SB2026040337 - openEuler 22.03 LTS SP4 update for kernel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026040337

SB2026040337 - openEuler 22.03 LTS SP4 update for kernel

Published: April 3, 2026

Security Bulletin ID SB2026040337
Severity
Low
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-23243)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a boundary error in the RDMA/umad component when processing user-controlled MAD headers. A local user can send a specially crafted request with mismatched MAD header size and RMPP header length to cause a denial of service.

Exploitation requires access to the RDMA UMAD interface. The vulnerability can trigger an out-of-bounds write in kernel memory, leading to system instability or crash.


2) Type conversion (CVE-ID: CVE-2026-23352)

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper memory management in the EFI boot services memory release mechanism when processing memory map initialization during system boot. A local attacker can trigger the early release of boot services memory before deferred memory map initialization is complete, leading to unfreed memory pages and a memory leak.

The issue specifically occurs on systems with CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, where memblock_free_late() skips uninitialized pages, resulting in a significant memory leak—up to approximately 140MB on constrained systems like EC2 t3a.nano instances with only 512MB RAM.


3) Out-of-bounds write (CVE-ID: CVE-2026-23388)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an improper input validation in the Squashfs filesystem component when processing a crafted filesystem image. A local user can mount a malicious Squashfs image to cause a general protection fault and crash the system.

Exploitation requires the ability to mount a specially crafted filesystem image, which typically requires user privileges but not root access.


Remediation

Install update from vendor's website.

References