SB2026090503 - openEuler 22.03 LTS SP4 update for kernel
Published: September 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 32 vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2026-64483)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.
The vulnerability exists due to an out-of-bounds read and out-of-bounds write in isight_packet() when processing crafted FireWire isochronous packets from a device on the bus during normal capture. An attacker with physical access can provide a malicious device that reports an oversized sample count to cause a denial of service or execute arbitrary code.
Exploitation requires a malicious or faulty Apple iSight device connected on the FireWire bus.
2) Out-of-bounds read (CVE-ID: CVE-2026-80557)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information, execute arbitrary code, or cause a denial of service.
The vulnerability exists due to an out-of-bounds read in decode_watchers() when processing a crafted obj_list_watch_response_t reply with struct_len set to 0. A remote attacker can send a specially crafted OSD response to disclose sensitive information, execute arbitrary code, or cause a denial of service.
Exploitation requires a malicious or compromised OSD and can be triggered when a kernel client invokes CEPH_OSD_OP_LIST_WATCHERS.
3) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80527)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper state management in __ceph_get_caps() when handling Ceph capability revocation and reacquisition. A remote attacker can trigger conflicting operations that leave stale mds_wanted state and cause a reader to wait indefinitely to cause a denial of service.
The issue occurs when a cap update requesting FILE_RD does not reach the MDS after mds_wanted has been raised, leaving the client without the wanted file read capability while local state still indicates it is wanted.
4) Use-after-free (CVE-ID: CVE-2026-74588)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a use-after-free in __sctp_outq_flush_rtx() and SCTP transport tracking when processing SCTP SACKs after transport removal. A remote user can send crafted SCTP control traffic to cause a denial of service.
Exploitation requires an SCTP association peer to trigger transport removal through ASCONF Delete-IP and then send a SACK that reneges on the TSN.
5) Out-of-bounds write (CVE-ID: CVE-2026-74499)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause a denial of service or execute arbitrary code.
The vulnerability exists due to out-of-bounds write in snd_usbmidi_akai_output() when processing MIDI output for a USB device advertising a tiny bulk-OUT endpoint. An attacker with physical access can connect a crafted USB device and trigger a write to the created MIDI device node to cause a denial of service or execute arbitrary code.
The issue is caused by a signed-to-unsigned conversion in the fill-loop bound calculation, making the loop continue writing past the end of the URB transfer buffer.
6) Improper resource shutdown or release (CVE-ID: CVE-2026-74397)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in mlx5_ib_alloc_transport_domain() when handling transport-domain allocation failures during loopback enablement. A local user can trigger an error path that leaks a transport domain to cause a denial of service.
The issue affects the IB/mlx5 driver in the Linux kernel.
7) NULL pointer dereference (CVE-ID: CVE-2026-74395)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT in drivers/infiniband/hw/mlx5/devx.c when handling devx subscribe-event requests and unwinding an error after eventfd acquisition fails. A local user can trigger the error path with a crafted subscribe-event request to cause a denial of service.
The issue occurs because the subscription object is linked into the pending list before fields needed by cleanup are initialized.
8) Integer overflow (CVE-ID: CVE-2026-74394)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in the immediate data length check in the RDMA/srpt subsystem when processing user-supplied immediate data received over the network. A remote attacker can send a specially crafted network request with an oversized length value to cause a denial of service.
The length field is user-controlled and may wrap the computed request size, bypassing the bounds check before a very large length is passed to sg_init_one().
9) Out-of-bounds read (CVE-ID: CVE-2026-74377)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause an out-of-bounds read.
The vulnerability exists due to an out-of-bounds read in rxe_resp_check_length() and copy_data() when processing a receive WQE from a shared queue buffer mapped into userspace. A local user can modify WQE fields such as num_sge or sge entries during processing to cause an out-of-bounds read.
The issue affects the non-SRQ queue pair receive path.
10) Use-after-free (CVE-ID: CVE-2026-74302)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to use-after-free in hci_unregister_dev() when a timeout fires during device teardown. A local user can trigger device teardown and a timer callback to dereference freed memory to cause a denial of service or execute arbitrary code.
The freed memory may include the hdev->reset function pointer.
11) Integer overflow (CVE-ID: CVE-2026-74297)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an integer overflow in set_rq_size() in the RDMA/mlx5 queue pair handling code when processing a user-provided rq_wqe_shift value. A local user can supply a crafted shift value to trigger undefined behavior and cause a denial of service.
12) Improper input validation (CVE-ID: CVE-2026-72188)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in ntfs_lookup_inode_by_name() when parsing directory index entries from a crafted NTFS image. A local user can supply a specially crafted NTFS image to cause a denial of service.
The issue arises because error-marked MFT references read from on-disk metadata are not validated before being returned to callers, which may then interpret a bogus pseudo-errno value.
13) Improper input validation (CVE-ID: CVE-2026-68425)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper state validation in the kernel-handled RMPP receive processing in IB MAD handling when processing unsolicited active RMPP DATA responses. A remote attacker can send a specially crafted unmatched RMPP response to cause a denial of service.
The issue occurs because receive-side reassembly could begin before the full TID and source address were verified against an outstanding send.
14) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68227)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource lifetime management in the cx231xx USB media driver when the driver is unbound from a USB interface without physical device disconnection. A local user can trigger driver unbind or reconfiguration conditions to cause a denial of service.
The issue can be triggered during probe deferral or configuration changes.
15) Use-after-free (CVE-ID: CVE-2026-68156)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the Ceph authorizer handling code when processing a rebuilt authorizer during a messenger reconnect. A local user can trigger an authorizer update that reallocates the buffer and then cause a reconnect to use a stale pointer to cause a denial of service.
The issue is triggered when a newer service ticket causes the authorizer to be rebuilt and the rebuilt authorizer no longer fits in the existing buffer.
16) Improper input validation (CVE-ID: CVE-2026-68155)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in ceph_monmap_decode() when processing a CEPH_MSG_MON_MAP monmap message. A remote attacker can send a specially crafted monmap advertising zero monitors to cause a denial of service.
The issue is triggered when the client later attempts to open a session with a monitor, causing an assertion in pick_new_mon() to fire.
17) Improper locking (CVE-ID: CVE-2025-40027)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper locking within the p9_fd_cancelled() function in net/9p/trans_fd.c. A local user can perform a denial of service (DoS) attack.
18) Use-after-free (CVE-ID: CVE-2026-64471)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the btusb driver probe error handling in drivers/bluetooth/btusb.c when handling Bluetooth USB controller registration failures and subsequent interface disconnection. A local attacker can trigger controller registration failure to cause a denial of service.
The issue can also result in a double-free when the sibling interfaces are eventually disconnected.
19) Out-of-bounds read (CVE-ID: CVE-2026-64450)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in the TIPC broadcast Gap ACK blocks handling in tipc_bcast_sync_rcv() when processing a crafted broadcast PROTOCOL/STATE_MSG. A remote attacker can send a specially crafted broadcast STATE_MSG with a malformed Gap ACK blocks record to cause a denial of service.
Exploitation requires a TIPC neighbour that has negotiated TIPC_GAP_ACK_BLOCK.
20) Use-after-free (CVE-ID: CVE-2026-64188)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in rmnet_dellink() and the rmnet endpoint handling in the Qualcomm rmnet driver when processing network packets on the receive path while an endpoint is being removed. A local user can trigger concurrent packet processing and endpoint deletion to cause a denial of service.
The stale read occurs when lockless RCU readers dereference the egress_dev pointer after the endpoint memory has been freed.
21) Race condition (CVE-ID: CVE-2026-64095)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in the batman-adv bridge loop avoidance subsystem when handling concurrent backbone gateway state changes and request tracking. A local user can trigger concurrent operations to cause a denial of service.
The issue stems from non-atomic updates to request state and the bla.num_requests counter across multiple concurrent code paths.
22) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-64089)
CWE-ID: CWE-195 - Signed to Unsigned Conversion Error
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an integer signedness error in batadv_send_my_tt_response() and batadv_tt_prepare_tvlv_local_data() when processing a translation table changeset length value larger than 32767. A local user can trigger the vulnerable code path to disclose sensitive information.
The issue occurs because a negative sign-extended length can cause a full-sized buffer to be allocated while only a small portion is populated, leaving the remaining bytes uninitialized.
23) Race condition (CVE-ID: CVE-2026-63971)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in sctp_wait_for_connect() in the SCTP socket implementation when waiting for an association to reach established state while another thread peels off the association to a new socket. A local user can trigger association migration during this window to cause a denial of service.
Exploitation requires concurrent access from another thread while the socket lock is dropped and re-acquired.
24) Improper access control (CVE-ID: CVE-2026-63914)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper access control in xfrm migrate notification handling in net/xfrm/xfrm_user.c and net/key/af_key.c when broadcasting successful XFRM_MSG_MIGRATE or SADB_X_MIGRATE events across network namespaces. A local user can trigger a migration notification from a non-init network namespace to disclose sensitive information.
An IKE daemon running in the initial network namespace may receive migration notifications originating from other network namespaces, including selector, old and new endpoint addresses, and the km_address.
25) Insufficient verification of data authenticity (CVE-ID: CVE-2026-63913)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper state validation in the TCP conntrack state machine in netfilter conntrack when processing a crafted SYN followed by an invalid-sequence RST packet. A remote attacker can send a specially crafted packet sequence to cause a denial of service.
The issue can prematurely terminate an active NAT entry by forcing the conntrack entry into the CLOSE state.
26) Use-after-free (CVE-ID: CVE-2026-63801)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in tipc_aead_decrypt_done in the TIPC crypto subsystem when processing crafted encrypted frames during asynchronous decryption. A remote attacker can send crafted encrypted frames to trigger a read from freed memory and cause a denial of service.
Exploitation requires the asynchronous decryption path to be used and can occur while the associated network namespace is being torn down.
27) Out-of-bounds read (CVE-ID: CVE-2026-53225)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in __sctp_rcv_asconf_lookup() in net/sctp/input.c when processing a truncated trailing ASCONF chunk containing a declared IPv6 address parameter. A remote attacker can send a specially crafted SCTP packet to disclose sensitive information.
The issue is reachable from the no-association lookup path.
28) Memory corruption (CVE-ID: CVE-2026-53199)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper memory access in netvsc_copy_to_send_buf() when copying skb fragments into the VMBus send buffer. A local user can trigger packet transmission with page-backed fragments to cause a denial of service.
The issue occurs on 32-bit x86 systems with CONFIG_HIGHMEM enabled when fragment pages reside above the LOWMEM boundary, and the fault happens on the transmit softirq path.
29) Out-of-bounds read (CVE-ID: CVE-2026-52955)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds access in crush_decode() when processing a CEPH_MSG_OSD_MAP message containing a crush map with mismatched bucket algorithm fields. A remote attacker can send a specially crafted CEPH_MSG_OSD_MAP message to cause a denial of service.
30) Out-of-bounds read (CVE-ID: CVE-2026-52917)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the SCTP sock_diag dump-one path when processing an exact association lookup after taking the socket lock on a stale association. A local user can trigger a stale association lookup to disclose sensitive information.
The issue occurs when association state is reaped or detached from the endpoint while the lookup path resumes after blocking on the socket lock.
31) Use-after-free (CVE-ID: CVE-2026-46208)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in tp_meter session handling during mesh teardown when processing tp_meter sessions as a mesh interface is being removed. A local user can trigger tp_meter activity during interface teardown to cause a denial of service.
32) Buffer overflow (CVE-ID: CVE-2025-40307)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory corruption within the exfat_allocate_bitmap() function in fs/exfat/balloc.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.