SB2026082039 - openEuler 24.03 LTS SP3 update for kernel
Published: August 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 24 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-52991)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in pressure_write() in kernel/cgroup/cgroup.c when handling a write to a pressure cgroup file during concurrent cgroup file release. A local user can write crafted pressure data while racing cgroup file release to cause a denial of service.
The issue occurs because the of->priv pointer may be freed concurrently and later dereferenced.
2) Use of uninitialized resource (CVE-ID: CVE-2026-53347)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to access of uninitialized data in the virtio-gpu driver removal path when removing or unbinding the driver with KMS disabled. A local user can trigger driver removal or unbinding to cause a denial of service.
Only configurations where the virtio-gpu driver is built with KMS disabled are affected.
3) Race condition (CVE-ID: CVE-2026-53314)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in the padata CPU hotplug callback handling when offlining a CPU. A local user can trigger CPU hotplug operations to cause a denial of service.
The issue occurs because the CPU offline callback was placed in a hotplug teardown state where failure is not allowed.
4) NULL pointer dereference (CVE-ID: CVE-2026-53313)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in dc_dmub_srv_log_diagnostic_data() and dc_dmub_srv_enable_dpia_trace() when handling error paths. A local user can trigger the vulnerable code path to cause a denial of service.
5) Resource exhaustion (CVE-ID: CVE-2026-53285)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in dcn32_enable_phantom_plane() when allocating phantom plane state during bandwidth validation. A local user can trigger allocation of a large dc_plane_state object to cause a denial of service.
The issue can lead to a kernel crash when memory allocation reaches the vmalloc path in a preemption-restricted context.
6) Use-after-free (CVE-ID: CVE-2026-53262)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to use-after-free in pppol2tp_ioctl() when processing ioctl requests while a concurrent socket close frees the associated l2tp_session after a controllable sleep during copy_from_user(). A local user can trigger a userfaultfd-assisted page fault sleep and race a socket close to dereference a stale session pointer to cause a denial of service or execute arbitrary code.
Exploitation requires local access to issue the ioctl and induce the race condition.
7) Heap-based buffer overflow (CVE-ID: CVE-2026-53196)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.
The vulnerability exists due to a heap-based buffer overflow in get_manuf_info() in the io_ti USB serial driver when processing a crafted USB device EEPROM descriptor. An attacker with physical access can connect a malicious USB device with a forged Size field to trigger the overflow and cause a denial of service or execute arbitrary code.
The out-of-bounds access is compounded because a checksum routine also iterates over the device-controlled length after the EEPROM data is read.
8) Out-of-bounds write (CVE-ID: CVE-2026-53194)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in klsi_105_prepare_write_buffer() when processing writes to the tty device. A local user can write bulk_out_size or more bytes to the tty to cause a denial of service.
The issue is triggered when the write fifo holds at least the full bulk-out buffer size, causing data to be copied starting two bytes into a 64-byte buffer.
9) NULL pointer dereference (CVE-ID: CVE-2026-53163)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in remove_waiter() in the rtmutex futex proxy locking path when handling FUTEX_CMP_REQUEUE_PI operations during deadlock detection or proxy lock acquisition. A local user can invoke crafted futex operations to cause a denial of service.
10) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-53114)
CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of a function call in the amd ibs nmi handler when processing perf events. A local user can create a perf event that triggers the unsafe call from nmi context to cause a denial of service.
The issue occurs when raw sampling is used for IBS perf events.
11) Improper access control (CVE-ID: CVE-2026-53053)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper access of device identifier data in clone_alias() in the AMD IOMMU subsystem when processing PCI DMA aliases. A local user can trigger alias cloning for a device to cause a denial of service.
Incorrect source device identifiers can cause wrong or stale device table entries to be propagated to an alias device.
12) Integer overflow (CVE-ID: CVE-2026-53015)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an integer truncation in the EROFS zmap logic when processing crafted EROFS filesystem metadata on 32-bit platforms. A local user can provide a specially crafted filesystem image to cause a denial of service.
Only 32-bit platforms are affected.
13) Use-after-free (CVE-ID: CVE-2026-43153)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in xfs_attr_leaf_hasname when handling attribute leaf lookups after read or lookup errors. A local user can trigger error conditions to cause a denial of service.
14) Improper resource shutdown or release (CVE-ID: CVE-2026-52990)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in fsnotify_recalc_mask() when handling concurrent mark attach and detach operations. A local user can trigger the race condition to cause a denial of service.
The issue can manifest as a hung task during unmount operations.
15) Race condition (CVE-ID: CVE-2026-52961)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in __ceph_build_xattrs_blob() and ceph xattr handling when processing concurrent xattr updates and capability grant handling. A local user can trigger stale blob size state to cause a denial of service.
The issue can lead to a kernel BUG in fs/ceph/xattr.c during Ceph xattr processing.
16) Out-of-bounds read (CVE-ID: CVE-2026-52953)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds access in domain_remove_dev_pasid() when closing a VFIO device and removing a device PASID for a blocked domain. A local user can trigger the affected code path to cause a denial of service.
The issue can be triggered when a QEMU process is terminated.
17) Integer overflow (CVE-ID: CVE-2026-52948)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to integer overflow in the I2C_TIMEOUT ioctl handler in i2c-dev when processing a user-supplied timeout value. A local user can supply a large timeout value to cause a denial of service.
The issue can corrupt the SMBus controller state machine and leave it in an unrecoverable state.
18) Race condition (CVE-ID: CVE-2026-52930)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in shared memory orphan cleanup in ipc/shm.c when cleaning up orphaned shared memory segments while attachment counts are updated concurrently. A local user can trigger concurrent shared memory attach and cleanup operations to cause a denial of service.
The issue occurs because shm_destroy_orphaned() may decide that an orphaned segment is unused before taking the object lock.
19) Use-after-free (CVE-ID: CVE-2026-52923)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in ipc_idr_alloc() in the checkpoint/restore SysV IPC allocation path when processing a request for the next SysV IPC id. A local user can request allocation beyond the valid IPC id range to cause a denial of service.
A subsequent walk of /proc/sysvipc/shm can dereference freed memory through a stale IDR entry.
20) Race condition (CVE-ID: CVE-2026-52918)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in bt_sock_poll() and the Bluetooth accept queue when polling Bluetooth sockets. A local user can trigger concurrent socket teardown and accept queue access to cause a denial of service.
The issue occurs because the accept queue is walked without synchronization while child teardown can unlink a socket and drop its last reference.
21) Improper access control (CVE-ID: CVE-2026-52908)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain write access to memory regions that were not properly pinned as writable.
The vulnerability exists due to improper access control in RDMA memory region re-registration handling when changing IB_MR_REREG_ACCESS from read-only to read-write. A local user can re-register a memory region with writable access to gain write access to memory regions that were not properly pinned as writable.
The issue occurs when a driver reuses an existing umem during memory region re-registration.
22) Race condition (CVE-ID: CVE-2026-46324)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in netfilter nf_tables netlink hooks when concurrent dumpers walk hook lists during hook unregistration. A local user can trigger concurrent netlink operations to cause a denial of service.
23) Race condition (CVE-ID: CVE-2026-46135)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a race condition in nvmet_tcp_handle_icreq() and target-side queue teardown when processing an initialization connection request and a connection close concurrently. A remote attacker can send an initialization connection request and immediately close the connection to cause a denial of service.
The issue can lead to a second kref_put() being issued on an already released queue.
24) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-43331)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of kcOV instrumentation state in machine kexec code when executing kexec on a KCOV-instrumented kernel. A local user can trigger a kexec operation to cause a denial of service.
Exploitation requires CONFIG_KEXEC and CONFIG_KCOV to be enabled simultaneously, and the issue is not relevant to 32-bit kernels.
Remediation
Install update from vendor's website.