SB2026051586 - openEuler 20.03 LTS SP4 update for kernel

Description

This security bulletin contains information about 9 vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2026-31504)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in packet_release() and fanout group handling when processing a concurrent NETDEV_UP event during socket release. A local user can trigger a race condition to cause a denial of service.

The issue affects fanout sockets during a race that can leave a dangling pointer in the fanout array.

2) Heap-based buffer overflow (CVE-ID: CVE-2026-31515)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a buffer overflow in pfkey_send_migrate() when processing migration requests with invalid old or new address families. A local user can trigger the vulnerable code path to cause a denial of service.

3) Stack-based buffer overflow (CVE-ID: CVE-2026-31630)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in the AF_RXRPC procfs helpers when formatting socket addresses for procfs output with "%pISpc". A local user can trigger address formatting with a specially crafted IPv6 address representation to cause a denial of service.

The issue occurs because the fixed 50-byte stack buffers are too small for the longest current IPv6-with-port textual form, including certain ISATAP address formats.

4) Use-after-free (CVE-ID: CVE-2026-31673)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in UNIX_DIAG_VFS handling in af_unix when processing UNIX diagnostic lookups. A local user can trigger a race condition to cause a denial of service.

5) Out-of-bounds read (CVE-ID: CVE-2026-31674)

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rt_mt6() when processing a malformed rt match rule with an oversized addrnr value. A local user can install a specially crafted rule to cause a denial of service.

6) Out-of-bounds read (CVE-ID: CVE-2026-31682)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in br_nd_send when parsing neighbor discovery options from a non-linear skb. A remote attacker can send a specially crafted ICMPv6 neighbor solicitation request to cause a denial of service.

7) Resource management error (CVE-ID: CVE-2026-43284)

The vulnerability allows a local user to escalate privileges on the system.

The xfrm-ESP Page-Cache Write vulnerability exists due to improper management of internal resources in esp_input() function in net/ipv4/esp4.c and esp6_input() function in net/ipv6/esp6.c. A local user can execute arbitrary code with root privileges. 

Note, this is one of two vulnerabilities reported as Dirty Frag.

8) Improper locking (CVE-ID: CVE-2025-38617)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the packet_set_ring() function in net/packet/af_packet.c. A local user can perform a denial of service (DoS) attack.

9) Resource management error (CVE-ID: CVE-2026-43500)

The vulnerability allows a local user to escalate privileges on the system.

The RxRPC Page-Cache Write vulnerability exists due to improper management of internal resources. A local user can execute arbitrary code with root privileges.

Note, this vulnerability is one of two issues described as Dirty Frag.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2310