Vulnerability-Lookup

RHSA-2026:62641

Vulnerability from csaf_redhat - Published: 2026-09-02 14:26 - Updated: 2026-09-03 14:26

Summary

Red Hat Security Advisory: kpatch-patch-5_14_0-570_116_1, kpatch-patch-5_14_0-570_17_1, kpatch-patch-5_14_0-570_39_1, kpatch-patch-5_14_0-570_66_1, and kpatch-patch-5_14_0-570_94_1 security update

Severity

Important

Notes

Topic: An update for multiple packages is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-5.14.0-570.17.1.el9_6. Security Fix(es): * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111) * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-23111

A flaw was found in the Linux kernel's nf_tables component. A logic bug in nft_map_catchall_activate causes an inverted element activity check during the abort path of a failed transaction. This can lead to a use-after-free vulnerability, as catchall verdict elements may still reference a freed chain. A local low privileged user can exploit this to cause a denial of service or potentially achieve privilege escalation.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-672 - Operation on a Resource after Expiration or Release

Affected products

Fixed 35 products

Product	Version	Remediation
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-43112

A flaw was found in the Linux kernel's CIFS (Common Internet File System) client. When the `cifs_sanitize_prepath` function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-bounds read can lead to a system crash, resulting in a denial of service.

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 35 products

Product	Version	Remediation
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64	—	Vendor Fix fix

Threats

Impact Important

CVE-2026-43114

A flaw was found in the Linux kernel's netfilter component, specifically within the `nft_set_pipapo_avx2` AVX2 matching functions. This vulnerability occurs when a `pipapo` set with an 'ipv4 . port' key is reloaded. Due to incorrect masking, the system may erroneously identify non-matching elements as duplicates, leading to data integrity issues and unexpected behavior. A remote attacker could potentially exploit this to cause a denial of service or impact data integrity.

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE-480 - Use of Incorrect Operator

Affected products

Fixed 35 products

Product	Version	Remediation
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-46323

A flaw was found in the Linux kernel's Generic Receive Offload (GRO) networking subsystem. This vulnerability occurs when `skb_gro_receive()` attempts to merge zerocopy socket buffers (skbs) without properly managing page reference counts, specifically when the `SKBFL_MANAGED_FRAG_REFS` flag is set. An attacker could potentially exploit this to trigger a Use-After-Free (UAF) condition, which is a memory corruption vulnerability that can lead to system instability or potentially arbitrary code execution.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-123 - Write-what-where Condition

Affected products

Fixed 35 products

Product	Version	Remediation
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-53264

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free (UAF) vulnerability, where the system attempts to use memory that has already been released. This could potentially allow an attacker to cause system instability or execute arbitrary code.

7.0 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-364 - Signal Handler Race Condition

Affected products

Fixed 35 products

Product	Version	Remediation
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64	—	Vendor Fix fix

Threats

Impact Important

References

39 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:62641	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2439687	external
https://bugzilla.redhat.com/show_bug.cgi?id=2466994	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467015	external
https://bugzilla.redhat.com/show_bug.cgi?id=2479832	external
https://bugzilla.redhat.com/show_bug.cgi?id=2492851	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-23111	self
https://bugzilla.redhat.com/show_bug.cgi?id=2439687	external
https://www.cve.org/CVERecord?id=CVE-2026-23111	external
https://nvd.nist.gov/vuln/detail/CVE-2026-23111	external
https://lore.kernel.org/linux-cve-announce/202602…	external
https://access.redhat.com/security/cve/CVE-2026-43112	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467015	external
https://www.cve.org/CVERecord?id=CVE-2026-43112	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43112	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-43114	self
https://bugzilla.redhat.com/show_bug.cgi?id=2466994	external
https://www.cve.org/CVERecord?id=CVE-2026-43114	external
https://nvd.nist.gov/vuln/detail/CVE-2026-43114	external
https://lore.kernel.org/linux-cve-announce/202605…	external
https://access.redhat.com/security/cve/CVE-2026-46323	self
https://bugzilla.redhat.com/show_bug.cgi?id=2479832	external
https://www.cve.org/CVERecord?id=CVE-2026-46323	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46323	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://git.kernel.org/pub/scm/linux/kernel/git/s…	external
https://lore.kernel.org/netdev/4d583fc5401298453d…	external
https://lore.kernel.org/netdev/agVpIsaSherjHTYg@s…	external
https://access.redhat.com/security/cve/CVE-2026-53264	self
https://bugzilla.redhat.com/show_bug.cgi?id=2492851	external
https://www.cve.org/CVERecord?id=CVE-2026-53264	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53264	external
https://lore.kernel.org/linux-cve-announce/202606…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for multiple packages is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel.  This patch module is targeted for kernel-5.14.0-570.17.1.el9_6.\n\nSecurity Fix(es):\n\n* kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)\n\n* kernel: netfilter: nft_set_pipapo_avx2: don\u0027t return non-matching entry on expiry (CVE-2026-43114)\n\n* kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)\n\n* kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)\n\n* kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:62641",
        "url": "https://access.redhat.com/errata/RHSA-2026:62641"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2439687",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439687"
      },
      {
        "category": "external",
        "summary": "2466994",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466994"
      },
      {
        "category": "external",
        "summary": "2467015",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467015"
      },
      {
        "category": "external",
        "summary": "2479832",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479832"
      },
      {
        "category": "external",
        "summary": "2492851",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492851"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62641.json"
      }
    ],
    "title": "Red Hat Security Advisory: kpatch-patch-5_14_0-570_116_1, kpatch-patch-5_14_0-570_17_1, kpatch-patch-5_14_0-570_39_1, kpatch-patch-5_14_0-570_66_1, and kpatch-patch-5_14_0-570_94_1 security update",
    "tracking": {
      "current_release_date": "2026-09-03T14:26:31+00:00",
      "generator": {
        "date": "2026-09-03T14:26:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:62641",
      "initial_release_date": "2026-09-02T14:26:33+00:00",
      "revision_history": [
        {
          "date": "2026-09-02T14:26:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-02T14:26:33+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-03T14:26:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
                  "product_id": "BaseOS-9.6.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhel_eus:9.6::baseos"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
                  "product_id": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_17_1@1-24.el9_6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
                  "product_id": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_39_1@1-15.el9_6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
                  "product_id": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_66_1@1-14.el9_6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
                  "product_id": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_94_1@1-12.el9_6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
                  "product_id": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_116_1@1-9.el9_6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_17_1@1-24.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_17_1-debugsource@1-24.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_17_1-debuginfo@1-24.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_39_1@1-15.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_39_1-debugsource@1-15.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_39_1-debuginfo@1-15.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_66_1@1-14.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_66_1-debugsource@1-14.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_66_1-debuginfo@1-14.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_94_1@1-12.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_94_1-debugsource@1-12.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_94_1-debuginfo@1-12.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_116_1@1-9.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_116_1-debugsource@1-9.el9_6?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
                  "product_id": "kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_116_1-debuginfo@1-9.el9_6?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_17_1@1-24.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_17_1-debugsource@1-24.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_17_1-debuginfo@1-24.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_39_1@1-15.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_39_1-debugsource@1-15.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_39_1-debuginfo@1-15.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_66_1@1-14.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_66_1-debugsource@1-14.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_66_1-debuginfo@1-14.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_94_1@1-12.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_94_1-debugsource@1-12.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_94_1-debuginfo@1-12.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_116_1@1-9.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_116_1-debugsource@1-9.el9_6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
                "product": {
                  "name": "kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
                  "product_id": "kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kpatch-patch-5_14_0-570_116_1-debuginfo@1-9.el9_6?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src"
        },
        "product_reference": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src"
        },
        "product_reference": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src"
        },
        "product_reference": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src"
        },
        "product_reference": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src"
        },
        "product_reference": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le"
        },
        "product_reference": "kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)",
          "product_id": "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
        },
        "product_reference": "kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64",
        "relates_to_product_reference": "BaseOS-9.6.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-23111",
      "cwe": {
        "id": "CWE-672",
        "name": "Operation on a Resource after Expiration or Release"
      },
      "discovery_date": "2026-02-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2439687"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s nf_tables component. A logic bug in nft_map_catchall_activate causes an inverted element activity check during the abort path of a failed transaction. This can lead to a use-after-free vulnerability, as catchall verdict elements may still reference a freed chain. A local low privileged user can exploit this to cause a denial of service or potentially achieve privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A logic bug in nf_tables nft_map_catchall_activate uses an inverted element active check during the abort path of a failed transaction. This can prevent re activation of catchall map elements and for NFT_GOTO verdict elements it can skip restoring the chain use reference count. Repeating an abort sequence can permanently decrement chain use until DELCHAIN frees the chain while catchall elements still reference it which can result in a use after free. For the CVSS the PR is L, but in the paranoid scenario the unprivileged users may reach nf_tables via user namespaces with delegated CAP_NET_ADMIN. The issue is not directly network reachable and is triggered by local nftables control plane operations. Impact can range from denial of service to potential privilege escalation depending on heap reuse.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-23111"
        },
        {
          "category": "external",
          "summary": "RHBZ#2439687",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439687"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-23111",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-23111"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-23111",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23111"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026021300-CVE-2026-23111-9762@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026021300-CVE-2026-23111-9762@gregkh/T"
        }
      ],
      "release_date": "2026-02-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-02T14:26:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62641"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, prevent module nf_tables from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.",
          "product_ids": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check"
    },
    {
      "cve": "CVE-2026-43112",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-05-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467015"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s CIFS (Common Internet File System) client. When the `cifs_sanitize_prepath` function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-bounds read can lead to a system crash, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important out-of-bounds read flaw in the Linux kernel\u0027s CIFS client can lead to a system crash and denial of service. This vulnerability, present in Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS 2, can be triggered by processing specially crafted input to the `cifs_sanitize_prepath` function, potentially disrupting system availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43112"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467015",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467015"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43112",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43112"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43112",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43112"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43112-f37f@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43112-f37f@gregkh/T"
        }
      ],
      "release_date": "2026-05-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-02T14:26:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62641"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath"
    },
    {
      "cve": "CVE-2026-43114",
      "cwe": {
        "id": "CWE-480",
        "name": "Use of Incorrect Operator"
      },
      "discovery_date": "2026-05-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2466994"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s netfilter component, specifically within the `nft_set_pipapo_avx2` AVX2 matching functions. This vulnerability occurs when a `pipapo` set with an \u0027ipv4 . port\u0027 key is reloaded. Due to incorrect masking, the system may erroneously identify non-matching elements as duplicates, leading to data integrity issues and unexpected behavior. A remote attacker could potentially exploit this to cause a denial of service or impact data integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: netfilter: nft_set_pipapo_avx2: don\u0027t return non-matching entry on expiry",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in the Linux kernel\u0027s netfilter component, specifically within the `nft_set_pipapo_avx2` functionality. Incorrect processing during AVX2 matching operations can lead to misidentification of network data entries, potentially causing unexpected network filtering behavior and data integrity problems. This issue primarily impacts Red Hat Enterprise Linux 9 and 10 systems configured to utilize AVX2 instructions for netfilter set processing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43114"
        },
        {
          "category": "external",
          "summary": "RHBZ#2466994",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466994"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43114",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43114"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43114",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43114"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43114-5deb@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026050626-CVE-2026-43114-5deb@gregkh/T"
        }
      ],
      "release_date": "2026-05-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-02T14:26:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62641"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: netfilter: nft_set_pipapo_avx2: don\u0027t return non-matching entry on expiry"
    },
    {
      "cve": "CVE-2026-46323",
      "cwe": {
        "id": "CWE-123",
        "name": "Write-what-where Condition"
      },
      "discovery_date": "2026-05-19T11:49:44.372000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479832"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s Generic Receive Offload (GRO) networking subsystem. This vulnerability occurs when `skb_gro_receive()` attempts to merge zerocopy socket buffers (skbs) without properly managing page reference counts, specifically when the `SKBFL_MANAGED_FRAG_REFS` flag is set. An attacker could potentially exploit this to trigger a Use-After-Free (UAF) condition, which is a memory corruption vulnerability that can lead to system instability or potentially arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in the Linux kernel\u0027s Generic Receive Offload (GRO) networking subsystem. The vulnerability, a variant of Fragnesia, stems from improper management of page reference counts when merging zerocopy socket buffers. An attacker could exploit this Use-After-Free condition to achieve arbitrary code execution or cause system instability on affected Red Hat Enterprise Linux and OpenShift Container Platform systems.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46323"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479832",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479832"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46323",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46323"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46323",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46323"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1f9c828556416fbe3f49386708ce999fc4d4da06",
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1f9c828556416fbe3f49386708ce999fc4d4da06"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=44bea2032af0425e4ce6d26a8af0ede79db49ec1",
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=44bea2032af0425e4ce6d26a8af0ede79db49ec1"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=479084ae0e1d9cb7929cb4298d35623de189f80a",
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=479084ae0e1d9cb7929cb4298d35623de189f80a"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4db79a322db8c97f7b73b8a347395ef4d685eb40",
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4db79a322db8c97f7b73b8a347395ef4d685eb40"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e334cbf3388fd9334503a778a82d9e9f14dd2f71",
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e334cbf3388fd9334503a778a82d9e9f14dd2f71"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/netdev/4d583fc5401298453d0a2f1b4719a15be30c8e49.1779194090.git.sd@queasysnail.net/",
          "url": "https://lore.kernel.org/netdev/4d583fc5401298453d0a2f1b4719a15be30c8e49.1779194090.git.sd@queasysnail.net/"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/netdev/agVpIsaSherjHTYg@sultan-box/",
          "url": "https://lore.kernel.org/netdev/agVpIsaSherjHTYg@sultan-box/"
        }
      ],
      "release_date": "2026-05-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-02T14:26:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62641"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs"
    },
    {
      "cve": "CVE-2026-53264",
      "cwe": {
        "id": "CWE-364",
        "name": "Signal Handler Race Condition"
      },
      "discovery_date": "2026-06-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2492851"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free (UAF) vulnerability, where the system attempts to use memory that has already been released. This could potentially allow an attacker to cause system instability or execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important severity race condition was discovered in the Linux kernel\u0027s `net/sched` action API. This presents the opportunity of a use-after-free, which could allow a local attacker to escalate privileges or cause a denial of service due to concurrent filter operations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
          "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-53264"
        },
        {
          "category": "external",
          "summary": "RHBZ#2492851",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492851"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-53264",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53264"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53264",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53264"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026062517-CVE-2026-53264-081f@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026062517-CVE-2026-53264-081f@gregkh/T"
        }
      ],
      "release_date": "2026-06-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-02T14:26:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:62641"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debuginfo-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_116_1-debugsource-0:1-9.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debuginfo-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_17_1-debugsource-0:1-24.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debuginfo-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_39_1-debugsource-0:1-15.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debuginfo-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_66_1-debugsource-0:1-14.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.src",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debuginfo-0:1-12.el9_6.x86_64",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.ppc64le",
            "BaseOS-9.6.0.Z.EUS:kpatch-patch-5_14_0-570_94_1-debugsource-0:1-12.el9_6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle"
    }
  ]
}

CVE-2026-23111 (GCVE-0-2026-23111)

Vulnerability from cvelistv5 – Published: 2026-02-13 13:29 – Updated: 2026-09-03 12:04

Title

netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate() and compared to what is logically required. nft_map_catchall_activate() is called from the abort path to re-activate catchall map elements that were deactivated during a failed transaction. It should skip elements that are already active (they don't need re-activation) and process elements that are inactive (they need to be restored). Instead, the current code does the opposite: it skips inactive elements and processes active ones. Compare the non-catchall activate callback, which is correct: nft_mapelem_activate(): if (nft_set_elem_active(ext, iter->genmask)) return 0; /* skip active, process inactive */ With the buggy catchall version: nft_map_catchall_activate(): if (!nft_set_elem_active(ext, genmask)) continue; /* skip inactive, process active */ The consequence is that when a DELSET operation is aborted, nft_setelem_data_activate() is never called for the catchall element. For NFT_GOTO verdict elements, this means nft_data_hold() is never called to restore the chain->use reference count. Each abort cycle permanently decrements chain->use. Once chain->use reaches zero, DELCHAIN succeeds and frees the chain while catchall verdict elements still reference it, resulting in a use-after-free. This is exploitable for local privilege escalation from an unprivileged user via user namespaces + nftables on distributions that enable CONFIG_USER_NS and CONFIG_NF_TABLES. Fix by removing the negation so the check matches nft_mapelem_activate(): skip active elements, process inactive ones.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-09 13:07 UTC

CWE

CWE-416 - Use After Free
CWE-672 - Operation on a Resource after Expiration or Release

Assigner

Linux mitre root

References

20 references

URL	Tags
https://git.kernel.org/stable/c/8c760ba4e36c75037…
https://git.kernel.org/stable/c/b9b6573421de51829…
https://git.kernel.org/stable/c/42c574c1504aa089a…
https://git.kernel.org/stable/c/1444ff890b4653add…
https://git.kernel.org/stable/c/8b68a45f9722f2bab…
https://git.kernel.org/stable/c/f41c5d151078c5348…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://blog.exodusintel.com/2026/06/08/off-by-ex…	technical-description
https://access.redhat.com/security/cve/CVE-2026-23111	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2439687	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:10996	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:18134	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10108	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9112	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6570	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62639	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62641	vendor-advisoryx_refsource_REDHAT

Impacted products

18 products

Vendor	Product	Version
Linux	Linux	Affected: 25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8 , < 8c760ba4e36c750379d13569f23f5a6e185333f5 (git) Affected: d60be2da67d172aecf866302c91ea11533eca4d9 , < b9b6573421de51829f7ec1cce76d85f5f6fbbd7f (git) Affected: 628bd3e49cba1c066228e23d71a852c23e26da73 , < 42c574c1504aa089a0a142e4c13859327570473d (git) Affected: 628bd3e49cba1c066228e23d71a852c23e26da73 , < 1444ff890b4653add12f734ffeffc173d42862dd (git) Affected: 628bd3e49cba1c066228e23d71a852c23e26da73 , < 8b68a45f9722f2babe9e7bad00aa74638addf081 (git) Affected: 628bd3e49cba1c066228e23d71a852c23e26da73 , < f41c5d151078c5348271ffaf8e7410d96f2d82f8 (git) Affected: bc9f791d2593f17e39f87c6e2b3a36549a3705b1 (git) Affected: 3c7ec098e3b588434a8b07ea9b5b36f04cef1f50 (git) Affected: a136b7942ad2a50de708f76ea299ccb45ac7a7f9 (git) Affected: dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41 (git) Affected: 5.15.121 , < 5.15.200 (semver) Affected: 6.1.36 , < 6.1.163 (semver) Affected: 4.19.316 , < 4.20 (semver) Affected: 5.4.262 , < 5.5 (semver) Affected: 5.10.188 , < 5.11 (semver) Affected: 6.3.10 , < 6.4 (semver)
Linux	Linux	Affected: 6.4 Unaffected: 0 , < 6.4 (semver) Unaffected: 5.15.200 , ≤ 5.15.* (semver) Unaffected: 6.1.163 , ≤ 6.1.* (semver) Unaffected: 6.6.124 , ≤ 6.6.* (semver) Unaffected: 6.12.70 , ≤ 6.12.* (semver) Unaffected: 6.18.10 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V4.0 (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.5 , < * (custom)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.7.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.70.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-611.47.1.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:5.14.0-427.121.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.108.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:46:05.821Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23111",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T13:07:47.429787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T20:33:26.145Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "technical-description"
            ],
            "url": "https://blog.exodusintel.com/2026/06/08/off-by-exploiting-a-use-after-free-in-the-linux-kernel/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.7.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.70.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-611.47.1.el9_7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.121.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.108.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-02-13T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s nf_tables component. A logic bug in nft_map_catchall_activate causes an inverted element activity check during the abort path of a failed transaction. This can lead to a use-after-free vulnerability, as catchall verdict elements may still reference a freed chain. A local low privileged user can exploit this to cause a denial of service or potentially achieve privilege escalation."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-672",
                "description": "Operation on a Resource after Expiration or Release",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T12:04:32.914Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-23111"
          },
          {
            "name": "RHBZ#2439687",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439687"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23111.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10996"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:18134"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:10108"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:9112"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:6570"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62639"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62641"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:10996: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:18134: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:10108: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4), Red Hat Enterprise Linux Real Time EUS (v.9.4), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:9112: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:6570: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62639: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62641: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-02-13T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-02-13T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, prevent module nf_tables from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c760ba4e36c750379d13569f23f5a6e185333f5",
              "status": "affected",
              "version": "25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8",
              "versionType": "git"
            },
            {
              "lessThan": "b9b6573421de51829f7ec1cce76d85f5f6fbbd7f",
              "status": "affected",
              "version": "d60be2da67d172aecf866302c91ea11533eca4d9",
              "versionType": "git"
            },
            {
              "lessThan": "42c574c1504aa089a0a142e4c13859327570473d",
              "status": "affected",
              "version": "628bd3e49cba1c066228e23d71a852c23e26da73",
              "versionType": "git"
            },
            {
              "lessThan": "1444ff890b4653add12f734ffeffc173d42862dd",
              "status": "affected",
              "version": "628bd3e49cba1c066228e23d71a852c23e26da73",
              "versionType": "git"
            },
            {
              "lessThan": "8b68a45f9722f2babe9e7bad00aa74638addf081",
              "status": "affected",
              "version": "628bd3e49cba1c066228e23d71a852c23e26da73",
              "versionType": "git"
            },
            {
              "lessThan": "f41c5d151078c5348271ffaf8e7410d96f2d82f8",
              "status": "affected",
              "version": "628bd3e49cba1c066228e23d71a852c23e26da73",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bc9f791d2593f17e39f87c6e2b3a36549a3705b1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3c7ec098e3b588434a8b07ea9b5b36f04cef1f50",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a136b7942ad2a50de708f76ea299ccb45ac7a7f9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.200",
              "status": "affected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.163",
              "status": "affected",
              "version": "6.1.36",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.316",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.262",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.188",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_tables_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.200",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.200",
                  "versionStartIncluding": "5.15.121",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.163",
                  "versionStartIncluding": "6.1.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.124",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.70",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.316",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.262",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.188",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()\n\nnft_map_catchall_activate() has an inverted element activity check\ncompared to its non-catchall counterpart nft_mapelem_activate() and\ncompared to what is logically required.\n\nnft_map_catchall_activate() is called from the abort path to re-activate\ncatchall map elements that were deactivated during a failed transaction.\nIt should skip elements that are already active (they don\u0027t need\nre-activation) and process elements that are inactive (they need to be\nrestored). Instead, the current code does the opposite: it skips inactive\nelements and processes active ones.\n\nCompare the non-catchall activate callback, which is correct:\n\n  nft_mapelem_activate():\n    if (nft_set_elem_active(ext, iter-\u003egenmask))\n        return 0;   /* skip active, process inactive */\n\nWith the buggy catchall version:\n\n  nft_map_catchall_activate():\n    if (!nft_set_elem_active(ext, genmask))\n        continue;   /* skip inactive, process active */\n\nThe consequence is that when a DELSET operation is aborted,\nnft_setelem_data_activate() is never called for the catchall element.\nFor NFT_GOTO verdict elements, this means nft_data_hold() is never\ncalled to restore the chain-\u003euse reference count. Each abort cycle\npermanently decrements chain-\u003euse. Once chain-\u003euse reaches zero,\nDELCHAIN succeeds and frees the chain while catchall verdict elements\nstill reference it, resulting in a use-after-free.\n\nThis is exploitable for local privilege escalation from an unprivileged\nuser via user namespaces + nftables on distributions that enable\nCONFIG_USER_NS and CONFIG_NF_TABLES.\n\nFix by removing the negation so the check matches nft_mapelem_activate():\nskip active elements, process inactive ones."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - nftables is accessed via nfnetlink socket (netlink), requiring local system access. This is a local attack vector via syscall/netlink interface.\nAC:L - The attacker fully controls the exploitation: they create the nftables rules with catchall map elements and NFT_GOTO verdicts, trigger repeated DELSET abort cycles to decrement chain-\u003euse to zero, then issue DELCHAIN. No race condition or special conditions beyond attacker control are needed.\nPR:L - nftables requires CAP_NET_ADMIN, but this capability is obtainable by an unprivileged user via user namespaces (unshare -Urn) since nfnetlink uses netlink_net_capable() which checks per-namespace capabilities. The commit message explicitly confirms exploitability from unprivileged users.\nUI:N - No user interaction is required. The attacker creates the nftables configuration, triggers the abort, and exploits the UAF entirely on their own.\nS:U - This is a standard local privilege escalation within the kernel. There is no crossing of virtualization or sandbox boundaries (no VM escape or IOMMU bypass).\nC:H - The use-after-free on the nft_chain structure allows the attacker to reclaim the freed memory with controlled data, providing arbitrary kernel memory read primitives. This is a well-known exploitation technique in nftables UAF bugs.\nI:H - The UAF enables heap spraying the freed chain object to gain arbitrary kernel memory write primitives, leading to full code execution in kernel context (local privilege escalation to root).\nA:H - The use-after-free will cause kernel crashes (oops/panic) when the dangling reference to the freed chain is accessed, and the attacker can trigger this reliably."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:18.504Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c760ba4e36c750379d13569f23f5a6e185333f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9b6573421de51829f7ec1cce76d85f5f6fbbd7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/42c574c1504aa089a0a142e4c13859327570473d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1444ff890b4653add12f734ffeffc173d42862dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b68a45f9722f2babe9e7bad00aa74638addf081"
        },
        {
          "url": "https://git.kernel.org/stable/c/f41c5d151078c5348271ffaf8e7410d96f2d82f8"
        }
      ],
      "title": "netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23111",
    "datePublished": "2026-02-13T13:29:55.895Z",
    "dateReserved": "2026-01-13T15:37:45.968Z",
    "dateUpdated": "2026-09-03T12:04:32.914Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43112 (GCVE-0-2026-43112)

Vulnerability from cvelistv5 – Published: 2026-05-06 07:40 – Updated: 2026-09-04 12:04

Title

fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

Summary

In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read. This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL. The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-125 - Out-of-bounds Read

Assigner

Linux mitre root

References

34 references

URL	Tags
https://git.kernel.org/stable/c/a2ba20c17de8eb028…
https://git.kernel.org/stable/c/fbced33599653471b…
https://git.kernel.org/stable/c/5d4fe469fe7dbff7d…
https://git.kernel.org/stable/c/2d29214448ec0f4e7…
https://git.kernel.org/stable/c/86f9c23e0814cfdff…
https://git.kernel.org/stable/c/49b1ce6d7cfb6c5a4…
https://git.kernel.org/stable/c/78ec5bf2f589ec7fd…
https://access.redhat.com/security/cve/CVE-2026-43112	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2467015	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:59831	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60019	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57402	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57543	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57457	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40764	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52764	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34911	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59662	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56573	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53990	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62642	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36366	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62637	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:53989	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52649	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62558	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62638	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62639	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62641	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62640	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36365	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59663	vendor-advisoryx_refsource_REDHAT

Impacted products

32 products

Vendor	Product	Version
Linux	Linux	Affected: c63433a09d6ae4c226fcbc66da4c58fc189fd746 , < a2ba20c17de8eb028f96b1d85f119d3d25655bd9 (git) Affected: a31080899d5fdafcccf7f39dd214a814a2c82626 , < fbced33599653471b4581dfe1abc7b467031f126 (git) Affected: a31080899d5fdafcccf7f39dd214a814a2c82626 , < 5d4fe469fe7dbff7d874c196bb680a82f2625d95 (git) Affected: a31080899d5fdafcccf7f39dd214a814a2c82626 , < 2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439 (git) Affected: a31080899d5fdafcccf7f39dd214a814a2c82626 , < 86f9c23e0814cfdffda9eedf0c591c51ba209010 (git) Affected: a31080899d5fdafcccf7f39dd214a814a2c82626 , < 49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3 (git) Affected: a31080899d5fdafcccf7f39dd214a814a2c82626 , < 78ec5bf2f589ec7fd8f169394bfeca541b077317 (git) Affected: 5.15.11 , < 5.15.209 (semver)
Linux	Linux	Affected: 5.16 Unaffected: 0 , < 5.16 (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.136 , ≤ 6.6.* (semver) Unaffected: 6.12.83 , ≤ 6.12.* (semver) Unaffected: 6.18.24 , ≤ 6.18.* (semver) Unaffected: 6.19.14 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.30.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.95.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.141.1.rt7.482.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::nfv
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:4.18.0-553.141.1.el8_10 , < * (rpm) cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:4.18.0-372.206.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:4.18.0-372.206.1.el8_6 , < * (rpm) cpe:/o:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:4.18.0-477.158.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:4.18.0-477.158.1.el8_8 , < * (rpm) cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.22.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.188.1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:5.14.0-284.188.1.rt14.473.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::nfv
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.145.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	cpe:/o:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.134.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	cpe:/o:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 412.86.202608241157-0 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202608250221-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202608182320-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 4.20.9.6.202608181658-0 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 4.21.9.6.202608180431-0 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.22	Unaffected: 4.22.9.8.202607152026-0 , < * (rpm) cpe:/a:redhat:openshift:4.22::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.30.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.95.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.141.1.rt7.482.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.141.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.206.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.206.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.158.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.158.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.22.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.188.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.188.1.rt14.473.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.145.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.134.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kpatch-patch",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "412.86.202608241157-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "417.94.202608250221-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202608182320-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.20.9.6.202608181658-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.21.9.6.202608180431-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.22::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.22",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.22.9.8.202607152026-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "libkrun",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-8",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-06T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s CIFS (Common Internet File System) client. When the `cifs_sanitize_prepath` function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-bounds read can lead to a system crash, resulting in a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T12:04:53.460Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-43112"
          },
          {
            "name": "RHBZ#2467015",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467015"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43112.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59831"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60019"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57402"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57543"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57457"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40764"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52764"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34911"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59662"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56573"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53990"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36018"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62642"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36366"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62637"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53989"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52649"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62558"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62638"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62639"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62641"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62640"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36365"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59663"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:59831: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60019: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57402: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57543: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57457: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40764: Red Hat OpenShift Container Platform 4.22"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52764: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34911: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59662: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56573: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53990: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62642: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36366: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62637: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53989: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52649: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62558: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62638: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62639: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62641: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62640: Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36365: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59663: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/fs_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a2ba20c17de8eb028f96b1d85f119d3d25655bd9",
              "status": "affected",
              "version": "c63433a09d6ae4c226fcbc66da4c58fc189fd746",
              "versionType": "git"
            },
            {
              "lessThan": "fbced33599653471b4581dfe1abc7b467031f126",
              "status": "affected",
              "version": "a31080899d5fdafcccf7f39dd214a814a2c82626",
              "versionType": "git"
            },
            {
              "lessThan": "5d4fe469fe7dbff7d874c196bb680a82f2625d95",
              "status": "affected",
              "version": "a31080899d5fdafcccf7f39dd214a814a2c82626",
              "versionType": "git"
            },
            {
              "lessThan": "2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439",
              "status": "affected",
              "version": "a31080899d5fdafcccf7f39dd214a814a2c82626",
              "versionType": "git"
            },
            {
              "lessThan": "86f9c23e0814cfdffda9eedf0c591c51ba209010",
              "status": "affected",
              "version": "a31080899d5fdafcccf7f39dd214a814a2c82626",
              "versionType": "git"
            },
            {
              "lessThan": "49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3",
              "status": "affected",
              "version": "a31080899d5fdafcccf7f39dd214a814a2c82626",
              "versionType": "git"
            },
            {
              "lessThan": "78ec5bf2f589ec7fd8f169394bfeca541b077317",
              "status": "affected",
              "version": "a31080899d5fdafcccf7f39dd214a814a2c82626",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.209",
              "status": "affected",
              "version": "5.15.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/fs_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.15.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath\n\nWhen cifs_sanitize_prepath is called with an empty string or a string\ncontaining only delimiters (e.g., \"/\"), the current logic attempts to\ncheck *(cursor2 - 1) before cursor2 has advanced. This results in an\nout-of-bounds read.\n\nThis patch adds an early exit check after stripping prepended\ndelimiters. If no path content remains, the function returns NULL.\n\nThe bug was identified via manual audit and verified using a\nstandalone test case compiled with AddressSanitizer, which\ntriggered a SEGV on affected inputs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious SMB/DFS server can influence referral target path handling that flows through SMB client mount/DFS processing into `cifs_sanitize_prepath`. The triggering data is delivered over the network via SMB responses.\nAC:L - The trigger is a deterministic empty or delimiter-only prepath condition; no race or hard-to-control environmental condition is required. A malicious server or local mount caller can craft the relevant path form directly.\nPR:N - In the network scenario, the attacker only needs to operate the SMB/DFS endpoint that the victim client contacts and needs no privileges on the victim system. Local user-namespace reachability also exists before the final non-`FS_USERNS_MOUNT` mount denial, but the no-privilege malicious-server scenario is more severe.\nUI:R - The victim must initiate or otherwise cause an SMB/CIFS mount or DFS traversal to the attacker-controlled server. After that action, no further interaction is needed.\nS:U - The bug corrupts or reads kernel memory within the same host kernel security authority. It does not cross a separate scope such as a hypervisor, guest boundary, or IOMMU boundary.\nC:H - The immediate invalid access is a bounded read, but the same edge case can enter a path that treats memory before the prepath as part of the buffer, making this defensibly kernel memory corruption. Under the required overestimation rule, potential exploitation of kernel memory corruption is scored as high confidentiality impact.\nI:H - After the out-of-bounds read, if the preceding byte is a delimiter the old code decrements the cursor and writes a NUL before the prepath buffer. That conditional out-of-bounds write is kernel memory corruption and is scored as high integrity impact.\nA:H - The fix commit reports an AddressSanitizer SEGV on affected inputs, and the kernel path can produce invalid memory access or heap corruption. A repeatable kernel oops/panic or destabilization is therefore a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:59.624Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a2ba20c17de8eb028f96b1d85f119d3d25655bd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbced33599653471b4581dfe1abc7b467031f126"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d4fe469fe7dbff7d874c196bb680a82f2625d95"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439"
        },
        {
          "url": "https://git.kernel.org/stable/c/86f9c23e0814cfdffda9eedf0c591c51ba209010"
        },
        {
          "url": "https://git.kernel.org/stable/c/49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/78ec5bf2f589ec7fd8f169394bfeca541b077317"
        }
      ],
      "title": "fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43112",
    "datePublished": "2026-05-06T07:40:38.563Z",
    "dateReserved": "2026-05-01T14:12:55.986Z",
    "dateUpdated": "2026-09-04T12:04:53.460Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43114 (GCVE-0-2026-43114)

Vulnerability from cvelistv5 – Published: 2026-05-06 07:40 – Updated: 2026-09-03 12:04

Title

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipapo set with 'ipv4 . port' key, i.e. nft -f foo. This works. Then, it reloads the set after a flush: (echo flush set t s; cat foo) | nft -f - This is expected to work, because its the same set after all and it was already loaded once. But with avx2, this fails: nft reports a clashing element. The reported clash is of following form: We successfully re-inserted a . b c . d Then we try to insert a . d avx2 finds the already existing a . d, which (due to 'flush set') is marked as invalid in the new generation. It skips the element and moves to next. Due to incorrect masking, the skip-step finds the next matching element *only considering the first field*, i.e. we return the already reinserted "a . b", even though the last field is different and the entry should not have been matched. No such error is reported for the generic c implementation (no avx2) or when the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback. Bisection points to 7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection") but that fix merely uncovers this bug. Before this commit, the wrong element is returned, but erronously reported as a full, identical duplicate. The root-cause is too early return in the avx2 match functions. When we process the last field, we should continue to process data until the entire input size has been consumed to make sure no stale bits remain in the map.

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-480 - Use of Incorrect Operator

Assigner

Linux mitre root

References

18 references

URL	Tags
https://git.kernel.org/stable/c/f8c39983fc9c1a978…
https://git.kernel.org/stable/c/c7babe2f28b507e17…
https://git.kernel.org/stable/c/1c43f0dd8691ddf88…
https://git.kernel.org/stable/c/fa4f1f52528c73989…
https://git.kernel.org/stable/c/3d53f9aafd469ae1e…
https://git.kernel.org/stable/c/07de44424bb7f17ef…
https://git.kernel.org/stable/c/0abbc43f71d99baad…
https://git.kernel.org/stable/c/d3c0037ffe1273fa1…
https://access.redhat.com/security/cve/CVE-2026-43114	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2466994	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:62568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59723	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62642	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62638	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62639	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62641	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62640	vendor-advisoryx_refsource_REDHAT

Impacted products

9 products

Vendor	Product	Version
Linux	Linux	Affected: 7400b063969bdca4a06cd97f1294d765c8eecbe1 , < f8c39983fc9c1a978c82e6f2df7bfba8a8561587 (git) Affected: 7400b063969bdca4a06cd97f1294d765c8eecbe1 , < c7babe2f28b507e17f28e9f753b7caec72d4857f (git) Affected: 7400b063969bdca4a06cd97f1294d765c8eecbe1 , < 1c43f0dd8691ddf8884793b481ddc7511cf593c3 (git) Affected: 7400b063969bdca4a06cd97f1294d765c8eecbe1 , < fa4f1f52528c73989d820f32bfca06bec5afeece (git) Affected: 7400b063969bdca4a06cd97f1294d765c8eecbe1 , < 3d53f9aafd469ae1ea27051e00f5b96ca1b55d52 (git) Affected: 7400b063969bdca4a06cd97f1294d765c8eecbe1 , < 07de44424bb7f17ef9357e8535df96d9e97c40cb (git) Affected: 7400b063969bdca4a06cd97f1294d765c8eecbe1 , < 0abbc43f71d99baadeeba6fa3fe1c80b676f57ed (git) Affected: 7400b063969bdca4a06cd97f1294d765c8eecbe1 , < d3c0037ffe1273fa1961e779ff6906234d6cf53c (git)
Linux	Linux	Affected: 5.7 Unaffected: 0 , < 5.7 (semver) Unaffected: 5.10.258 , ≤ 5.10.* (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.1.175 , ≤ 6.1.* (semver) Unaffected: 6.6.136 , ≤ 6.6.* (semver) Unaffected: 6.12.83 , ≤ 6.12.* (semver) Unaffected: 6.18.24 , ≤ 6.18.* (semver) Unaffected: 6.19.14 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.42.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.42.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "libkrun",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unknown",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-8",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-06T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s netfilter component, specifically within the `nft_set_pipapo_avx2` AVX2 matching functions. This vulnerability occurs when a `pipapo` set with an \u0027ipv4 . port\u0027 key is reloaded. Due to incorrect masking, the system may erroneously identify non-matching elements as duplicates, leading to data integrity issues and unexpected behavior. A remote attacker could potentially exploit this to cause a denial of service or impact data integrity."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-480",
                "description": "Use of Incorrect Operator",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T12:04:36.683Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-43114"
          },
          {
            "name": "RHBZ#2466994",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466994"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43114.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62568"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59723"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62642"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62638"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62639"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62641"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62640"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:62568: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59723: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62642: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62638: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62639: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62641: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62640: Red Hat Enterprise Linux BaseOS (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-06T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: netfilter: nft_set_pipapo_avx2: don\u0027t return non-matching entry on expiry",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_set_pipapo_avx2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f8c39983fc9c1a978c82e6f2df7bfba8a8561587",
              "status": "affected",
              "version": "7400b063969bdca4a06cd97f1294d765c8eecbe1",
              "versionType": "git"
            },
            {
              "lessThan": "c7babe2f28b507e17f28e9f753b7caec72d4857f",
              "status": "affected",
              "version": "7400b063969bdca4a06cd97f1294d765c8eecbe1",
              "versionType": "git"
            },
            {
              "lessThan": "1c43f0dd8691ddf8884793b481ddc7511cf593c3",
              "status": "affected",
              "version": "7400b063969bdca4a06cd97f1294d765c8eecbe1",
              "versionType": "git"
            },
            {
              "lessThan": "fa4f1f52528c73989d820f32bfca06bec5afeece",
              "status": "affected",
              "version": "7400b063969bdca4a06cd97f1294d765c8eecbe1",
              "versionType": "git"
            },
            {
              "lessThan": "3d53f9aafd469ae1ea27051e00f5b96ca1b55d52",
              "status": "affected",
              "version": "7400b063969bdca4a06cd97f1294d765c8eecbe1",
              "versionType": "git"
            },
            {
              "lessThan": "07de44424bb7f17ef9357e8535df96d9e97c40cb",
              "status": "affected",
              "version": "7400b063969bdca4a06cd97f1294d765c8eecbe1",
              "versionType": "git"
            },
            {
              "lessThan": "0abbc43f71d99baadeeba6fa3fe1c80b676f57ed",
              "status": "affected",
              "version": "7400b063969bdca4a06cd97f1294d765c8eecbe1",
              "versionType": "git"
            },
            {
              "lessThan": "d3c0037ffe1273fa1961e779ff6906234d6cf53c",
              "status": "affected",
              "version": "7400b063969bdca4a06cd97f1294d765c8eecbe1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_set_pipapo_avx2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo_avx2: don\u0027t return non-matching entry on expiry\n\nNew test case fails unexpectedly when avx2 matching functions are used.\n\nThe test first loads a ranomly generated pipapo set\nwith \u0027ipv4 . port\u0027 key, i.e.  nft -f foo.\n\nThis works.  Then, it reloads the set after a flush:\n(echo flush set t s; cat foo) | nft -f -\n\nThis is expected to work, because its the same set after all and it was\nalready loaded once.\n\nBut with avx2, this fails: nft reports a clashing element.\n\nThe reported clash is of following form:\n\n    We successfully re-inserted\n      a . b\n      c . d\n\nThen we try to insert a . d\n\navx2 finds the already existing a . d, which (due to \u0027flush set\u0027) is marked\nas invalid in the new generation.  It skips the element and moves to next.\n\nDue to incorrect masking, the skip-step finds the next matching\nelement *only considering the first field*,\n\ni.e. we return the already reinserted \"a . b\", even though the\nlast field is different and the entry should not have been matched.\n\nNo such error is reported for the generic c implementation (no avx2) or when\nthe last field has to use the \u0027nft_pipapo_avx2_lookup_slow\u0027 fallback.\n\nBisection points to\n7711f4bb4b36 (\"netfilter: nft_set_pipapo: fix range overlap detection\")\nbut that fix merely uncovers this bug.\n\nBefore this commit, the wrong element is returned, but erronously\nreported as a full, identical duplicate.\n\nThe root-cause is too early return in the avx2 match functions.\nWhen we process the last field, we should continue to process data\nuntil the entire input size has been consumed to make sure no stale\nbits remain in the map."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Although nftables configuration is local, the vulnerable AVX2 pipapo lookup is also used from nftables packet hooks, so a received network packet can exercise it in a deployed firewall ruleset.\nAC:L - No race, memory-layout dependency, or probabilistic condition is required once an affected AVX2 interval/concatenated set with expired or inactive entries exists; the attacker controls the packet key values used for lookup.\nPR:N - A remote packet sender does not need nftables privileges or authentication to trigger the packet-path lookup in an already configured firewall.\nUI:N - No victim user action is needed; packet processing and set lookup occur automatically in the kernel netfilter hook path.\nS:U - The impact remains within the kernel/network filtering security authority and does not cross a VM, IOMMU, or separate sandbox boundary.\nC:H - The bug can falsely match a non-matching set element after an expired or inactive element is skipped, which can bypass firewall policy and expose services or traffic that should have been unreachable.\nI:H - A false nftables set match can select the wrong verdict or map data, allowing unauthorized traffic/action contrary to the intended firewall policy.\nA:L - The same wrong-match behavior can cause legitimate nftables updates to fail with false element clashes or can misclassify selected traffic, but it is not a kernel crash, hang, or memory corruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:01.768Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f8c39983fc9c1a978c82e6f2df7bfba8a8561587"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7babe2f28b507e17f28e9f753b7caec72d4857f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c43f0dd8691ddf8884793b481ddc7511cf593c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa4f1f52528c73989d820f32bfca06bec5afeece"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d53f9aafd469ae1ea27051e00f5b96ca1b55d52"
        },
        {
          "url": "https://git.kernel.org/stable/c/07de44424bb7f17ef9357e8535df96d9e97c40cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0abbc43f71d99baadeeba6fa3fe1c80b676f57ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3c0037ffe1273fa1961e779ff6906234d6cf53c"
        }
      ],
      "title": "netfilter: nft_set_pipapo_avx2: don\u0027t return non-matching entry on expiry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43114",
    "datePublished": "2026-05-06T07:40:39.877Z",
    "dateReserved": "2026-05-01T14:12:55.986Z",
    "dateUpdated": "2026-09-03T12:04:36.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46323 (GCVE-0-2026-46323)

Vulnerability from cvelistv5 – Published: 2026-06-09 12:11 – Updated: 2026-09-03 12:04

Title

net: gro: don't merge zcopy skbs

Summary

In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-123 - Write-what-where Condition

Assigner

Linux mitre root

References

23 references

URL	Tags
https://git.kernel.org/stable/c/3c6cc9f2ca65b6dd6…
https://git.kernel.org/stable/c/1f9c828556416fbe3…
https://git.kernel.org/stable/c/479084ae0e1d9cb79…
https://git.kernel.org/stable/c/e334cbf3388fd9334…
https://git.kernel.org/stable/c/44bea2032af0425e4…
https://git.kernel.org/stable/c/4db79a322db8c97f7…
https://access.redhat.com/security/cve/CVE-2026-46323	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2479832	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:47727	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44230	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44231	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44259	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27731	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44270	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27735	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27708	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62642	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62639	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62641	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62640	vendor-advisoryx_refsource_REDHAT

Impacted products

18 products

Vendor	Product	Version
Linux	Linux	Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 1f9c828556416fbe3f49386708ce999fc4d4da06 (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 479084ae0e1d9cb7929cb4298d35623de189f80a (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < e334cbf3388fd9334503a778a82d9e9f14dd2f71 (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 44bea2032af0425e4ce6d26a8af0ede79db49ec1 (git) Affected: 753f1ca4e1e50248a1b760c9774d6d6b354562cc , < 4db79a322db8c97f7b73b8a347395ef4d685eb40 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.142 , ≤ 6.6.* (semver) Unaffected: 6.12.92 , ≤ 6.12.* (semver) Unaffected: 6.18.34 , ≤ 6.18.* (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:6.12.0-211.38.1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:6.12.0-55.82.1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:5.14.0-687.22.1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:5.14.0-427.132.1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:5.14.0-570.123.1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 417.94.202607240132-0 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 418.94.202607211754-0 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 4.19.9.6.202607220857-0 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 4.20.9.6.202607221038-0 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 4.21.9.6.202607221317-0 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux for NVIDIA 26	cpe:/a:redhat:enterprise_linux_nvidia:
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-211.38.1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:6.12.0-55.82.1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.22.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.132.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.123.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "417.94.202607240132-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "418.94.202607211754-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.19.9.6.202607220857-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.20.9.6.202607221038-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhcos",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.21.9.6.202607221317-0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_nvidia:"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux for NVIDIA 26",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-8",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-19T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Generic Receive Offload (GRO) networking subsystem. This vulnerability occurs when `skb_gro_receive()` attempts to merge zerocopy socket buffers (skbs) without properly managing page reference counts, specifically when the `SKBFL_MANAGED_FRAG_REFS` flag is set. An attacker could potentially exploit this to trigger a Use-After-Free (UAF) condition, which is a memory corruption vulnerability that can lead to system instability or potentially arbitrary code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-123",
                "description": "Write-what-where Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T12:04:41.019Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-46323"
          },
          {
            "name": "RHBZ#2479832",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479832"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46323.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47727"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44230"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44231"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44259"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44262"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27731"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44270"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27735"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27708"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36018"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62642"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62639"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62641"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62640"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:47727: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44230: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44231: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44259: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44262: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27731: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44270: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27735: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27708: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62642: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62639: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62641: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62640: Red Hat Enterprise Linux BaseOS (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-19T11:49:44.372Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-19T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/gro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d",
              "status": "affected",
              "version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
              "versionType": "git"
            },
            {
              "lessThan": "1f9c828556416fbe3f49386708ce999fc4d4da06",
              "status": "affected",
              "version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
              "versionType": "git"
            },
            {
              "lessThan": "479084ae0e1d9cb7929cb4298d35623de189f80a",
              "status": "affected",
              "version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
              "versionType": "git"
            },
            {
              "lessThan": "e334cbf3388fd9334503a778a82d9e9f14dd2f71",
              "status": "affected",
              "version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
              "versionType": "git"
            },
            {
              "lessThan": "44bea2032af0425e4ce6d26a8af0ede79db49ec1",
              "status": "affected",
              "version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
              "versionType": "git"
            },
            {
              "lessThan": "4db79a322db8c97f7b73b8a347395ef4d685eb40",
              "status": "affected",
              "version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/gro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: don\u0027t merge zcopy skbs\n\nskb_gro_receive() can currently copy frags between the source and GRO\nskb, without checking the zerocopy status, and in particular the\nSKBFL_MANAGED_FRAG_REFS flag.\n\nWhen SKBFL_MANAGED_FRAG_REFS is set, the skb doesn\u0027t hold a reference\non the pages in shinfo-\u003efrags. Appending those frags to another skb\u0027s\nfrags without fixing up the page refcount can lead to UAF.\n\nWhen either the last skb in the GRO chain (the one we would append\nfrags to) or the source skb is zerocopy, don\u0027t merge the skbs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local attacker to inject zerocopy/managed-frags skbs via io_uring SEND_ZC, TUN/TAP, or similar local APIs; ordinary remote wire packets processed by GRO do not carry SKBFL_MANAGED_FRAG_REFS, so a network-only attacker cannot reach the buggy merge path.\nAC:L - The attacker fully controls both sides of the GRO merge (seed and zerocopy TCP segments over a veth pair), timing (netem delay, RST race), and buffer setup; a public working LPE exploit exists, so success does not depend on conditions outside attacker control.\nPR:L - Triggering requires only a basic unprivileged local account with io_uring and user-namespace access (unshare -Urn), which is the default on many distributions; no init-namespace root or CAP_NET_ADMIN is needed.\nUI:N - No victim user action is required; the attacker drives the entire exploit autonomously through syscalls and local network namespace setup.\nS:U - Impact is standard host-kernel privilege escalation (root on the same kernel); it does not cross a distinct hypervisor/IOMMU security boundary such as VM-guest-to-host escape.\nC:H - The flaw is a use-after-free on page structures; the known exploit leverages the refcount underflow to obtain stale read access to freed physical pages and extract kernel PTE contents, enabling arbitrary memory disclosure primitives.\nI:H - UAF page refcount corruption enables crafting writable PTE entries against read-only page-cache pages; the public exploit demonstrates integrity compromise by rewriting /etc/passwd and obtaining root via su.\nA:H - Use-after-free of page structures can cause kernel oops/panic during skb teardown; even failed exploitation attempts can crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:18.394Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f9c828556416fbe3f49386708ce999fc4d4da06"
        },
        {
          "url": "https://git.kernel.org/stable/c/479084ae0e1d9cb7929cb4298d35623de189f80a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e334cbf3388fd9334503a778a82d9e9f14dd2f71"
        },
        {
          "url": "https://git.kernel.org/stable/c/44bea2032af0425e4ce6d26a8af0ede79db49ec1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4db79a322db8c97f7b73b8a347395ef4d685eb40"
        }
      ],
      "title": "net: gro: don\u0027t merge zcopy skbs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46323",
    "datePublished": "2026-06-09T12:11:15.562Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-09-03T12:04:41.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-53264 (GCVE-0-2026-53264)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:34

Title

net/sched: act_api: use RCU with deferred freeing for action lifecycle

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() <-- holds the idr lock 0: rcu_read_lock() 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR) 0: mutex_unlock() <-- releases the idr lock 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) <-- Action removed from IDR 1: mutex_unlock() <-- mutex released allowing us to delete the action 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory This patch fixes the race condition between NEWTFILTER and DELFILTER by adding struct rcu_head to tc_action used in the deferral and introducing a call_rcu() in the delete path to defer the final kfree(). Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") but also modernization/simplification to directly use kfree_rcu(). Let's illustrate the new restored code path: 0: rcu_read_lock() 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period 0: p = idr_find(idr, index) 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0 1: rcu_read_unlock() <-- release so freeing can run after grace period After CPU1 calls idr_remove(), the object is no longer reachable through the IDR. CPU0's subsequent idr_find() will return NULL, and even if it still held a stale pointer, the immediate kfree() is now deferred until after the RCU grace period, so no UAF can occur.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-29 03:55 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/98b2e40879abf0245…
https://git.kernel.org/stable/c/18af5d2ef0c4f6578…
https://git.kernel.org/stable/c/1f1b98fea6b9ea305…
https://git.kernel.org/stable/c/8b136f18ac4b2ace5…
https://git.kernel.org/stable/c/5dd51e09020c65aa5…
https://git.kernel.org/stable/c/b60e9391142e983fa…
https://git.kernel.org/stable/c/91d105d2cbe002f9c…
https://git.kernel.org/stable/c/5057e1aca011e51ef…
https://starlabs.sg/blog/2026/07-when-ai-makes-0-…	exploit

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 98b2e40879abf0245be5a5b7af69e0f6ff524ac3 (git) Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 18af5d2ef0c4f65787fd1280c8b23286b9f2a835 (git) Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 1f1b98fea6b9ea30507d0f2fbff6750292d097e2 (git) Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 8b136f18ac4b2ace5aaad3305b3f8a5d8165a009 (git) Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 5dd51e09020c65aa53cf128e5e3517cd53b3c113 (git) Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < b60e9391142e983fab2be53497aa8f71fdd09cd5 (git) Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 91d105d2cbe002f9c7b43a6183adedc37e1da1f7 (git) Affected: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da , < 5057e1aca011e51ef51498c940ef96f3d3e8a305 (git)
Linux	Linux	Affected: 4.14 Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.94 , ≤ 6.12.* (semver) Unaffected: 6.18.36 , ≤ 6.18.* (semver) Unaffected: 7.0.13 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53264",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T03:55:26.363824Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T18:15:51.295Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "98b2e40879abf0245be5a5b7af69e0f6ff524ac3",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "18af5d2ef0c4f65787fd1280c8b23286b9f2a835",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "1f1b98fea6b9ea30507d0f2fbff6750292d097e2",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "8b136f18ac4b2ace5aaad3305b3f8a5d8165a009",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "5dd51e09020c65aa53cf128e5e3517cd53b3c113",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "b60e9391142e983fab2be53497aa8f71fdd09cd5",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "91d105d2cbe002f9c7b43a6183adedc37e1da1f7",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            },
            {
              "lessThan": "5057e1aca011e51ef51498c940ef96f3d3e8a305",
              "status": "affected",
              "version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/act_api.h",
            "net/sched/act_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_api: use RCU with deferred freeing for action lifecycle\n\nWhen NEWTFILTER and DELFILTER are run concurrently it is possible to create a\nrace with an associated action.\n\nLet\u0027s illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:\n\n 0: mutex_lock() \u003c-- holds the idr lock\n 0: rcu_read_lock()\n 0: p = idr_find(idr, index) \u003c-- action p is valid (RCU protects IDR)\n 0: mutex_unlock() \u003c-- releases the idr lock\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\n 1: idr_remove(idr, index) \u003c-- Action removed from IDR\n 1: mutex_unlock() \u003c-- mutex released allowing us to delete the action\n 1: tcf_action_cleanup(p); kfree(p) \u003c-- Kfrees p immediately, no deferral\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- ouch, UAF p points to freed memory\n\nThis patch fixes the race condition between NEWTFILTER and DELFILTER by\nadding struct rcu_head to tc_action used in the deferral and introducing a\ncall_rcu() in the delete path to defer the final kfree().\n\nNote: this is a revert of commit d7fb60b9cafb (\"net_sched: get rid of tcfa_rcu\")\nbut also modernization/simplification to directly use kfree_rcu().\n\nLet\u0027s illustrate the new restored code path:\n\n 0: rcu_read_lock()\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\n 1: idr_remove(idr, index)\n 1: mutex_unlock()\n 1: call_rcu(\u0026p-\u003etcfa_rcu, tcf_action_rcu_free) \u003c-- defer kfree after grace period\n 0: p = idr_find(idr, index)\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- fails, refcnt already 0\n 1: rcu_read_unlock() \u003c-- release so freeing can run after grace period\n\nAfter CPU1 calls idr_remove(), the object is no longer reachable through the IDR.\nCPU0\u0027s subsequent idr_find() will return NULL, and even if it still held a\nstale pointer, the immediate kfree() is now deferred until after the RCU grace\nperiod, so no UAF can occur."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local rtnetlink `RTM_NEWTFILTER`/`RTM_DELTFILTER` traffic-control netlink messages, not by remote packet input.\nAC:L - The race is attacker-controlled because the same local actor can issue concurrent filter creation and deletion operations against the same action index. No external victim timing or rare environmental condition is required.\nPR:L - The operations require `CAP_NET_ADMIN` for non-GET rtnetlink messages, but traffic control is reachable with `CAP_NET_ADMIN` inside a user-created network namespace. Under the provided kernel guidance, this is Low privileges rather than High.\nUI:N - No victim interaction is needed; exploitation consists of the attacker sending crafted concurrent rtnetlink requests.\nS:U - The impact is within the kernel security authority and is a standard local kernel memory-corruption/privilege-escalation class issue. It does not cross a VM, IOMMU, or separate authorization scope boundary.\nC:H - The bug is a use-after-free of a `tc_action` object during action lookup/refcounting. A kernel heap UAF can be shaped into disclosure primitives, so confidentiality impact is High.\nI:H - The stale freed action pointer can be reused after heap reallocation and then modified/dereferenced through refcount, bind count, ops, and action lifecycle fields. This is memory corruption that can plausibly support arbitrary write or code execution, so integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or mutate freed/reused kernel memory and can crash or oops the kernel. Availability impact is therefore High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:41.215Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3"
        },
        {
          "url": "https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009"
        },
        {
          "url": "https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113"
        },
        {
          "url": "https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305"
        }
      ],
      "title": "net/sched: act_api: use RCU with deferred freeing for action lifecycle",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53264",
    "datePublished": "2026-06-25T08:39:51.870Z",
    "dateReserved": "2026-06-09T07:44:35.395Z",
    "dateUpdated": "2026-08-05T12:34:41.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:62641

CVE-2026-23111 (GCVE-0-2026-23111)

CVE-2026-43112 (GCVE-0-2026-43112)

CVE-2026-43114 (GCVE-0-2026-43114)

CVE-2026-46323 (GCVE-0-2026-46323)

CVE-2026-53264 (GCVE-0-2026-53264)

Tags

Sightings

Nomenclature