SB2026092013 - openEuler 24.03 LTS SP3 update for kernel
Published: September 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 33 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2026-74747)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.
The vulnerability exists due to an out-of-bounds read in ip_vs_nat_icmp() when processing embedded IP headers in ICMP packets after copying header data into the skb head. A local user can modify the ihl field to trigger out-of-bounds access and disclose sensitive information, modify data, or cause a denial of service.
The issue occurs because the embedded header length was not revalidated after reading data from skb fragments.
2) Improper input validation (CVE-ID: CVE-2026-74544)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in the cls_u32 packet classifier when processing a crafted filter configuration with varoffset enabled. A local user can supply an out-of-range offshift value to trigger shift-out-of-bounds behavior and cause a denial of service.
Exploitation is possible by an unprivileged user via user or network namespaces.
3) Use-after-free (CVE-ID: CVE-2026-74565)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to use-after-free in nft_object lookup handling in nf_tables when accessing objects during net namespace event processing. A local user can trigger object lookup and destruction across tables to cause a denial of service or execute arbitrary code.
The issue arises because a global object name rhltable could expose objects being dismantled from the lookup path by another existing network namespace.
4) Race condition (CVE-ID: CVE-2026-74605)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in eventfs inode handling in fs/tracefs/event_inode.c when iterating over the SRCU-protected children list during inode freeing. A local user can trigger concurrent eventfs operations to cause a denial of service.
The issue occurs because a freed inode can be observed with its children list reused as an RCU head, causing iteration to read an invalid list target.
5) Race condition (CVE-ID: CVE-2026-74668)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an inconsistent use of hard_header_len in the tpacket_snd() transmit ring send path in net/packet/af_packet.c when processing tx ring frames during packet transmission. A local user can trigger concurrent netdevice reconfiguration and send crafted ring frames to cause a denial of service.
The issue can make the reserved headroom smaller than the amount later pushed, or make the computed copy length negative.
6) Race condition (CVE-ID: CVE-2026-74715)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in the BPF conntrack kfuncs when processing a shared map value for the opts argument during conntrack lookup or allocation. A local user can modify opts->netns_id concurrently to trigger an unmatched namespace reference release and cause a denial of service.
Exploitation requires the ability to invoke the affected BPF conntrack kfuncs with an opts argument that can reference a shared map value.
7) Out-of-bounds write (CVE-ID: CVE-2026-74724)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in ip_vs_nat_icmp when processing ICMP packets with a modified embedded IPv4 header length field. A local attacker can modify a packet while it is processed by IPVS to cause memory corruption.
8) Use-after-free (CVE-ID: CVE-2026-74730)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the NFS FREE_STATEID handling in fs/nfs/nfs4proc.c when processing a delayed FREE_STATEID operation. A local user can trigger a delayed FREE_STATEID operation to cause a denial of service.
9) NULL pointer dereference (CVE-ID: CVE-2026-74734)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in ar_context_release() in the firewire ohci driver when handling device probe error cleanup. A local attacker can trigger an early pci_probe() failure to cause a denial of service.
The issue occurs on the driver's error handling path before the asynchronous receive context has been successfully initialized.
10) Memory leak (CVE-ID: CVE-2026-74543)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a memory leak in udp_tunnel_nic_unregister() when handling failed device registration and netdevice unregister events. A local attacker can trigger device registration failure with queued work to cause a denial of service.
The issue occurs because a queued work item can cause the unregister path to return early, leaving a struct udp_tunnel_nic allocation permanently leaked.
11) Out-of-bounds write (CVE-ID: CVE-2026-80536)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in xlog_recover_do_reg_buffer() when processing a crafted XFS filesystem image during mount-time log recovery. A remote attacker can mount a specially crafted filesystem image to execute arbitrary code.
The issue is reachable during mount-time recovery on production kernels where the bounds check was enforced only by an ASSERT().
12) Improper locking (CVE-ID: CVE-2026-80549)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to improper locking in the vfio_ccw driver when handling a device transitioning to a not-operational state. A local privileged user can trigger this condition to cause a denial of service.
The cleanup may occur asynchronously while other locks are held in the calling sequence.
13) Improper input validation (CVE-ID: CVE-2026-80551)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.
The vulnerability exists due to improper input validation in the vfio_ccw channel program IDAW handling when reading the first IDAW and then processing the full IDAL. A remote attacker can trigger inconsistent IDAW reads to execute arbitrary code or cause a denial of service.
The issue affects the s390 vfio_ccw subsystem and arises because the first IDAW is read separately from the full IDAL.
14) Improper privilege management (CVE-ID: CVE-2026-80560)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to improper access control in restore_sigcontext() in the openrisc signal handling code when returning from a signal handler through a crafted sigframe. A local user can craft a sigframe that modifies privileged SR bits to escalate privileges.
By clearing SPR_SR_DME, data accesses can occur without MMU translation or protection, enabling read and write access to arbitrary physical memory.
15) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80611)
CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to improper handling of function tracing in acpi_idle_lpi_enter() and acpi_processor_ffh_lpi_enter() when entering an ACPI low power idle state with function tracing or Kprobes enabled. A local attacker can trigger idle-state entry on an affected system to cause a denial of service.
The issue is exposed only when function tracing or Kprobes is enabled.
16) Type conversion (CVE-ID: CVE-2026-80637)
CWE-ID: CWE-704 - Type conversion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of unaligned memory access in synproxy timestamp adjustment in netfilter synproxy when processing crafted TCP packets with timestamp options. A remote attacker can send specially crafted network packets to cause a denial of service.
The issue may lead to a crash on strict alignment architectures.
17) Use-after-free (CVE-ID: CVE-2026-80721)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the Bluetooth ISO socket handling in net/bluetooth/iso.c when deleting an ISO connection. A local user can trigger connection deletion while ISO sockets still access a dangling hcon reference to cause a denial of service.
The issue is related to races involving ISO connection teardown and stale hcon references.
18) NULL pointer dereference (CVE-ID: CVE-2026-64405)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in hci_abort_conn() when handling connection cancellation from the hci_rx_work() receive path. A local user can trigger a pending Bluetooth connection state to cause a denial of service.
The issue can lead to a general protection fault while a connection request is pending and hdev->sent_cmd is NULL.
19) Use-after-free (CVE-ID: CVE-2026-74520)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the IOMMUFD IOPF group handling logic when processing page fault groups during device detach or HWPT replacement. A local user can trigger fault handling and later access a freed group to cause a denial of service.
The issue occurs because an accepted group can remain referenced by the IOMMUFD deliver list or response xarray after being freed through the generic pending list.
20) Use-after-free (CVE-ID: CVE-2026-74509)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the Bluetooth HCI advertising command-sync paths in net/bluetooth/hci_sync.c when processing advertising termination events during extended advertising, scan response, or periodic advertising data handling. A local attacker can trigger a race condition to cause a denial of service.
The issue occurs because an adv_info pointer can be retained across an HCI command wait after the associated advertising instance is removed.
21) Deadlock (CVE-ID: CVE-2026-74375)
CWE-ID: CWE-833 - Deadlock
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper lock handling in md_handle_request() and the raid1/raid10 read error recovery path when resubmitting a split md cloned bio while the array is suspended. A local user can trigger read error recovery to cause a denial of service.
The issue occurs because an md cloned bio already holds an active_io reference before another reference is attempted.
22) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74356)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in vhost_get_avail_idx in the vhost subsystem when handling available ring entries with mergeable buffers enabled. A local user can trigger repeated processing of available entries to cause a denial of service.
The issue can lead to a host livelock when the guest is not making progress and notifications are re-enabled while entries remain in the ring.
23) Use-after-free (CVE-ID: CVE-2026-74289)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in fib_leaf_notify() and fib_info reference handling when dumping IPv4 fib_info entries under RCU during fib notifier processing. A local user can trigger network namespace cleanup or device reload operations that invoke affected fib notifier paths to cause a denial of service.
The issue was reported through the netdevsim notifier path, and IPv6 is not affected by the same condition.
24) Race condition (CVE-ID: CVE-2026-74268)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper state management in tcp_set_state() and tcp_call_bpf() when force-closing a child socket whose inherited sock_ops callback flags remain set after setup failure. A remote attacker can send network traffic that triggers child socket setup failure to cause a denial of service.
The issue occurs before the child socket is ever established and affects forced-close paths that reach tcp_done() without the expected socket lock.
25) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-72496)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper exception handling in bnxt_qplib_alloc_dpi when mapping device memory with ioremap. A local user can trigger an ioremap failure to cause a denial of service.
26) Race condition (CVE-ID: CVE-2026-72420)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a data race in break_stripe_batch_list() and raid5_make_request() in the md/raid5 subsystem when handling overlapping stripe I/O requests. A local user can submit crafted I/O that triggers the R5_Overlap flag race to cause a denial of service.
The issue can leave a task waiting on a bit indefinitely.
27) Memory leak (CVE-ID: CVE-2026-72413)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a memory leak in SCTP INIT handling in net/sctp/sm_statefuns.c when processing INIT chunks with unrecognized parameters. A remote attacker can send a specially crafted INIT chunk to cause a denial of service.
The issue occurs when err_chunk is allocated by sctp_verify_init() and is not freed on certain error and success return paths.
28) Improper access control (CVE-ID: CVE-2026-72247)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass connection counting limits.
The vulnerability exists due to improper access control in nf_conncount when processing connection tuples across conntrack zones. A remote attacker can send network traffic that creates connections with matching tuples in different zones to bypass connection counting limits.
The issue affects the tuple dedup logic in __nf_conncount_add(), where original-direction tuples are compared using an incorrect zone direction value.
29) Out-of-bounds write (CVE-ID: CVE-2026-72098)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in dm-verity fec calculation when processing erasure data during FEC decoding. A local user can trigger crafted corruption conditions to cause memory corruption.
The out-of-bounds write can occur when the erasure count exceeds the intended Reed-Solomon roots limit and the decoder writes past the end of the lambda array into the syndrome buffer.
30) Out-of-bounds write (CVE-ID: CVE-2026-68145)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in ifs_set_range_dirty() when processing a zero-length range. A local user can trigger a user buffer fault that results in copied == 0 during a write operation to cause a denial of service.
The issue is reachable from __iomap_write_end() when copy_folio_from_iter_atomic() returns 0 and the folio is already uptodate.
31) Race condition (CVE-ID: CVE-2026-68138)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition leading to use-after-free and double-free in qdisc_get_rtab() and qdisc_put_rtab() when processing concurrent RTM_NEWTFILTER requests that add flower filters with a police action carrying the same rate. A local user can send concurrent netlink filter configuration requests to cause a denial of service.
The corrupted qdisc_rate_table object is shared system-wide because the affected rate-table list is process-global rather than per-network-namespace.
32) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-68118)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of reset packets in tcp_check_req() when processing in-window RST segments in the SYN-RECEIVED request-socket path. A remote attacker can send a specially crafted non-exact RST packet to cause a denial of service.
The issue affects connection handling before a connection is fully established.
33) Race condition (CVE-ID: CVE-2026-68095)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in fuse_uring_do_register in fs/fuse/dev_uring.c when registering a FUSE io_uring ring entry while a connection abortion is occurring. A local user can trigger concurrent registration and connection abort operations to cause a denial of service.
The issue can leave the abort or unmount thread hung indefinitely in an unkillable state and may leak ring, queue, and entry objects.
Remediation
Install update from vendor's website.