SB2026110488 - openEuler 22.03 LTS SP4 update for kernel
Published: November 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 33 vulnerabilities.
1) Incorrect calculation (CVE-ID: CVE-2026-98254)
CWE-ID: CWE-682 - Incorrect Calculation
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt memory and transfer incorrect data during DMA operations.
The vulnerability exists due to incorrect address calculations in swiotlb_bounce() when performing partial DMA synchronization. A local user can trigger a partial synchronization with an address adjustment that crosses a page boundary to corrupt memory and transfer incorrect data during DMA operations.
A recorded lowmem address that is adjusted into highmem can also cause the lowmem path to pass a highmem address to phys_to_virt().
2) Out-of-bounds read (CVE-ID: CVE-2026-93806)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read out-of-bounds memory.
The vulnerability exists due to an out-of-bounds read in cfg80211_rx_assoc_resp() in the cfg80211 wireless subsystem when processing a short association response frame. A remote attacker can send a malformed association response frame to read out-of-bounds memory.
3) Resource exhaustion (CVE-ID: CVE-2026-93830)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper interrupt masking in the XGMAC2 stmmac driver when the DMA runs out of receive descriptors under heavy receive pressure. A remote attacker can generate heavy receive traffic to cause a denial of service.
4) Integer overflow (CVE-ID: CVE-2026-97421)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause incorrect page-size selection.
The vulnerability exists due to integer overflow in ib_umem_find_best_pgsz() in the RDMA/umem subsystem when handling a virtual address and length. A local user can provide values that trigger boundary conditions to cause incorrect page-size selection.
The issue is especially important on 32-bit systems.
5) Use-after-free (CVE-ID: CVE-2026-97901)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the generic netlink controller policy dump handling when advancing a pending policy dump. A local user can initiate and advance a policy dump to cause a denial of service.
Exploitation requires the target generic netlink family to be unregistered and its module unloaded while the dump remains pending.
6) Out-of-bounds read (CVE-ID: CVE-2026-98169)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose kernel memory to userspace.
The vulnerability exists due to an out-of-bounds read in smb3_enum_snapshots() in the Linux kernel SMB client when processing short server replies during snapshot enumeration. A remote attacker can supply a specially crafted SMB ioctl reply to disclose kernel memory to userspace.
The vulnerable path is reached when snapshot_array_size is smaller than GMT_TOKEN_SIZE. The exposed data comes from slab memory adjacent to the reply buffer.
7) Out-of-bounds read (CVE-ID: CVE-2026-98186)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read beyond the bounds of a kernel beacon buffer.
The vulnerability exists due to an out-of-bounds read in mwifiex_search_oui_in_ie() when processing RSN or WPA information elements in beacon or probe-response frames during scan-result parsing. A remote attacker can transmit a crafted information element with a pairwise-cipher count exceeding the element's available length to read beyond the bounds of a kernel beacon buffer.
8) Use-after-free (CVE-ID: CVE-2026-98196)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause access to freed kernel memory.
The vulnerability exists due to use-after-free in the brcmsmac driver's brcms_free_timer() function when freeing a timer while its delayed-work callback is still running. A local user can trigger this overlapping timer cleanup and callback execution to cause access to freed kernel memory.
The non-synchronous cancel_delayed_work() call returns without waiting for an already-running callback, which accesses the timer structure through container_of().
9) Use-after-free (CVE-ID: CVE-2026-98229)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause the kernel to dereference freed memory.
The vulnerability exists due to use-after-free in xfrm_input() when receive-side processing resets the packet's security path before the function finishes accessing the associated XFRM state. A remote attacker can send packets processed during concurrent deletion of the associated state to cause the kernel to dereference freed memory.
The race requires secpath_reset() to release the last state reference. Relevant paths include VTI receive processing, cross-network-namespace packets on XFRM interfaces, and the XFRM_MAX_DEPTH error path.
10) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2026-93167)
CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to incorrect stack offset handling in the C-SKY syscall trace path when tracing system calls with fifth or sixth arguments. A local user can trace a process executing a system call with five or six arguments to cause a denial of service.
The issue is limited to the C-SKY ABIv2 syscall trace path.
11) Use-after-free (CVE-ID: CVE-2026-98260)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in POSIX CPU timer cleanup during process execution and termination when a non-leader thread executes a program and a subsequent failure leaves a freed timer node queued. A local user can create and arm a per-thread CPU timer and trigger an execution failure after the thread ID exchange, followed by task reaping, to cause a denial of service.
The affected timer functionality requires CONFIG_POSIX_TIMERS to be enabled.
12) Incorrect comparison (CVE-ID: CVE-2026-98339)
CWE-ID: CWE-697 - Incorrect Comparison
CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a kernel warning.
The vulnerability exists due to incorrect BSS type comparison in cfg80211_update_assoc_bss_entry() when updating an associated access point's BSS entry after a channel change. A remote attacker can operate a rogue access point that switches to a channel containing an existing BSS entry with a mismatched advertised type to trigger a kernel warning.
The retained entry collides with the associated access point's entry in the BSS red-black tree during cfg80211_rehash_bss().
13) Use-after-free (CVE-ID: CVE-2026-98341)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a use-after-free in the kernel.
The vulnerability exists due to premature freeing of driver-owned scan requests in the cfg80211 scan completion handling when a wireless interface goes down while a scan is running. A local user can cause an interface to go down during an active scan to trigger a use-after-free in the kernel.
Scan cancellation is asynchronous, so the driver may still reference the request after cfg80211 has completed the scan towards userspace.
14) Use-after-free (CVE-ID: CVE-2026-98364)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a use-after-free in the kernel.
The vulnerability exists due to use-after-free in xfrm_bundle_create() and xfrm_create_dummy_bundle() when creating XFRM bundles concurrently with network device removal. A local user can race bundle creation against an RTM_DELLINK operation to trigger a use-after-free in the kernel.
The reported invalid read occurs in xfrm6_fill_dst() during an IPv6 UDP send operation.
15) Out-of-bounds read (CVE-ID: CVE-2026-98375)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to insufficient validation of the Ethernet header length in xen/netfront handle_incoming_queue() when processing backend-supplied receive packets. A local user can supply a packet whose first receive slot is shorter than ETH_HLEN and is followed by additional slots to cause a denial of service.
Exploitation requires control over the receive slot lengths supplied by the backend.
16) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98451)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to exhaust kernel resources and potentially cause a denial of service.
The vulnerability exists due to missing release of dentry references in the Linux kernel SMB client's cifs_atomic_open() function when opening an existing symbolic link with O_CREAT. A local user can repeatedly perform these opens on a CIFS filesystem to accumulate unreleased references and potentially cause a denial of service.
17) Out-of-bounds read (CVE-ID: CVE-2026-98454)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger out-of-bounds memory reads that may disclose sensitive information or cause a denial of service.
The vulnerability exists due to out-of-bounds reads in the Linux kernel SMB client's create-context and lease parsers when processing malformed SMB2/SMB3 create responses. A remote attacker can supply a crafted response from an SMB server with inconsistent context boundaries, data offsets, or data lengths to cause handlers to read beyond the current context or interpret unrelated bytes as file identifiers or lease data, potentially exposing sensitive information or causing a denial of service.
18) Use-after-free (CVE-ID: CVE-2026-64585)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in esd_usb_disconnect() and unlink_all_urbs() when handling USB device disconnect events. A local user can trigger a device disconnect condition to cause a denial of service.
The issue occurs because per-netdev private data embedded in the net_device allocation is dereferenced after free during teardown.
19) Use-after-free (CVE-ID: CVE-2026-90214)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a use-after-free condition.
The vulnerability exists due to improper error handling in xlnx_formatter_pcm_open() in the ASoC Xilinx formatter PCM driver when handling errors during PCM stream initialization. A local user can open a PCM stream that encounters a constraint setup error to trigger a use-after-free condition.
ALSA does not invoke the close callback when opening a stream fails.
20) Use-after-free (CVE-ID: CVE-2026-90151)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a use-after-free.
The vulnerability exists due to a use-after-free in the NFSv4 callback identifier IDR when an NFSv4.0 callback lookup occurs after a client allocation failure. A remote attacker can trigger an NFSv4.0 callback lookup using the stale callback identifier to trigger a use-after-free.
Exploitation requires an NFSv4.0 client allocation to fail after a callback identifier has been allocated.
21) Use-after-free (CVE-ID: CVE-2026-90116)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a use-after-free.
The vulnerability exists due to improper synchronization in the MTPAV driver's output timer teardown handling when an output timer callback runs during card teardown. A local user can cause output timer activity to overlap with card teardown to trigger a use-after-free.
22) Out-of-bounds read (CVE-ID: CVE-2026-89954)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information, modify data, or cause a denial of service through an out-of-bounds memory access.
The vulnerability exists due to improper bounds checking in the AFS v2 parser when parsing a crafted AFS v2 image. A remote attacker can supply an image with a footer offset or region count that exceeds expected bounds to disclose sensitive information, modify data, or cause a denial of service through an out-of-bounds memory access.
23) Race condition (CVE-ID: CVE-2026-89929)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to compromise confidentiality, integrity, and availability.
The vulnerability exists due to improper synchronization of TLB invalidation in KVM nested virtualization INVVPID emulation when a virtual machine is migrated between physical CPUs. A local user can cause L1 to migrate between physical CPUs while emulating INVVPID to compromise confidentiality, integrity, and availability.
24) NULL pointer dereference (CVE-ID: CVE-2026-89912)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in vgic_its_save_ite() in the KVM arm64 vgic-its component when saving ITS tables during virtual machine migration after processing MAPD, MAPTI, and MAPC with V=0 commands. A remote attacker can issue MAPD, MAPTI, and MAPC commands with V=0 in a guest to cause a denial of service.
The command sequence is architecturally unpredictable.
25) Out-of-bounds read (CVE-ID: CVE-2026-89786)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.
The vulnerability exists due to an out-of-bounds read in ext4_read_inline_dir() when processing inline directory entries during getdents64() calls. A remote attacker can cause the kernel to process an inline directory entry whose header extends beyond the inline buffer to disclose sensitive information and cause a denial of service.
26) Out-of-bounds read (CVE-ID: CVE-2026-89785)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to read beyond the allocated buffer.
The vulnerability exists due to an out-of-bounds read in ntfs_reparse_init() and ntfs_objid_init() when mounting a crafted NTFS filesystem image containing a malformed resident INDEX_ROOT attribute. A local privileged user can mount a crafted filesystem image to read beyond the allocated buffer.
Exploitation requires CAP_SYS_ADMIN.
27) Integer underflow (CVE-ID: CVE-2026-89476)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause an integer underflow.
The vulnerability exists due to improper tracking of outstanding stream reconfiguration request parameters in SCTP stream reconfiguration response handling when processing duplicate RECONF responses. A remote attacker can send duplicate RECONF responses to cause an integer underflow.
A cached RECONF chunk containing multiple request parameters must have another parameter still outstanding.
28) Race condition (CVE-ID: CVE-2026-80980)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause connection state inconsistencies.
The vulnerability exists due to a race condition in the connection state flags of struct smc_connection when processing received connection control messages concurrently with connection termination. A remote attacker can send connection control messages during concurrent connection termination to cause connection state inconsistencies.
29) Use-after-free (CVE-ID: CVE-2026-80932)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a use-after-free condition.
The vulnerability exists due to improper workqueue synchronization in virtio_vsock_remove() when removing a virtio vsock device. A local user can trigger device removal while dependent work items are queued to cause a use-after-free condition.
The race involves tx_work, send_pkt_work, and rx_work.
30) Memory leak (CVE-ID: CVE-2026-74719)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a memory leak in smc_llc_event_handler() when handling duplicate CONFIRM_LINK or ADD_LINK_CONT messages while a local LLC flow is active and a qentry is already pending. A remote attacker can send duplicate crafted messages to cause a denial of service.
The issue affects the SMC_LLC_CONFIRM_LINK and SMC_LLC_ADD_LINK_CONT handling path, while the response direction is not affected.
31) Out-of-bounds read (CVE-ID: CVE-2026-74295)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the hdac_hdmi_set_pin_port_mux() function when handling a written enumerated control value. A local user can supply an out-of-range enum value to disclose sensitive information.
32) Out-of-bounds read (CVE-ID: CVE-2026-72210)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in ntfs_mapping_pairs_decompress() when parsing crafted NTFS mapping pair data. A local user can provide a crafted NTFS attribute record to disclose sensitive information.
The issue is caused by off-by-one bounds checks when the parsed data extends exactly to the end of the attribute record.
33) Improper access control (CVE-ID: CVE-2026-72164)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to overwrite file data belonging to another inode.
The vulnerability exists due to improper allocation of occupied clusters in ocfs2_move_extent() and ocfs2_probe_alloc_group() when processing a non-auto OCFS2_IOC_MOVE_EXT operation with a user-supplied physical goal. A local user can supply a crafted occupied goal value to overwrite file data belonging to another inode.
The issue occurs when the supplied goal is at the end of the target block group or when the free-run start is miscalculated.
Remediation
Install update from vendor's website.