577e46785d45484b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < 8c6d18d61bb6fe0e6edf848413391c590552e8a9 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < d162a1ead7de404d8b41a093c83ed0db6487cded (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < f0be9eba946e9200b43265e0a748d38bd0a56954 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < 26c895928d7118436a24f564587cb4aefc40cdd8 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < 4e3689c26854356f41fbaa1eafa382e58ac79e00 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < e849c6f51e6877104c765da084e001ec37c8e119 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < bfe622efecd4ff0a792d0ecd1a8dce535a902f50 (git) Affected: 3e64fcbdbd10e46dede502d507dbcc104837cd59 , < d577e46785d45484b2ab7e7309c49b18764bf56c (git)
Linux	Linux	Affected: 4.14 Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/rmi4/rmi_f30.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c6d18d61bb6fe0e6edf848413391c590552e8a9",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "d162a1ead7de404d8b41a093c83ed0db6487cded",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "f0be9eba946e9200b43265e0a748d38bd0a56954",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "26c895928d7118436a24f564587cb4aefc40cdd8",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "4e3689c26854356f41fbaa1eafa382e58ac79e00",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "e849c6f51e6877104c765da084e001ec37c8e119",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "bfe622efecd4ff0a792d0ecd1a8dce535a902f50",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            },
            {
              "lessThan": "d577e46785d45484b2ab7e7309c49b18764bf56c",
              "status": "affected",
              "version": "3e64fcbdbd10e46dede502d507dbcc104837cd59",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/rmi4/rmi_f30.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count\n\nrmi_f30_map_gpios() allocates gpioled_key_map with\nmin(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f30_attention() iterates the full f30-\u003egpioled_count (device query\nregister, range 0..31) and dereferences gpioled_key_map[i], and\ninput-\u003ekeycodemax is set to the full gpioled_count while input-\u003ekeycode\npoints at the 6-entry allocation.\n\nA device that reports gpioled_count \u003e 6 with GPIO support enabled\ntherefore causes an out-of-bounds read on the attention interrupt and\nout-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,\nwhich bound the index only against keycodemax. This is the same defect\nas the F3A handler, which was copied from F30.\n\nSize the keymap for the full gpioled_count; the mapping loop still\nassigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An unprivileged local process that can open the affected /dev/input/event node can reach the flawed table through EVIOCGKEYCODE or EVIOCSKEYCODE; no physical reattachment or network path is required on systems with an affected F30 device.\nAC:L - Once an F30 device reports more than six GPIO/LEDs, attacker-selected indices deterministically trigger two-byte heap out-of-bounds reads or writes. No race or condition outside the attacker\u0027s control is required.\nPR:L - The evdev ioctl path contains no capability or namespace privilege check, so any ordinary user permitted to open the event node can trigger it.\nUI:N - The attacker directly issues the ioctls, and the separate attention path is device-driven; neither requires action by another user.\nS:U - The vulnerable driver and the affected kernel memory share the same security authority. Kernel privilege escalation or code execution does not itself cross a VM, IOMMU, or other scope boundary.\nC:H - EVIOCGKEYCODE returns attacker-selected out-of-bounds u16 values and can disclose multiple adjacent slab words across the available indices. This heap disclosure can expose security-sensitive kernel data and facilitate further exploitation.\nI:H - EVIOCSKEYCODE performs attacker-controlled u16 writes beyond the allocation at selectable offsets. These writes can corrupt adjacent heap objects or metadata and plausibly enable control-flow hijacking.\nA:H - The controlled heap corruption can damage adjacent kernel objects and cause an oops or panic, while the device can also repeatedly trigger the out-of-bounds attention path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:31.046Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c6d18d61bb6fe0e6edf848413391c590552e8a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d162a1ead7de404d8b41a093c83ed0db6487cded"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0be9eba946e9200b43265e0a748d38bd0a56954"
        },
        {
          "url": "https://git.kernel.org/stable/c/26c895928d7118436a24f564587cb4aefc40cdd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e3689c26854356f41fbaa1eafa382e58ac79e00"
        },
        {
          "url": "https://git.kernel.org/stable/c/e849c6f51e6877104c765da084e001ec37c8e119"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfe622efecd4ff0a792d0ecd1a8dce535a902f50"
        },
        {
          "url": "https://git.kernel.org/stable/c/d577e46785d45484b2ab7e7309c49b18764bf56c"
        }
      ],
      "title": "Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64276",
    "datePublished": "2026-07-25T08:49:21.300Z",
    "dateReserved": "2026-07-19T15:36:31.776Z",
    "dateUpdated": "2026-08-17T04:52:31.046Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64277 (GCVE-0-2026-64277)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52

Title

Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

Summary

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention() iterates the full gpio_count and dereferences gpio_key_map[i], and input->keycodemax is set to the full gpio_count while input->keycode points at the 6-entry allocation. A device that reports gpio_count > 6 therefore causes an out-of-bounds read of gpio_key_map[] on every attention interrupt, and out-of-bounds accesses through the input core's default keymap ioctls: EVIOCGKEYCODE reads past the buffer (leaking adjacent slab memory to user space) and EVIOCSKEYCODE writes a caller-controlled value past it, for any process able to open the evdev node, since input_default_getkeycode() and input_default_setkeycode() only bound the index against keycodemax. Size the keymap for the full gpio_count. The mapping loop is unchanged: it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END) entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills) and are skipped when reporting.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/502ad7caaa1a445b7…
https://git.kernel.org/stable/c/3480e24bc4e178aaa…
https://git.kernel.org/stable/c/35ed74d32d8260bdf…
https://git.kernel.org/stable/c/ba57f430328534501…
https://git.kernel.org/stable/c/850117b637bcb1dcc…
https://git.kernel.org/stable/c/8db211aed83733073…
https://git.kernel.org/stable/c/64fb0e1161ccc6b9e…
https://git.kernel.org/stable/c/57c10915f2c16c90e…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 502ad7caaa1a445b734c827fa256e5311df67e3d (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 3480e24bc4e178aaa009edb25b6ee12df199e210 (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 35ed74d32d8260bdfb14a94caf402bf0866bdeec (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < ba57f430328534501962d60d651e385ffd7af9ca (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 850117b637bcb1dcc14be0cf09ac819a8707b42c (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 8db211aed83733073b0814adaeeab61d4521474e (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42 (git) Affected: 9e4c596bfd004f447a652205163234dfd4aafa69 , < 57c10915f2c16c90e0d46ad00876bf39ece40fc2 (git)
Linux	Linux	Affected: 5.10 Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/rmi4/rmi_f3a.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "502ad7caaa1a445b734c827fa256e5311df67e3d",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "3480e24bc4e178aaa009edb25b6ee12df199e210",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "35ed74d32d8260bdfb14a94caf402bf0866bdeec",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "ba57f430328534501962d60d651e385ffd7af9ca",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "850117b637bcb1dcc14be0cf09ac819a8707b42c",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "8db211aed83733073b0814adaeeab61d4521474e",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            },
            {
              "lessThan": "57c10915f2c16c90e0d46ad00876bf39ece40fc2",
              "status": "affected",
              "version": "9e4c596bfd004f447a652205163234dfd4aafa69",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/rmi4/rmi_f3a.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - bound the F3A keymap to the GPIO count\n\nrmi_f3a_initialize() takes the GPIO count from the device query register\n(f3a-\u003egpio_count = buf \u0026 RMI_F3A_GPIO_COUNT, range 0..127).\nrmi_f3a_map_gpios() then allocates gpio_key_map with\nmin(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but\nrmi_f3a_attention() iterates the full gpio_count and dereferences\ngpio_key_map[i], and input-\u003ekeycodemax is set to the full gpio_count\nwhile input-\u003ekeycode points at the 6-entry allocation.\n\nA device that reports gpio_count \u003e 6 therefore causes an out-of-bounds\nread of gpio_key_map[] on every attention interrupt, and out-of-bounds\naccesses through the input core\u0027s default keymap ioctls: EVIOCGKEYCODE\nreads past the buffer (leaking adjacent slab memory to user space) and\nEVIOCSKEYCODE writes a caller-controlled value past it, for any process\nable to open the evdev node, since input_default_getkeycode() and\ninput_default_setkeycode() only bound the index against keycodemax.\n\nSize the keymap for the full gpio_count. The mapping loop is unchanged:\nit still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)\nentries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)\nand are skipped when reporting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The highest-severity defensible path is local: a process that can open the affected RMI touchpad\u0027s evdev node can invoke the vulnerable keymap ioctls. A malicious USB RMI device is also a physical trigger, but the local ioctl path is more severe.\nAC:L - On a vulnerable device reporting more than six GPIOs, selecting any keymap index from 6 through gpio_count-1 deterministically accesses beyond the allocation. No race or condition outside the attacker\u0027s control is required.\nPR:L - The evdev keymap ioctl path has no capability or authentication check; only ordinary device-node access controls apply. An unprivileged user with seat, ACL, or input-device access can exploit it without administrative capabilities.\nUI:N - The attacker directly issues EVIOCGKEYCODE or EVIOCSKEYCODE after opening the node. No action by another user is required.\nS:U - Exploitation compromises the host kernel within the same security authority. It does not inherently cross a VM, IOMMU, or other separate security boundary.\nC:H - EVIOCGKEYCODE can disclose successive 16-bit words across as much as 242 bytes beyond the six-entry keymap, exposing adjacent slab contents and potentially kernel pointers. The accompanying corruption can also support stronger disclosure primitives.\nI:H - EVIOCSKEYCODE provides indexed, caller-controlled 16-bit writes throughout the out-of-bounds range. This heap corruption can overwrite adjacent pointers or control data and plausibly enable kernel code execution.\nA:H - The controlled heap overwrite can corrupt adjacent slab objects and cause a kernel oops or panic, while device attention interrupts repeatedly exercise the out-of-bounds read. The failure can be triggered repeatedly without victim interaction."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:32.147Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/502ad7caaa1a445b734c827fa256e5311df67e3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3480e24bc4e178aaa009edb25b6ee12df199e210"
        },
        {
          "url": "https://git.kernel.org/stable/c/35ed74d32d8260bdfb14a94caf402bf0866bdeec"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba57f430328534501962d60d651e385ffd7af9ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/850117b637bcb1dcc14be0cf09ac819a8707b42c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8db211aed83733073b0814adaeeab61d4521474e"
        },
        {
          "url": "https://git.kernel.org/stable/c/64fb0e1161ccc6b9e48b8df61f07d3c34c01ec42"
        },
        {
          "url": "https://git.kernel.org/stable/c/57c10915f2c16c90e0d46ad00876bf39ece40fc2"
        }
      ],
      "title": "Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64277",
    "datePublished": "2026-07-25T08:49:21.936Z",
    "dateReserved": "2026-07-19T15:36:31.776Z",
    "dateUpdated": "2026-08-17T04:52:32.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64320 (GCVE-0-2026-64320)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:53

Title

nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

Summary

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-supplied Log Page Offset (lpo). The 64-bit offset is then added to a small kzalloc'd buffer that holds the discovery log page and the result is passed straight to nvmet_copy_to_sgl(), which memcpy()s data_len bytes out to the host with no source-side bound check: u64 offset = nvmet_get_log_page_offset(req->cmd); /* 64-bit host */ size_t data_len = nvmet_get_log_page_len(req->cmd); /* 32-bit host */ ... if (offset & 0x3) { ... } /* only check */ ... alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req); buffer = kzalloc(alloc_len, GFP_KERNEL); ... status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len); The Discovery controller is unauthenticated -- nvmet_host_allowed() returns true unconditionally for the discovery subsystem -- so the call is reachable pre-authentication by any TCP/RDMA/FC peer that can reach the nvmet target. With a discovery log page of ~1 KiB, an attacker requesting up to 4 KiB starting at offset == alloc_len reads the next slab page out and gets its content returned over the fabric (an empirical run on a default nvmet-tcp loopback target leaked 81 canonical kernel pointers in one Get Log Page response). Pointing the offset at unmapped kernel memory faults the in-kernel memcpy and crashes (or panics, on panic_on_oops=1) the target host instead. The attacker-controlled source-side offset pattern "nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)" is unique to nvmet_execute_disc_get_log_page in the entire nvmet codebase: every other Get Log Page handler in admin-cmd.c either ignores lpo (and silently starts every response at offset 0) or tracks a local destination offset with a fixed source pointer. Validate the host-supplied offset against the log page size, cap the copy length to what is actually available, and zero-fill any remainder of the host transfer buffer. The zero-fill matches the existing short-response pattern in nvmet_execute_get_log_changed_ns() (admin-cmd.c) and prevents leaking transport SGL contents when the host asks for more bytes than the log page contains.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/33b974eb626154ae9…
https://git.kernel.org/stable/c/56c021a0869260d04…
https://git.kernel.org/stable/c/a29b316b9bbfd269f…
https://git.kernel.org/stable/c/53cd102a7a56079b1…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a07b4970f464f13640e28e16dad6cfa33647cc99 , < 33b974eb626154ae9348f2bac7de84cb2a3d9dd4 (git) Affected: a07b4970f464f13640e28e16dad6cfa33647cc99 , < 56c021a0869260d04c4b65d1471936aaf9177114 (git) Affected: a07b4970f464f13640e28e16dad6cfa33647cc99 , < a29b316b9bbfd269f323ab4ba9906a894025680f (git) Affected: a07b4970f464f13640e28e16dad6cfa33647cc99 , < 53cd102a7a56079b11b897835bd9b94c14e6322c (git)
Linux	Linux	Affected: 4.8 Unaffected: 0 , < 4.8 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/discovery.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "33b974eb626154ae9348f2bac7de84cb2a3d9dd4",
              "status": "affected",
              "version": "a07b4970f464f13640e28e16dad6cfa33647cc99",
              "versionType": "git"
            },
            {
              "lessThan": "56c021a0869260d04c4b65d1471936aaf9177114",
              "status": "affected",
              "version": "a07b4970f464f13640e28e16dad6cfa33647cc99",
              "versionType": "git"
            },
            {
              "lessThan": "a29b316b9bbfd269f323ab4ba9906a894025680f",
              "status": "affected",
              "version": "a07b4970f464f13640e28e16dad6cfa33647cc99",
              "versionType": "git"
            },
            {
              "lessThan": "53cd102a7a56079b11b897835bd9b94c14e6322c",
              "status": "affected",
              "version": "a07b4970f464f13640e28e16dad6cfa33647cc99",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/discovery.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page\n\nnvmet_execute_disc_get_log_page() validates only the dword alignment\nof the host-supplied Log Page Offset (lpo).  The 64-bit offset is then\nadded to a small kzalloc\u0027d buffer that holds the discovery log page\nand the result is passed straight to nvmet_copy_to_sgl(), which\nmemcpy()s data_len bytes out to the host with no source-side bound\ncheck:\n\n    u64 offset      = nvmet_get_log_page_offset(req-\u003ecmd);  /* 64-bit host */\n    size_t data_len = nvmet_get_log_page_len(req-\u003ecmd);     /* 32-bit host */\n    ...\n    if (offset \u0026 0x3) { ... }                               /* only check */\n    ...\n    alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req);\n    buffer = kzalloc(alloc_len, GFP_KERNEL);\n    ...\n    status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);\n\nThe Discovery controller is unauthenticated -- nvmet_host_allowed()\nreturns true unconditionally for the discovery subsystem -- so the call\nis reachable pre-authentication by any TCP/RDMA/FC peer that can reach\nthe nvmet target.  With a discovery log page of ~1 KiB, an attacker\nrequesting up to 4 KiB starting at offset == alloc_len reads the next\nslab page out and gets its content returned over the fabric (an\nempirical run on a default nvmet-tcp loopback target leaked 81\ncanonical kernel pointers in one Get Log Page response).  Pointing the\noffset at unmapped kernel memory faults the in-kernel memcpy and\ncrashes (or panics, on panic_on_oops=1) the target host instead.\n\nThe attacker-controlled source-side offset pattern\n\"nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)\" is unique\nto nvmet_execute_disc_get_log_page in the entire nvmet codebase: every\nother Get Log Page handler in admin-cmd.c either ignores lpo (and\nsilently starts every response at offset 0) or tracks a local\ndestination offset with a fixed source pointer.\n\nValidate the host-supplied offset against the log page size, cap the\ncopy length to what is actually available, and zero-fill any remainder\nof the host transfer buffer.  The zero-fill matches the existing\nshort-response pattern in nvmet_execute_get_log_changed_ns()\n(admin-cmd.c) and prevents leaking transport SGL contents when the\nhost asks for more bytes than the log page contains."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable discovery command is remotely reachable through routable NVMe/TCP, as well as NVMe/RDMA and FC transports.\nAC:L - The attacker controls the protocol sequence, transfer length, and aligned 64-bit offset, with no race or condition outside their control.\nPR:N - The discovery subsystem accepts every Host NQN and explicitly skips DH-HMAC-CHAP authentication, making the command reachable pre-authentication.\nUI:N - No victim action is required after the NVMe-oF target port is available.\nS:U - The disclosure and crash affect the vulnerable target kernel within the same security authority.\nC:H - The unbounded offset permits repeated multi-kilobyte kernel heap disclosures; testing cited by the fix exposed 81 canonical kernel pointers in one response.\nI:N - The primitive reads target memory into transport response pages but provides no attacker-selected write to target memory.\nA:H - An offset resolving to unmapped or noncanonical memory faults the in-kernel memcpy, causing an oops or target-host panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:53:20.999Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/33b974eb626154ae9348f2bac7de84cb2a3d9dd4"
        },
        {
          "url": "https://git.kernel.org/stable/c/56c021a0869260d04c4b65d1471936aaf9177114"
        },
        {
          "url": "https://git.kernel.org/stable/c/a29b316b9bbfd269f323ab4ba9906a894025680f"
        },
        {
          "url": "https://git.kernel.org/stable/c/53cd102a7a56079b11b897835bd9b94c14e6322c"
        }
      ],
      "title": "nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64320",
    "datePublished": "2026-07-25T08:49:48.908Z",
    "dateReserved": "2026-07-19T15:36:31.780Z",
    "dateUpdated": "2026-08-17T04:53:20.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:59737

CVE-2026-52924 (GCVE-0-2026-52924)

CVE-2026-63886 (GCVE-0-2026-63886)

CVE-2026-63913 (GCVE-0-2026-63913)

CVE-2026-64189 (GCVE-0-2026-64189)

CVE-2026-64191 (GCVE-0-2026-64191)

CVE-2026-64276 (GCVE-0-2026-64276)

CVE-2026-64277 (GCVE-0-2026-64277)

CVE-2026-64320 (GCVE-0-2026-64320)

Tags

Sightings

Nomenclature