SB2026101649 - openEuler 24.03 LTS SP1 update for kernel
Published: October 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 23 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-80762)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the Bluetooth hci_update_event_filter_sync() accept-list handling when suspending a Bluetooth controller while an accept-list device is concurrently removed. A local user can trigger concurrent accept-list removal during a controller wait to cause a denial of service.
2) Unchecked Return Value (CVE-ID: CVE-2026-89749)
CWE-ID: CWE-252 - Unchecked Return Value
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an unchecked return value in event_test_stuff() when kthread creation fails. A local user can trigger a kthread creation failure that results in an error pointer being passed to kthread_stop() to cause a denial of service.
The failure can occur under memory pressure during the boot-time event self-test.
3) Use-after-free (CVE-ID: CVE-2026-89655)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a use-after-free condition.
The vulnerability exists due to use-after-free in __kick_flushing_caps() when processing FLUSH_ACK messages during cap flushing. A remote attacker can send a FLUSH_ACK message during cap flushing to trigger a use-after-free condition.
Exploitation requires the FLUSH_ACK to be processed after i_ceph_lock is released and before list iteration resumes.
4) Out-of-bounds write (CVE-ID: CVE-2026-89652)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause memory corruption.
The vulnerability exists due to improper bounds checking in the CephFS NFS-export get_name functions when processing LOOKUPNAME replies containing oversized dentry names. A remote user can return a specially crafted LOOKUPNAME reply to cause memory corruption.
The issue is reachable when a CephFS mount is re-exported over NFS.
5) Use-after-free (CVE-ID: CVE-2026-89637)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory leaks and use-after-free conditions.
The vulnerability exists due to use-after-free in the SMB client cifs_check_trans2() function when processing a malformed secondary TRANSACT2 response. A remote attacker can send a malformed secondary TRANSACT2 response to cause memory leaks and use-after-free conditions.
Exploitation requires that a valid primary TRANSACT2 response has already been received.
6) Integer overflow (CVE-ID: CVE-2026-89634)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an integer overflow in symlink_data() in fs/smb/client/smb2file.c when processing an SMB error context with a malformed ErrorDataLength value. A remote attacker can provide a crafted SMB error context to cause a denial of service.
7) Improper initialization (CVE-ID: CVE-2026-89618)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a false warning.
The vulnerability exists due to improper initialization in eventfs_inode list heads when eventfs_create_dir() fails due to memory pressure. A local user can trigger directory creation failure due to memory pressure to cause a false warning.
8) Improper locking (CVE-ID: CVE-2026-89598)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper locking in the ssd1307fb framebuffer driver when processing framebuffer damage callbacks while preemption is disabled. A local user can trigger a display update to cause a denial of service.
The issue affects SSD1307 framebuffer devices that use I2C transfers.
9) Use-after-free (CVE-ID: CVE-2026-80914)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a use-after-free.
The vulnerability exists due to use-after-free in the Bluetooth ISO iso_conn_ready function when handling a concurrently closed BIS listener socket. A local user can close a BIS listener socket concurrently with connection readiness processing to trigger a use-after-free.
10) Use-after-free (CVE-ID: CVE-2026-80864)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the RDMA/rxe responder resource handling when modifying IB_QP_MAX_DEST_RD_ATOMIC while the responder task is active. A local user can race the freeing and reallocation of rd_atomic resources to cause a denial of service.
11) Out-of-bounds write (CVE-ID: CVE-2026-80863)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in free_rd_atomic_resources() in the RXE RDMA driver when modifying a queue pair's max_dest_rd_atomic setting. A local user can modify a queue pair's max_dest_rd_atomic setting to cause a denial of service.
12) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-80786)
CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause inconsistent framebuffer console state.
The vulnerability exists due to improper state management in fb_set_var() callers when processing display mode changes through sysfs or driver code. A local user can invoke a display mode change to cause inconsistent framebuffer console state.
13) NULL pointer dereference (CVE-ID: CVE-2026-45943)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in z_erofs_decompress_pcluster() when processing inline data for ztailpacking pclusters during file reads. A local user can read a crafted erofs image to cause a denial of service.
The issue may occur if a fatal signal arrives while read_mapping_folio() is running.
14) Use-after-free (CVE-ID: CVE-2026-74594)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in kernel/sched/psi.c when destroying PSI cgroup triggers concurrently with scheduling poll work. A local user can trigger a race that leaves a poll timer pending on freed memory to cause a denial of service.
The issue occurs because a timer may be re-armed during teardown and later execute poll_timer_fn() after the associated group has been freed.
15) Out-of-bounds write (CVE-ID: CVE-2026-72252)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to out-of-bounds writes in the nft_pipapo_match handling in netfilter nft_set_pipapo when processing set element insertions after a prior memory allocation failure left a cloned match in an invalid state. A local user can trigger an allocation failure and then perform a subsequent insertion in the same batch to cause memory corruption.
The issue can also affect a subsequent transaction because a bad clone may persist when the abort callback is not executed after the initial failure.
16) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-53345)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of a warning condition in KVM memory dirty page tracking in virt/kvm/kvm_main.c when destroying a vCPU after certain SEV-ES VM-Exits without a subsequent KVM_RUN. A local user can trigger this condition to cause a denial of service.
The issue occurs in SEV-ES guest scenarios where KVM retains a writable mapping of a guest page across an exit to userspace.
17) Use-after-free (CVE-ID: CVE-2026-53272)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in z_erofs_decompress_kickoff() when racing I/O completion with filesystem unmount. A local user can trigger the race condition to cause a denial of service.
The issue involves access to sbi->sync_decompress after the superblock information has been freed during unmount.
18) Out-of-bounds read (CVE-ID: CVE-2026-53138)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an attacker with physical access to cause a denial of service or disclose sensitive information.
The vulnerability exists due to an out-of-bounds read and unbounded iteration in amd display bios_parser.c and bios_parser2.c record-chain walk loops when parsing a malformed VBIOS image during probe time. An attacker with physical access can provide a crafted VBIOS image missing the terminator record to cause a denial of service or disclose sensitive information.
The issue is triggered when the VBIOS record chain lacks the 0xFF terminator record or uses a zero-sized termination condition incorrectly.
19) Use-after-free (CVE-ID: CVE-2026-53129)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to use-after-free in mb_cache_destroy() and mb_cache_shrink_worker() when destroying an mbcache instance while scheduled shrink work is pending or running. A local privileged user can trigger the last put of a mounted ext2, ext4, or ocfs2 filesystem to cause a denial of service.
The issue is only reachable when the attacker can trigger teardown of the cache for a mounted filesystem.
20) Use-after-free (CVE-ID: CVE-2026-53118)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the vdpa driver_override handling in the vDPA bus match callback when probing a driver through __driver_attach(). A local user can trigger driver matching while the driver_override field is accessed without the device lock to cause a denial of service.
The issue occurs because the bus match callback is invoked without the device lock held during this code path.
21) Use-after-free (CVE-ID: CVE-2026-53115)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the fsl-mc bus driver_override handling when matching drivers during device probing. A local user can trigger driver matching on a device with a stale driver_override reference to cause a denial of service.
The issue occurs because the match callback may access driver_override without the device lock held during __driver_attach().
22) Use-after-free (CVE-ID: CVE-2026-45949)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the hwrng core when unregistering and registering hardware random number generator devices concurrently. A local user can trigger repeated register and unregister operations to cause a denial of service.
The issue is caused by a race condition involving the global hwrng_fill pointer and thread lifecycle handling.
23) Memory leak (CVE-ID: CVE-2026-45947)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a memory leak in amdgpu_acpi_enumerate_xcc() when handling an error from amdgpu_acpi_dev_init(). A local user can trigger the affected code path to cause a denial of service.
The issue occurs when amdgpu_acpi_dev_init() returns -ENOMEM.
Remediation
Install update from vendor's website.