SB2026080729 - openEuler 22.03 LTS SP4 update for kernel
Published: August 7, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 27 vulnerabilities.
1) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-63975)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of channel deletion during list iteration in l2cap_ecred_conn_rsp in the Bluetooth L2CAP subsystem when processing a crafted L2CAP credit-based connection response with an already-assigned destination CID. A remote attacker can send a specially crafted Bluetooth packet to cause a denial of service.
The issue occurs when a duplicate destination CID is received for an L2CAP extended credit based connection response.
2) Use-after-free (CVE-ID: CVE-2026-64560)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to a use-after-free in the posix CPU timers subsystem when handling a non-leader exec() race involving POSIX CPU timer deletion, setting, or rearming. A local user can trigger concurrent exec() and timer operations to execute arbitrary code.
The issue occurs when a TGID-targeted timer remains inherited across exec(), and can also cause user-visible transient -ESRCH errors or prevent timer rearming.
3) Out-of-bounds read (CVE-ID: CVE-2026-64496)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the iio event FIFO handling in drivers/iio/industrialio-event.c when reading from a newly created event file descriptor concurrently with FIFO reset. A local user can read from the file descriptor from another thread to disclose sensitive information.
Exploitation requires shared file descriptor table access between threads, creating a race window before the fd number is returned to userspace.
4) Out-of-bounds read (CVE-ID: CVE-2026-64456)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the virtio-rng driver copy_data() function when processing device-reported used.len values from a virtio-rng backend. A remote attacker can provide a specially crafted length value to disclose sensitive information.
The issue can leak adjacent guest-kernel slab contents through the guest RNG and can also be observed directly via /dev/hwrng. No guest userspace interaction is required for the initial out-of-bounds read to occur.
5) Use-after-free (CVE-ID: CVE-2026-64397)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a use-after-free in smb2_query_dir() and the ksmbd directory enumeration state when handling concurrent QUERY_DIRECTORY requests using the same file handle. A remote user can send concurrent QUERY_DIRECTORY requests on the same file handle to cause a denial of service.
The issue occurs because a pointer to stack-allocated private data is stored in shared readdir state and can be overwritten while an iterate_dir() callback is still using it.
6) Race condition (CVE-ID: CVE-2026-64378)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb() when unmounting a filesystem while switching inode writeback state. A local user can trigger a container exit or unmount operation during concurrent writeback activity to cause a denial of service.
The issue can lead to busy inodes after unmount and a subsequent use-after-free in writeback cleanup paths.
7) Deadlock (CVE-ID: CVE-2026-64374)
CWE-ID: CWE-833 - Deadlock
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a live lock condition in the linux kernel scheduler RT_PUSH_IPI logic when handling RT task migration and repeated inter-processor interrupts on non-PREEMPT_RT systems. A local user can trigger heavy networking activity and wake RT tasks to cause a denial of service.
The issue occurs on non-PREEMPT_RT systems when softirqs execute for long periods and prevent the target CPU from returning to task context.
8) Use-after-free (CVE-ID: CVE-2026-64362)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to use-after-free in the hid-lg-g15 driver work handling logic when a pending work item is triggered and the device is unplugged. An attacker with physical access can trigger a backlight cycle key event and disconnect the keyboard to cause a denial of service.
The issue is reachable as a race condition on device unplug for G15, G15 v2, and G510 models that initialize the work item.
9) Use-after-free (CVE-ID: CVE-2026-64341)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to use-after-free in the iowarrior USB driver when release() races with disconnect(). A local user can trigger device release and disconnection in a racing condition to cause a denial of service or execute arbitrary code.
Exploitation requires access to the affected USB device interface.
10) Out-of-bounds read (CVE-ID: CVE-2026-64299)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in regex_match_glob() glob matching in the tracing event filter subsystem when processing non-NUL-terminated string event fields. A local user can supply a crafted glob filter against such fields to disclose sensitive information.
One reported path reaches the issue from the xfs_lookup tracepoint, and the affected string fields may be dynamic char arrays copied without a trailing NUL byte.
11) Out-of-bounds write (CVE-ID: CVE-2026-64192)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in BPF_MAP_TYPE_INODE_STORAGE handling when creating and updating inode storage maps while the BPF LSM is uninitialized. A local privileged user can create and update a BPF_MAP_TYPE_INODE_STORAGE map to cause a denial of service.
This issue occurs when CONFIG_BPF_LSM is enabled but the BPF LSM is not enabled at boot time, causing the inode security blob offset to remain uninitialized and leading to a kernel panic during later RCU callback execution.
12) Out-of-bounds read (CVE-ID: CVE-2026-64191)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds read and out-of-bounds write in stub_xfer() in the i2c-stub driver when handling an I2C_SMBUS ioctl with I2C_SMBUS_I2C_BLOCK_DATA and an invalid block length. A local user can issue a crafted ioctl request with data->block[0] greater than 32 to cause a denial of service.
The issue affects the development and test i2c-stub driver, which is not built by default and must be loaded with a chip_addr= parameter.
13) Improper handling of exceptional conditions (CVE-ID: CVE-2026-64170)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of error pointers in the spi-qup DMA initialization logic when handling DMA setup failures during driver probe. A local user can trigger a DMA setup failure and subsequent probe error or driver unbind to cause a denial of service.
The issue can lead to dereferencing an error pointer or attempting to release a DMA channel a second time.
14) Double free (CVE-ID: CVE-2026-64118)
CWE-ID: CWE-415 - Double Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to double free in qed_cid_map_free() in the QLogic qed driver context management code when handling failed CID bitmap allocations. A local user can trigger the failing allocation path to cause a denial of service.
Exploitation requires device-specific setup to reach the affected allocation failure path.
15) Out-of-bounds read (CVE-ID: CVE-2026-31747)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds read in me4000_xilinx_download() when parsing a crafted firmware file. A local user can supply a specially crafted firmware file to cause a denial of service.
The issue occurs because the function reads a length value from the first 4 bytes of the firmware and then reads data from offset 16 onward without ensuring the supplied firmware is large enough to contain the declared data stream.
16) Improper input validation (CVE-ID: CVE-2026-63956)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause a denial of service or corrupt memory.
The vulnerability exists due to improper input validation in the cypress_m8 USB serial driver when processing a malicious USB device with a too-small interrupt-out endpoint max packet size. An attacker with physical access can connect a specially crafted USB device to cause a denial of service or corrupt memory.
The issue can be triggered if a device reports an interrupt-out endpoint max packet size smaller than eight bytes.
17) Out-of-bounds read (CVE-ID: CVE-2026-63888)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in iscsit_handle_text_cmd() when processing Text PDUs with DataDigest enabled. A remote user can send a specially crafted text request to cause a denial of service.
The issue is triggered when DataDigest is negotiated for the connection.
18) Double free (CVE-ID: CVE-2026-63888)
CWE-ID: CWE-415 - Double Free
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a double free in iscsit_handle_text_cmd() when handling a Text PDU with a bad DataDigest on connections using ErrorRecoveryLevel greater than 0. A remote user can send a specially crafted text request to cause a denial of service.
On hardened kernels the flaw can trigger a remote kernel BUG(), while on non-hardened kernels it can corrupt the slab freelist. A follow-up Text Request on the same ITT or session teardown can free the same pointer again.
19) Heap-based buffer overflow (CVE-ID: CVE-2026-63887)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in iscsi_encode_text_output() when processing iSCSI login text parameters. A remote attacker can send a specially crafted login request with many minimal key-value pairs to cause a denial of service.
The issue can be triggered by expansion of unknown keys into larger "NotUnderstood" response records during login negotiation.
20) Use-after-free (CVE-ID: CVE-2026-63827)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in aa_replace_profiles() during rawdata_list deduplication when processing policy replacement operations. A local user can trigger AppArmor profile replacement with crafted timing to cause a denial of service.
The issue occurs because entries can remain on the rawdata list after their profile reference count has reached zero and before deferred cleanup runs.
21) Out-of-bounds write (CVE-ID: CVE-2026-63825)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in inflate_fast() when processing IP payload compression data concurrently on multiple cpus. A local user can trigger concurrent execution of the vulnerable code path to cause a denial of service.
The issue occurs because global gcov counters can change between multiple loads during execution, producing inconsistent loop values.
22) Race condition (CVE-ID: CVE-2026-53400)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in the i2c adapter registration logic when looking up adapters by id during registration. A local user can trigger concurrent adapter lookup and registration activity to cause a denial of service.
The issue can lead to access to uninitialized adapter data, including NULL-pointer dereferences or use-after-free.
23) Use-after-free (CVE-ID: CVE-2026-53388)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in fuse_try_move_folio() in the FUSE subsystem when moving a page cache folio during FUSE read handling. A local user can trigger a race condition to cause a denial of service.
The issue occurs because the request is not re-locked on the success path, allowing request abortion to free fuse_io_args while subsequent copy logic still accesses it.
24) Use-after-free (CVE-ID: CVE-2026-53262)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to use-after-free in pppol2tp_ioctl() when processing ioctl requests while a concurrent socket close frees the associated l2tp_session after a controllable sleep during copy_from_user(). A local user can trigger a userfaultfd-assisted page fault sleep and race a socket close to dereference a stale session pointer to cause a denial of service or execute arbitrary code.
Exploitation requires local access to issue the ioctl and induce the race condition.
25) Integer overflow (CVE-ID: CVE-2026-53133)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to integer overflow in __rdma_block_iter_next() in the RDMA umem block iterator when reassembling split scatter-gather entries during IOMMU-backed mapping linearization. A local user can trigger processing of a very large mapped block to cause a denial of service.
The issue occurs for block sizes greater than or equal to 4G when a single large block is split across multiple scatter-gather entries.
26) Use-after-free (CVE-ID: CVE-2026-43497)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read and write freed kernel memory.
The vulnerability exists due to a use-after-free in the udlfb framebuffer mmap handling when replacing the framebuffer while a userspace mapping remains active and the device is later disconnected. A local user can trigger framebuffer reallocation through FBIOPUT_VSCREENINFO and then access stale mapped pages to read and write freed kernel memory.
Exploitation requires an existing userspace mmap of the framebuffer, and the stale mapping remains usable after USB disconnect.
27) Use-after-free (CVE-ID: CVE-2026-43459)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in snd_soc_dapm_stream_event() when handling delayed work during sound card unbind while a PCM stream is open. A local user can trigger a sound card unbind in this state to cause a denial of service.
The issue occurs because a PCM close path can schedule new delayed work after the earlier workqueue flush and before DAPM widgets are removed.
Remediation
Install update from vendor's website.