SB20260925214 - openEuler 20.03 LTS SP4 update for kernel
Published: September 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-52924)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the SCTP outqueue and stream scheduler state handling when processing a stale COOKIE-ECHO condition. A remote attacker can send a stale cookie error during SCTP association handling to cause a denial of service.
The issue occurs when an association is rolled back from COOKIE_ECHOED to COOKIE_WAIT, leaving scheduler state referencing freed stream entries.
2) Use-after-free (CVE-ID: CVE-2026-72322)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in the IPv6 MLD delayed work handling in net/ipv6/mcast.c when processing incoming MLD queries during device teardown. A remote attacker can send crafted MLD query traffic to trigger a kernel panic and cause a denial of service.
The issue arises from a race condition between device destruction and packet receive processing under RCU protection.
3) Race condition (CVE-ID: CVE-2026-74398)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a race condition in addrconf_dad_failure in the IPv6 address configuration subsystem when handling duplicate address detection failure processing concurrently with IPv6 address deletion. A local attacker can trigger concurrent state transitions to cause a denial of service.
The issue can lead to a general protection fault when a deleted IPv6 address entry is processed a second time through scheduled DAD work.
4) Out-of-bounds write (CVE-ID: CVE-2026-74597)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory.
The vulnerability exists due to an out-of-bounds write in ip6ip6_err() and the IPv6 ICMP error reply path when processing a quoted inner IPv6 packet after cloning an outer IPv6 ICMP error skb with stale inet6_skb_parm metadata. A remote attacker can send a specially crafted IPv6 packet to corrupt memory.
Exploitation requires the outer packet to carry a Home Address Option and a malformed inner destination-options header.
5) Race condition (CVE-ID: CVE-2026-74662)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a race condition in inet_frag_create() and the fragment queue timer handling in net/ipv4/inet_fragment.c when processing fragmented packets with a zero or negative fragment timeout. A remote attacker can send specially crafted fragmented network traffic to cause a denial of service.
The issue occurs because the timer may run before the queue is published in the fqdir rhashtable, which can leave a stale hash node after reference handling becomes unbalanced.
6) Use-after-free (CVE-ID: CVE-2026-74743)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a use-after-free in the macvlan network device handling in drivers/net/macvlan.c when processing packets on a macvlan device backed by a lower device that requires additional headroom or tailroom. A remote attacker can send network traffic that triggers insufficient buffer space handling to execute arbitrary code.
The issue can be triggered when the lower device requires extra header or trailer space, such as with macsec, ipsec, wireguard, tunnels, or veth with rx headroom.
7) Use-after-free (CVE-ID: CVE-2026-74744)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a use-after-free in the ipvlan network device component when handling packet header and tailroom requirements inherited from the underlying physical device. A remote attacker can trigger packet processing that causes insufficient headroom or tailroom reservation to execute arbitrary code.
The issue can occur when the underlying physical or stacked lower device requires extra headroom or tailroom for headers or trailers.
8) Use-after-free (CVE-ID: CVE-2026-80737)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to a use-after-free in the AMBA PL011 serial driver's DMA shutdown handling when DMA activity is being terminated. A local user can trigger DMA shutdown while TX callbacks or RX polling remain active to cause memory corruption.
9) Out-of-bounds write (CVE-ID: CVE-2026-89729)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause an out-of-bounds write.
The vulnerability exists due to an out-of-bounds write in sensor_hub_get_feature() when processing a malicious HID descriptor. An attacker with physical access can provide a HID descriptor advertising a large feature field size to cause an out-of-bounds write.
An IIO caller supplying a small stack buffer can be affected.
Remediation
Install update from vendor's website.