SB2026080363 - openEuler 24.03 LTS SP1 update for kernel
Published: August 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 72 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-53236)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper access control in SO_ATTACH_FILTER on TCP sockets when attaching a cBPF filter. A local user can attach a filter to leak TCP sequence and acknowledgment numbers to disclose sensitive information.
Exploitation requires access to create or control a TCP socket and use the socket option interface.
2) Out-of-bounds read (CVE-ID: CVE-2026-53253)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in bnep_rx_frame() and bnep_rx_control() in the BNEP packet parser when processing short BNEP frames. A remote attacker can send a specially crafted short BNEP SDU to cause a denial of service.
The issue is triggered by malformed control packets with missing fixed fields or an empty control payload.
3) Memory leak (CVE-ID: CVE-2026-53252)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a memory leak in bt_host_release() when handling failed Bluetooth HCI device initialization before hci_register_dev() completes. A local user can trigger device initialization failures to cause a denial of service.
The issue occurs because the unregistered device cleanup path bypasses hci_release_dev(), leaving the SRCU structure allocated in hci_alloc_dev() uncleared.
4) Improper access control (CVE-ID: CVE-2026-53249)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper access control in ip_options_get() in net/ipv4/ip_options.c when setting IPv4 Loose Source and Record Route or Strict Source and Record Route options. A local user can set crafted IP options to force packets through attacker-controlled nodes to disclose sensitive information.
Exposure depends on network paths that support and forward these IPv4 options.
5) Out-of-bounds read (CVE-ID: CVE-2026-53246)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information or cause memory corruption.
The vulnerability exists due to an out-of-bounds read in sctp_unpack_cookie() and cached peer INIT chunk processing when processing a crafted COOKIE_ECHO chunk. A remote attacker can send a specially crafted COOKIE_ECHO chunk with an inflated cached INIT chunk length to disclose sensitive information or cause memory corruption.
The issue occurs in a listening SCTP server while walking parameters from the cached peer INIT chunk embedded after the cookie.
6) Improper input validation (CVE-ID: CVE-2026-53245)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in mrp_pdu_parse_vecattr when parsing crafted MRP vector attributes in protocol data units. A remote attacker can send a specially crafted MRP packet to cause a denial of service.
The issue can be triggered when a VectorAttribute uses a zero-length value set or event counts that cross byte boundaries.
7) Race condition (CVE-ID: CVE-2026-53242)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper synchronization in snd_pcm_drain() when handling linked PCM streams during concurrent unlink operations. A local user can trigger concurrent drain and unlink activity to cause a denial of service.
The issue can corrupt wait queue lists and lead to a kernel panic through a NULL function pointer dereference during a subsequent wake-up.
8) Use-after-free (CVE-ID: CVE-2026-53239)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in xfrm_policy_bysel_ctx() and inexact bin handling in the xfrm policy subsystem when processing concurrent policy deletion and hash rebuild operations. A local user can trigger a race condition to cause a denial of service.
The issue occurs because an inexact bin may be freed during a window after the policy lock is released and before pruning is performed.
9) Out-of-bounds read (CVE-ID: CVE-2026-53238)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in netlbl_unlabel_addrinfo_get() when handling crafted Generic Netlink requests with a shorter unlabeled address mask attribute. A local user can send a specially crafted Generic Netlink request to cause a denial of service.
10) Out-of-bounds read (CVE-ID: CVE-2026-53254)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in the Bluetooth RFCOMM MCC handlers when processing truncated MCC frames from a remote Bluetooth device. A remote attacker can send specially crafted truncated MCC frames to cause a denial of service.
The issue affects the RFCOMM MCC handling paths including rfcomm_recv_mcc(), rfcomm_recv_pn(), rfcomm_recv_rpn(), rfcomm_recv_rls(), and rfcomm_recv_msc().
11) Out-of-bounds read (CVE-ID: CVE-2026-53230)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in mlx5_query_nic_vport_mac_list when querying a VF vport MAC list with a larger configured maximum than the PF capability-based buffer size. A local user can configure or trigger processing of a VF vport with a larger MAC list to cause a denial of service.
The issue occurs in the mlx5 driver while handling vport address list updates.
12) Improper resource shutdown or release (CVE-ID: CVE-2026-53229)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in mlx5e_xmit_xdp_buff() in the mlx5 XDP transmit path when handling XDP_TX transmission failures in the XSK branch. A local user can trigger an XDP_TX transmit failure to cause a denial of service.
The issue occurs when sq->xmit_xdp_frame() returns false, such as when the XDPSQ is full, leaving DMA mappings and xdp_frame objects unreleased.
13) Use-after-free (CVE-ID: CVE-2026-53228)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to a use-after-free in the ipip6_tunnel_xmit() function in the SIT IPv6 tunneling implementation when handling GSO packets after offload processing. A local user can trigger transmission of a crafted packet to disclose sensitive information.
The issue occurs because a cached inner IPv6 header pointer may become stale if the skb head is moved during offload handling, and the stale pointer may later be used to read header fields.
14) NULL pointer dereference (CVE-ID: CVE-2026-53227)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an invalid pointer dereference in the openvswitch datapath flow command handler when handling crafted flow set operations after a reply skb allocation failure. A local user can trigger the error-handling path to cause a denial of service.
15) Out-of-bounds read (CVE-ID: CVE-2026-53223)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the generic timestamp cmsg path in net/socket.c when processing timestamped messages for AF_PACKET sockets. A local user can send or receive crafted packets on an AF_PACKET socket to disclose sensitive information.
Exploitation requires timestamping to be enabled, and information disclosure can occur when SO_RXQ_OVFL is enabled and a non-linear skb is processed.
16) Improper input validation (CVE-ID: CVE-2026-53221)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause traffic to be associated with the wrong tunnel.
The vulnerability exists due to improper input validation in vti6_tnl_lookup() when matching IPv6 VTI tunnels during fallback wildcard tunnel searches. A remote attacker can send network traffic that triggers a hash collision and incorrect tunnel selection to cause traffic to be associated with the wrong tunnel.
The issue occurs because candidate tunnels in the fallback search were not verified to actually use wildcard local or remote addresses.
17) NULL pointer dereference (CVE-ID: CVE-2026-53220)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in ebt_redirect_tg() in net/bridge/netfilter/ebt_redirect.c when reinjecting an NFQUEUE packet after bridge port state changes. A local user can remove or reassign the bridge port before reinjection to cause a denial of service.
The issue occurs if the bridge port is removed between the original hook invocation and NFQUEUE reinjection, and the device may also be moved to a different virtual device such as macvlan.
18) Information disclosure (CVE-ID: CVE-2026-53219)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper handling of partially failed copy_to_user operations in x_tables get-entries implementations when copying rule entries to userspace. A local user can provide a userspace buffer that faults during the initial header copy to disclose sensitive information.
On SMP kernels, the leaked value is the internal percpu counter allocation pointer. The issue affects the IPv4, IPv6, and ARP native and compat get-entries paths.
19) Use-after-free (CVE-ID: CVE-2026-53349)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to a use-after-free in netfilter nf_conntrack expectation handling when processing an expected connection after a NAT helper module has been unloaded. A local privileged user can unload a NAT helper module while live expectations remain and then trigger the expected connection to cause a denial of service.
Reaching the vulnerable state requires CAP_SYS_MODULE in the initial user namespace to remove a NAT helper that still has live expectations.
20) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-64112)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a time-of-check time-of-use race condition in the rbd lock_dwork handling in drivers/block/rbd.c when unmapping an image while exclusive lock work is being queued. A local user can trigger image unmap operations during concurrent I/O activity to cause a denial of service.
The issue can result in lock acquisition work executing after device and image release operations have freed or reset internal state.
21) Use-after-free (CVE-ID: CVE-2026-64073)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in irq_work_single() when synchronizing irq_work on PREEMPT_RT systems. A local user can trigger concurrent irq_work activity and free the work structure after BUSY is cleared to cause a denial of service.
The issue affects non-HARD irq_work processed by per-CPU kthreads on PREEMPT_RT.
22) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-63975)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of channel deletion during list iteration in l2cap_ecred_conn_rsp in the Bluetooth L2CAP subsystem when processing a crafted L2CAP credit-based connection response with an already-assigned destination CID. A remote attacker can send a specially crafted Bluetooth packet to cause a denial of service.
The issue occurs when a duplicate destination CID is received for an L2CAP extended credit based connection response.
23) Race condition (CVE-ID: CVE-2026-63974)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper synchronization in hci_dev_close_sync() in the Bluetooth HCI subsystem when closing a device during the reset path. A local user can trigger Bluetooth device reset and close operations to cause a denial of service.
24) Use-after-free (CVE-ID: CVE-2026-63802)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in __blkcg_rstat_flush() when releasing multiple blkgs in the same blkcg concurrently. A local user can trigger concurrent blkg release operations to cause a denial of service.
The race occurs when one blkg removes another blkg's iostat entries via llist_del_all() while the other blkg is still being processed.
25) Use-after-free (CVE-ID: CVE-2026-53359)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the KVM x86 shadow paging logic when changing a PDE mapping from outside the guest and deleting a memslot. A local user can trigger stale rmap entries and subsequent dereference of a freed sptep to cause a denial of service.
The issue occurs when a modified PDE points to a non-leaf page, causing a role mismatch between reused shadow pages for large 2MB mappings and new 4KB mappings.
26) Improper locking (CVE-ID: CVE-2026-53358)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper locking in l2cap_sock_cleanup_listen() when cleaning up listening L2CAP channels. A local user can trigger a race condition to cause a denial of service.
The issue involves incorrect lock ordering between conn->lock, chan->lock, and sk_lock during Bluetooth L2CAP channel cleanup.
27) Use-after-free (CVE-ID: CVE-2026-53357)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in l2cap_sock_cleanup_listen() and bt_accept_dequeue() in the Bluetooth L2CAP socket handling code when racing listen socket cleanup with a concurrent HCI disconnect. A local user can trigger a listen/close versus HCI-disconnect race to cause a denial of service.
The issue occurs during cleanup of not-yet-accepted child sockets on a listening socket.
28) Use of uninitialized resource (CVE-ID: CVE-2026-53218)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an uninitialized memory exposure in nft_exthdr_init and the nft_exthdr evaluation paths when processing a userspace request with the NFT_EXTHDR_F_PRESENT flag set and an invalid length value. A local user can supply a crafted netfilter expression that causes uninitialized stack data from nft_regs to be retained in registers and disclose sensitive information.
The issue occurs because the initialized register bitmap can mark more bytes as written than the evaluation paths actually store when the presence flag is used.
29) NULL pointer dereference (CVE-ID: CVE-2026-53337)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in bond_do_ioctl() when handling bonding ioctl requests with a non-existent slave interface name. A local privileged user can send a bonding ioctl request referencing a non-existent slave interface to cause a denial of service.
The issue is reachable from userspace through the bonding ioctl interface.
30) Use-after-free (CVE-ID: CVE-2026-53270)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to a use-after-free in the IPVS scheduler handling in ip_vs_edit_service() when editing a service and unbinding the old scheduler. A local privileged user can trigger service reconfiguration while packets are being scheduled to cause a denial of service.
The issue occurs because packets may continue using the old scheduler after its scheduling data has been freed following an RCU grace period.
31) Race condition (CVE-ID: CVE-2026-53269)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in the synproxy hook reference counting logic in netfilter when concurrently adding the first iptables target or nftables expression. A local user can trigger concurrent registration or teardown operations to cause a denial of service.
The issue affects on-demand netfilter hook registration performed by the SYNPROXY infrastructure from both iptables and nftables frontends.
32) Stack-based buffer overflow (CVE-ID: CVE-2026-53267)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to a stack-based buffer overflow in nft_ct_get_eval and nft_ct_get_fast_eval in the netfilter nft_ct subsystem when processing a crafted nftables rule that uses a template conntrack object. A local user can create a crafted rule sequence to cause memory corruption.
The issue is triggered when a conntrack template created by a preceding expression is treated as a real conntrack entry by a subsequent expression on the same skb.
33) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53266)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper memory handling in the ebtables SNAT target ARP sender hardware address rewrite in net/bridge/netfilter/ebt_snat.c when processing ARP packets in bridge netfilter hooks. A local user can trigger ARP sender hardware address rewriting on a crafted nonlinear skb to cause a denial of service.
Exploitation requires the ARP sender hardware address rewrite path to be reached with a nonlinear skb fragment backed by a splice-imported file page.
34) Use-after-free (CVE-ID: CVE-2026-53264)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the net/sched action lifecycle handling in act_api when NEWTFILTER and DELFILTER are run concurrently. A local user can trigger concurrent filter operations to cause a denial of service.
The issue arises from a race between action lookup and action deletion under RCU-protected access.
35) Use-after-free (CVE-ID: CVE-2026-53256)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in rfcomm_connect_ind() and rfcomm_get_sock_by_channel() when handling RFCOMM connection indications for a listener socket during a concurrent close. A remote attacker can trigger a race condition to cause a denial of service.
The issue occurs in the Linux kernel Bluetooth RFCOMM socket handling path when a listener socket is closed while a child socket is being queued, and KASAN reported the resulting slab-use-after-free in lock_sock_nested().
36) Out-of-bounds read (CVE-ID: CVE-2026-53255)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the tlv_data_is_valid() advertising data parser in net/bluetooth/mgmt.c when processing a crafted MGMT_OP_ADD_ADVERTISING request. A local user can send a specially crafted advertising data field to disclose sensitive information.
The issue is triggered when a malformed field length byte appears at the end of the supplied buffer.
37) Improper resource shutdown or release (CVE-ID: CVE-2026-46158)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in the mptcp path manager ADD_ADDR retransmission handling when retransmitting ADD_ADDR messages. A local user can trigger ADD_ADDR retransmissions to cause a denial of service.
38) Use-after-free (CVE-ID: CVE-2026-53000)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in netfilter nat hook operations when dumping active netfilter hooks from userspace or handling partial hook exposure on error paths. A local user can trigger hook inspection while freed hook operation structures are still referenced to cause a denial of service.
The issue affects nat hook registration and unregistration paths, including interaction with the nfnetlink hook dump subsystem.
39) Use-after-free (CVE-ID: CVE-2026-52991)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in pressure_write() in kernel/cgroup/cgroup.c when handling a write to a pressure cgroup file during concurrent cgroup file release. A local user can write crafted pressure data while racing cgroup file release to cause a denial of service.
The issue occurs because the of->priv pointer may be freed concurrently and later dereferenced.
40) Race condition (CVE-ID: CVE-2026-52988)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in nf_tables commit phase hook list handling in netfilter when publishing new hooks while concurrent netlink dump list traversal via rcu is in progress. A local user can trigger concurrent ruleset updates to cause a denial of service.
41) Out-of-bounds read (CVE-ID: CVE-2026-52967)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in symlink_data() in fs/smb/client/smb2file.c when parsing SMB error context data for symlink responses. A remote attacker can send a specially crafted SMB response to cause a denial of service or disclose sensitive information.
On 32-bit architectures, malformed ErrorDataLength values can also trigger an infinite loop.
42) Improper locking (CVE-ID: CVE-2026-52946)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper locking in fs/fcntl.c when handling TCP urgent data signaling for a process group. A remote attacker can send specially crafted TCP URG packets to cause a denial of service.
The issue occurs when FASYNC is configured for a process group.
43) Use-after-free (CVE-ID: CVE-2026-52943)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to a use-after-free in pskb_carve_inside_header() and pskb_carve_inside_nonlinear() when copying skb_shared_info for MSG_ZEROCOPY skbs. A local user can trigger repeated zerocopy skb operations to escalate privileges.
The issue is caused by copying the destructor_arg pointer into a new skb_shared_info without incrementing the associated zerocopy reference count, which can prematurely free ubuf_info_msgzc while transmit skbs still hold live references.
44) Improper access control (CVE-ID: CVE-2026-52909)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to move a fallback tunnel device to another network namespace.
The vulnerability exists due to improper access control in the ip6_vti fallback tunnel device initialization when initializing the per-network-namespace fallback device. A local user can move the ip6_vti0 device to another network namespace to move a fallback tunnel device to another network namespace.
The issue affects the per-netns fallback tunnel device ip6_vti0.
45) Improper access control (CVE-ID: CVE-2026-46302)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper access control in /sys/fs/selinux/policy when handling concurrent opens of the policy file. A local user can open the policy file and keep it open to cause a denial of service.
The issue can prevent other processes from reading the kernel policy.
46) Improper input validation (CVE-ID: CVE-2026-53003)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in the PPPoE frame handling in the Linux kernel when processing PPPoE frames with a compressed protocol field. A remote attacker can send a specially crafted PPPoE frame to cause a denial of service.
The issue can trigger unaligned access exceptions on some architectures because the PPP payload becomes shifted by one byte and the network header becomes 4-byte misaligned.
47) Improper access control (CVE-ID: CVE-2026-46054)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass SELinux access controls.
The vulnerability exists due to improper access control in SELinux overlayfs mmap() and mprotect() access checks when handling mmap() and mprotect() operations on overlayfs filesystems. A local user can map or change protections on an overlayfs file to bypass SELinux access controls.
48) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-45899)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in the ext4 extent status tree when splitting extents. A local user can trigger a split extent failure to cause a denial of service.
49) Resource exhaustion (CVE-ID: CVE-2026-45855)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in libata-scsi when issuing non-NCQ commands while NCQ commands are in flight on host adapters using multiple submission queues. A local user can issue non-NCQ commands under constant NCQ load to cause a denial of service.
The issue can result in very long delays or complete starvation of non-NCQ commands in the worst case.
50) Type Confusion (CVE-ID: CVE-2026-43456)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to type confusion in bond_setup_by_slave() when handling header operations for a bonded non-Ethernet slave device. A local user can enslave a non-Ethernet device such as a GRE tunnel to a bond and trigger packet transmission to cause a denial of service.
The issue is triggered because header callbacks from the slave device are invoked with the bond device context, causing device-specific private data to be interpreted as the wrong type.
51) Out-of-bounds read (CVE-ID: CVE-2026-43172)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in the SMEM parsing logic when processing firmware-reported LMAC configuration data. A local user can provide crafted firmware data to cause a denial of service.
Exploitation requires the firmware to report three LMACs, a condition that does not exist in hardware.
52) Improper locking (CVE-ID: CVE-2026-43115)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper locking in tiny SRCU when starting a grace period from call_srcu() while a scheduler lock is held. A local user can trigger call_srcu() in this state to cause a denial of service.
A use-after-free may also occur if queued irq_work executes after SRCU structure cleanup begins.
53) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43109)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper exception handling in shstk_pop_sigframe() when handling signal frames. A local user can trigger an error from mmap_read_lock_killable() to cause a denial of service.
54) Use-after-free (CVE-ID: CVE-2026-31663)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in xfrm_input_resume and transport_finish when processing packets after asynchronous crypto completion. A local user can trigger a race with device teardown to cause a denial of service.
55) Out-of-bounds write (CVE-ID: CVE-2026-53137)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in mod_hdcp_read_rx_id_list() when processing a malicious HDMI HDCP 2.x repeater ReceiverID list over I2C. An attacker with physical access can provide a malicious HDMI repeater that advertises an oversized message length to cause a denial of service.
The issue occurs during HDCP 2.x repeater authentication over HDMI.
56) Deadlock (CVE-ID: CVE-2026-53207)
CWE-ID: CWE-833 - Deadlock
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a recursive spinlock self-deadlock in get_huge_page_for_hwpoison() when handling concurrent madvise(MADV_HWPOISON) calls on the same hugetlb page while racing with a concurrent unmap. A local user can trigger concurrent madvise(MADV_HWPOISON) operations to cause a denial of service.
The issue occurs when folio_put() drops the folio reference count to zero while hugetlb_lock is still held, leading free_huge_folio() to attempt to re-acquire the same non-recursive lock.
57) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-53190)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a reference count leak in virtio_gpu_dma_fence_wait() when handling fence wait errors inside dma_fence_unwrap_for_each(). A local user can trigger an error during fence waiting to cause a denial of service.
58) Out-of-bounds read (CVE-ID: CVE-2026-53186)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in srp_process_rsp() when processing a crafted SRP_RSP response from an SRP target. A remote user can send a specially crafted SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len value to cause a denial of service.
Exploitation requires that the initiator is logged into a malicious or compromised SRP target on the InfiniBand or RoCE fabric.
59) Type Confusion (CVE-ID: CVE-2026-53184)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a type confusion in udp_read_skb() when processing UDP packets for a socket in a sockmap with an attached SK_SKB verdict program that performs a socket lookup. A remote attacker can send a specially crafted packet to cause a denial of service.
Exploitation requires a UDP socket to be in a sockmap and the attached verdict program to call a socket-lookup helper.
60) NULL pointer dereference (CVE-ID: CVE-2026-53177)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in the bnxt_io_error_detected error recovery path when handling PCIe error recovery on a closed NIC. A local user can trigger PCIe error recovery for a device whose bnapi state is not allocated to cause a denial of service.
The issue occurs because error recovery services may run on subordinate devices regardless of administrative state.
61) Out-of-bounds write (CVE-ID: CVE-2026-53176)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in isert_login_recv_done() and isert_rx_login_req() in drivers/infiniband/ulp/isert/ib_isert.c when processing a login PDU shorter than ISER_HEADERS_LEN. A remote attacker can send a specially crafted login send work request to cause a denial of service.
The vulnerable code path is reachable during the login phase before iSCSI authentication.
62) Use-after-free (CVE-ID: CVE-2026-53175)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in inet_frag_queue_flush() and fragment reassembly handling when processing fragmented network packets during network namespace teardown. A remote attacker can send fragmented packets and trigger reuse of a flushed fragment queue to cause a denial of service.
IPv6, nf_conntrack_reasm6, and 6lowpan reassembly share the same affected flush path.
63) Out-of-bounds read (CVE-ID: CVE-2026-53149)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in __tb_property_parse_dir() in the thunderbolt property parser when parsing a crafted root directory property block. A local user can supply a crafted property block to cause a denial of service.
64) Memory leak (CVE-ID: CVE-2025-71273)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a memory leak in rtw_register_hw() when handling error paths during supported band registration. A local user can trigger the vulnerable code path to cause a denial of service.
65) Heap-based buffer overflow (CVE-ID: CVE-2026-53136)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to a heap-based buffer overflow in get_integrated_info_v11() and get_integrated_info_v2_1() in the AMD display BIOS parser when parsing a malformed VBIOS during driver probe. A local user can provide a specially crafted VBIOS with oversized HDMI retimer register counts to cause a denial of service or execute arbitrary code.
Exploitation requires control over the VBIOS data consumed by the driver.
66) Use of Uninitialized Variable (CVE-ID: CVE-2026-53134)
CWE-ID: CWE-457 - Use of Uninitialized Variable
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to uninitialized memory exposure in the nft_fib IPv4/IPv6 evaluation logic when processing nftables fib expressions that use the OIFNAME result or an invalid NFTA_FIB_F_PRESENT combination. A local user can configure and trigger a crafted fib expression to disclose sensitive information.
The issue occurs because only part of the declared destination register span is written on certain evaluation paths, leaving stale kernel stack data available to a downstream expression that reads the full register span.
67) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-53132)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in virtio_transport_inc_rx_pkt() and the virtio vsock receive queue when processing crafted packets with zero-length payloads and the VIRTIO_VSOCK_SEQ_EOM flag. A local user can send a large number of specially crafted packets to cause a denial of service.
The issue occurs because queued packets may not increase the tracked byte count, allowing the receive queue to grow excessively.
68) Improper input validation (CVE-ID: CVE-2026-53131)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in netfilter Ethernet header handling when processing packets that reach ip6t_eui64, xt_mac, ipset bitmap:ip,mac, hash:ip,mac, hash:mac, or nf_log_syslog code paths without a valid Ethernet MAC header. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue occurs because these paths access eth_hdr(skb) after insufficient validation that the skb is associated with an Ethernet device and that a full MAC header is present.
69) Improper locking (CVE-ID: CVE-2026-53123)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper synchronization in the raid456 reshape handling in the md subsystem when suspending an md device during direct I/O across the reshape position. A local user can freeze reshape and write md/suspend_lo or md/suspend_hi to trigger a deadlock and cause a denial of service.
The issue occurs because I/O can wait for reshape progress while still holding an active_io reference, preventing suspend from completing if reshape is already frozen or interrupted.
70) Improper access control (CVE-ID: CVE-2026-53090)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass BPF verifier checks.
The vulnerability exists due to improper access control in the Linux kernel BPF verifier when analyzing ld_{abs,ind} instructions in subprograms. A local user can load a crafted BPF program to bypass BPF verifier checks.
The issue affects subprograms where ld_{abs,ind} instructions are permitted, including cases involving BTF-annotated subprograms with scalar return types.
71) Use-after-free (CVE-ID: CVE-2026-53072)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in hci_conn_request_evt() when handling deferred Bluetooth connection requests. A local user can trigger concurrent connection handling to cause a denial of service.
Only SCO deferred setup listen code paths are affected.
72) Race condition (CVE-ID: CVE-2026-53071)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.1 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt kernel memory.
The vulnerability exists due to a race condition in l2cap_ecred_reconf_rsp in the L2CAP subsystem when processing a crafted L2CAP ECRED reconfiguration response from a remote BLE device. A remote attacker can send a specially crafted L2CAP ECRED reconfiguration response to corrupt kernel memory.
Exploitation requires concurrent channel list iteration by another thread.
Remediation
Install update from vendor's website.