SB2026061290 - openEuler 24.03 LTS SP3 update for kernel



SB2026061290 - openEuler 24.03 LTS SP3 update for kernel

Published: June 12, 2026

Security Bulletin ID SB2026061290
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 46
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 15% Low 85%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 46 vulnerabilities.


1) Race condition (CVE-ID: CVE-2026-45973)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the RDMA/mlx5 driver bond device handling when unloading the device during a firmware reset in LAG mode. A local user can trigger device teardown during this state to cause a denial of service.

The issue can cause the driver to hang indefinitely while waiting for UMR completion because completions never arrive.


2) Improper update of reference count (CVE-ID: CVE-2026-43465)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in the mlx5 XDP receive path when processing XDP multi-buffer packets on striding RQ. A local user can trigger XDP actions that alter the XDP buffer layout to cause a kernel warning and crash.

The issue affects multiple XDP actions, including XDP_TX, XDP_REDIRECT, XDP_PASS, and packet drops after buffer layout changes caused by bpf_xdp_pull_data() or bpf_xdp_adjust_tail().


3) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43466)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state management in the mlx5e transmit queue recovery logic when handling a TX error CQE during SQ recovery. A local user can trigger a TX error CQE recovery flow to cause a denial of service.

The issue can desynchronize the DMA FIFO producer and consumer counters, leading to stale DMA addresses being unmapped and a kernel warning.


4) Improper input validation (CVE-ID: CVE-2026-45850)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ipvs checksum validation when processing IPv6 packets with extension headers. A remote attacker can send specially crafted IPv6 packets to cause a denial of service.


5) Improper input validation (CVE-ID: CVE-2026-45893)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of unaligned memory access in AppArmor table creation when processing user-supplied source blobs. A local user can provide a specially crafted unaligned blob to cause a denial of service.

The source blob may originate from userspace.


6) Race condition (CVE-ID: CVE-2026-45894)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the Intel VT-d scalable mode PASID table entry handling when tearing down an active PASID entry. A local user can trigger concurrent PASID entry teardown to cause a denial of service.

The issue can lead to unpredictable behavior or spurious faults if the IOMMU hardware observes a torn read of the entry.


7) Deadlock (CVE-ID: CVE-2026-45895)

CWE-ID: CWE-833 - Deadlock

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a livelock condition in quotactl_block() when waiting for a frozen filesystem to thaw. A local user can repeatedly toggle quota operations during filesystem freeze activity to cause a denial of service.

The issue is reliably triggered on non-preemptible kernels when the freezer and quota operations run on the same CPU.


8) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-45915)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of link counts in vfat_rmdir() and msdos_rmdir() when processing a corrupted FAT filesystem image during directory removal. A local user can trigger directory removal on a crafted filesystem image to cause a denial of service.


9) Double free (CVE-ID: CVE-2026-45920)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in ext4 block allocation handling when processing filesystem shutdown error paths. A local user can trigger a filesystem shutdown during block allocation operations to cause a denial of service.

The issue can lead to an inconsistent dirty cluster counter state and trigger a kernel warning in ext4_put_super().


10) Race condition (CVE-ID: CVE-2026-45944)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a race condition in the Intel VT-d IOMMU context entry teardown logic when tearing down context entries. A local attacker can trigger use of a torn context entry to cause a denial of service.

The issue arises because the hardware may observe a partially updated 128-bit context entry while the Present bit remains set, resulting in unpredictable behavior or spurious faults.


11) Use-after-free (CVE-ID: CVE-2026-45949)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the hwrng core when unregistering and registering hardware random number generator devices concurrently. A local user can trigger repeated register and unregister operations to cause a denial of service.

The issue is caused by a race condition involving the global hwrng_fill pointer and thread lifecycle handling.


12) Out-of-bounds write (CVE-ID: CVE-2026-45968)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds index in the cpuidle ladder governor when selecting an idle state on systems with only one available idle state. A local attacker can trigger the vulnerable code path to cause a denial of service.

This issue occurs on certain platforms where cpuidle registers only a single polling idle state, which can result in a NULL enter callback being invoked and a system crash.


13) Improper access control (CVE-ID: CVE-2026-43334)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to bypass man-in-the-middle protection during Bluetooth pairing.

The vulnerability exists due to improper access control in the Bluetooth SMP pairing response handling when processing a pairing request. A remote attacker can initiate a pairing request that omits MITM requirements to bypass man-in-the-middle protection during Bluetooth pairing.

Exploitation is possible when the local side requires high security and the selected pairing method becomes inconsistent with the responder's security policy.


14) Use-after-free (CVE-ID: CVE-2026-45984)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in gfs2 inline data write path when handling inline data writes. A local user can trigger an inline write operation to cause a denial of service.

The issue occurs because a buffer head is released before the inline write completes, leaving a stale pointer that is later dereferenced during the write end path.


15) Integer overflow (CVE-ID: CVE-2026-46006)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in nouveau_gem_pushbuf_reloc_apply() when validating relocation bounds checks. A local user can provide a crafted relocation offset to cause a denial of service.


16) Use-after-free (CVE-ID: CVE-2026-46021)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in thermal_set_governor() and thermal_zone_device_unregister() when handling concurrent governor updates via sysfs during thermal zone unregistration. A local user can trigger a governor update race to cause a denial of service.

The issue can occur if thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered.


17) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-46032)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper error handling in nested_svm_vmexit() in KVM nSVM when handling a nested #VMEXIT after a failure to restore the host CR3. A local user can trigger a failure while loading L1's CR3 to cause a denial of service.

The issue can leave the guest running with corrupted state after the error is ignored.


18) Out-of-bounds read (CVE-ID: CVE-2026-46033)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the authencesn ESN encrypt/decrypt paths when handling AF_ALG requests with a too-short authentication tag inherited from an ahash digest size of 1 to 3 bytes. A local user can select an ahash with a digest size of 1 to 3 bytes and trigger ESN tail handling to cause a denial of service.


19) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-46052)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of negative dentries in fs/ceph/dir.c when processing Ceph lookup or atomic_open operations with reused cached negative dentries. A local user can trigger lookup paths that call d_add() on an already-hashed negative dentry to cause a denial of service.

The issue can corrupt the dcache hash bucket, potentially creating a self-loop that causes __d_lookup() to spin forever and trigger RCU stall reports.


20) Use-after-free (CVE-ID: CVE-2026-46065)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in fbdev deferred I/O handling when accessing a memory mapping after device hot-unplug. A local user can keep an active mapping of graphics memory and access it after hot-unplug to cause a denial of service.

Access to the invalidated mapping may result in a SIGBUS signal.


21) Improper resource shutdown or release (CVE-ID: CVE-2026-46153)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in vlan_dev_set_egress_priority() when repeatedly setting and clearing egress priority mappings with distinct skb priorities. A local user can trigger repeated set and clear operations to cause a denial of service.

The issue results in mapping nodes being retained until device teardown, leading to memory consumption over time.


22) Use-after-free (CVE-ID: CVE-2026-46242)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in ep_remove() in fs/eventpoll.c when removing epoll file references during a race with file release handling. A local user can trigger a race condition to cause memory corruption.

The issue involves the epoll-watches-epoll case and a concurrent __fput() path that can lead to operations on freed structures.


23) NULL pointer dereference (CVE-ID: CVE-2026-46245)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in amdgpu_dm_hpd_init() in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c when initializing HPD interrupts for connectors without a valid dc_link. A local user can trigger handling of such a connector to cause a denial of service.


24) Out-of-bounds read (CVE-ID: CVE-2026-43083)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in __ioam6_fill_trace_data() when processing packets with trace->type.bit6 set on the RX path. A local user can trigger the kernel to access an invalid transmit queue index to cause a denial of service.

The issue occurs when the ingress device has more RX queues than the egress device has TX queues.


25) Integer overflow (CVE-ID: CVE-2025-71109)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the ftrace_dyn_arch_init_insns() and ftrace_make_call() functions in arch/mips/kernel/ftrace.c. A local user can execute arbitrary code.


26) Improper locking (CVE-ID: CVE-2026-23213)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the smu_v14_0_2_mode1_reset() function in drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c. A local user can perform a denial of service (DoS) attack.


27) Resource management error (CVE-ID: CVE-2026-23214)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the fs/btrfs/fs.h. A local user can perform a denial of service (DoS) attack.


28) Use-after-free (CVE-ID: CVE-2026-31527)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the platform driver core driver_override handling when probing a driver through __driver_attach__(). A local user can trigger concurrent access to the driver_override field to cause a denial of service.


29) Heap-based buffer overflow (CVE-ID: CVE-2026-31607)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in usbip_pack_ret_submit() when processing a RET_SUBMIT response from a USB/IP server. A remote attacker can send a specially crafted response with an oversized number_of_packets value to cause a denial of service or execute arbitrary code.

The issue occurs because the response value is later used as the loop bound for accesses to urb->iso_frame_desc[], whose allocation size was determined by the original submission.


30) Integer underflow (CVE-ID: CVE-2026-31662)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow in tipc_group_proto_rcv() when handling duplicate or stale GRP_ACK_MSG messages. A remote attacker can send duplicate group acknowledgment messages to cause a denial of service.

After the counter wraps, group broadcasts on the affected socket remain blocked until the group is recreated.


31) Out-of-bounds read (CVE-ID: CVE-2026-31709)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in cifsacl DACL rewrite helpers when processing a server-supplied truncated DACL. A remote attacker can send a malformed ACL response to cause a denial of service.

The issue occurs because the incoming DACL body and each ACE were not structurally validated before chmod/chown security descriptor rebuild paths walked the ACE list.


32) Double free (CVE-ID: CVE-2026-31759)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in ulpi_register_interface() when handling a device registration failure. A local user can trigger the vulnerable error path to cause a denial of service.


33) Improper input validation (CVE-ID: CVE-2026-43024)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in nf_tables verdict handling when processing nftables rules. A local user can create a rule with an immediate NF_QUEUE verdict to cause a denial of service.

The issue is reachable in the arp family even though queue support is not provided there.


34) Out-of-bounds read (CVE-ID: CVE-2026-43038)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ip6_err_gen_icmpv6_unreach() when processing a forged ICMPv4 error containing a CIPSO IP option and an attacker-controlled inner IPv6 packet. A remote attacker can send a specially crafted ICMP error packet to cause a denial of service.

The issue arises because IPv4 control buffer data is reused as IPv6 control buffer data in a cloned skb, which can lead to a forged home address option offset being used during IPv6 TLV parsing.


35) Use-after-free (CVE-ID: CVE-2026-43059)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in Bluetooth MGMT command complete handlers when processing command completion paths. A local user can trigger concurrent pending command handling to cause a denial of service.

The issue involves list corruption in mgmt_add_adv_patterns_monitor_complete() and incorrect freeing of other pending mesh commands in set_mesh_complete().


36) Resource management error (CVE-ID: CVE-2025-39781)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the flush_cache_vmap() function in arch/parisc/kernel/cache.c. A local user can perform a denial of service (DoS) attack.


37) Use of uninitialized resource (CVE-ID: CVE-2026-43088)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an information exposure caused by uninitialized memory in PF_KEY export paths when exporting aligned sockaddr payloads for certain PF_KEY messages. A local user can trigger affected PF_KEY message handling to disclose sensitive information.

The issue affects the SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, and SADB_X_MIGRATE export paths, while state and policy dump builders are not affected.


38) Improper Initialization (CVE-ID: CVE-2026-43089)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in build_mapping() when copying xfrm_usersa_id structures to userspace. A local user can trigger the affected code path to disclose sensitive information.

The issue is caused by a one-byte padding hole after the proto field that is not cleared before the structure is copied out.


39) NULL pointer dereference (CVE-ID: CVE-2026-43101)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in __ioam6_fill_trace_data() when processing ipv6 ioam trace data. A local user can trigger the vulnerable code path to cause a denial of service.


40) Improper input validation (CVE-ID: CVE-2026-43107)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in xfrm_get_ae() and xfrm_aevent_msgsize() when handling malformed netlink interactions for xfrm aevent messages. A local user can send a malformed netlink interaction to cause a denial of service.

The issue is triggered for states with if_id set, where the reply skb size calculation does not account for the XFRMA_IF_ID attribute.


41) Race condition (CVE-ID: CVE-2026-43180)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double submission of an active URB in kaweth_set_rx_mode when handling rx mode changes during transmission. A local user can trigger network interface state changes to cause a denial of service.

The issue is caused by premature transmission queue wake-up while tx_urb is still in flight, which triggers the warning "URB submitted while active".


42) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43194)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of transmit error return codes in tcp_write_xmit() when processing GSO frames on qdisc-less network devices. A local user can trigger packet drops on a veth-based setup to cause a denial of service.

The issue occurs in configurations using qdisc-less devices, such as veth with TSO disabled and NAPI enabled, where loss of a single segment in a GSO super frame can be treated as loss of the entire frame and leave a TCP connection stuck.


43) Race condition (CVE-ID: CVE-2026-43198)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a race condition in tcp_v6_syn_recv_sock() when handling IPv6 TCP connection requests. A remote attacker can send network traffic that triggers the race to cause a denial of service.

The issue occurs because a child socket may become visible in the TCP ehash table before its IPv6 state is fully initialized.


44) Improper locking (CVE-ID: CVE-2026-43216)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in skb_may_tx_timestamp() when processing transmit timestamps in interrupt context. A local user can trigger transmit timestamp handling to cause a deadlock.

The issue occurs when a driver completes the transmit timestamp from a dedicated interrupt handler while the same lock is already write-locked on the same CPU.


45) Out-of-bounds write (CVE-ID: CVE-2026-43248)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in vdpa_sim when assigning an ASID to a group. A local user can assign a valid ASID to a group equal to ngroups to cause a denial of service.


46) Use-after-free (CVE-ID: CVE-2026-43303)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the swap subsystem when handling stale page->private values on reallocated and split pages. A local user can trigger swapoff operations after causing affected page state reuse to cause a denial of service.

The issue occurs because tail pages can retain stale page->private values after split_page(), leading swap_count_continued() to follow an invalid continuation list and access poisoned list entries.


Remediation

Install update from vendor's website.