{"id":"CLSA-2026-1787304608","summary":"kernel-uek: Fix of 34 CVEs","details":"- Rebased onto Oracle UEK base 5.4.17-2136.357.2.el7uek\n- sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}\n- ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison {CVE-2026-53309}\n- ocfs2/dlm: validate qr_numregions in dlm_match_regions() {CVE-2026-53043}\n- ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}\n- ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 {CVE-2026-64114}\n- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}\n- fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}\n- scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}\n- crypto: authencesn - reject too-short AAD (assoclen\u003c8) to match ESP/ESN spec {CVE-2026-23060}\n- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}\n- net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}\n- scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}\n- i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}\n- Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}\n- ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}\n- can: raw: fix ro-\u003euniq use-after-free in raw_rcv() {CVE-2026-31532}\n- ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}\n- ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}\n- netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}\n- drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}\n- xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}\n- xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}\n- libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}\n- e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}\n- ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}\n- nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}\n- Squashfs: check metadata block offset is within range {CVE-2026-23388}\n- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}\n- wifi: mac80211: fix NULL deref in mesh_matches_local() {CVE-2026-23396}\n- icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}\n- HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}\n- net: usb: kalmia: validate USB endpoints {CVE-2026-23365}\n- wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}\n- drbd: fix \"LOGIC BUG\" in drbd_al_begin_io_nonblock() {CVE-2026-23356}\n- batman-adv: reject oversized global TT response buffers {CVE-2026-31659}\n- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}\n- net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}\n- ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}\n- nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}\n- usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}\n- media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}\n- sysctl: Fix data races in proc_douintvec(). {CVE-2022-49641}\n- netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}\n- ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}\n- atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}\n- fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}\n- usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}\n- crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}\n- KVM: x86: Reset IRTE to host control if *new* route isn't postable {CVE-2025-37885}\n- vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}\n- mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}\n- drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}\n- fou: remove warn in gue_gro_receive on unsupported protocol {CVE-2024-44940}\n- wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}\n- NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}\n- drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731}\n- scsi: mpi3mr: Sanitise num_phys {CVE-2024-42159}\n- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}\n- net: usb: rtl8150: fix memory leak on usb_submit_urb() failure {CVE-2025-71154}\n- net: sock: fix hardened usercopy panic in sock_recv_errqueue {CVE-2026-22977}\n- can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23061}\n- libceph: make free_choose_arg_map() resilient to partial allocation {CVE-2026-22991}\n- net/sched: sch_qfq: do not free existing class in qfq_change_class() {CVE-2026-22999}\n- ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() {CVE-2026-23089}\n- drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}\n- HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}\n- bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}\n- KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115}\n- tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}\n- media: xc2028: avoid use-after-free in load_firmware_cb() {CVE-2024-43900}\n- libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}\n- ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}\n- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}\n- net/rds: zero per-item info buffer before handing it to visitors {CVE-2026-52995}\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role {CVE-2026-53359}\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN {CVE-2026-46113}\n- net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}\n- RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043}\n- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued {CVE-2026-53163}\n- rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}\n- ipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038}\n- net: skbuff: fix missing zerocopy reference in pskb_carve helpers {CVE-2026-52943}\n- net: fix fanout UAF in packet_release() via NETDEV_UP race {CVE-2026-31504}\n- net: tap: NULL pointer derefence in dev_parse_header_protocol when skb-\u003edev is null {CVE-2022-50073}\n- ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err() {CVE-2026-43037}\n- batman-adv: hold claim backbone gateways by reference {CVE-2026-31657}\n- scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker {CVE-2026-63890}\n- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888}\n- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887}\n- smb: client: reject userspace cifs.spnego descriptions {CVE-2026-46243}\n- tun: free page on build_skb failure in tun_xdp_one() {CVE-2026-46322}\n- tap: free page on error paths in tap_get_user_xdp() {CVE-2026-46320}\n- tun: free page on short-frame rejection in tun_xdp_one() {CVE-2026-46321}\n- ptrace: slightly saner 'get_dumpable()' logic {CVE-2026-46333}\n- net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}\n- net: skbuff: preserve shared-frag marker during coalescing {CVE-2026-46300}\n- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}\n- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}\n- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193}\n- xfrm: esp: avoid in-place decrypt on shared skb frags {CVE-2026-43284}\n- crypto: algif_aead - Fix minimum RX size check for decryption {CVE-2026-43077}\n- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl {CVE-2026-43078}\n- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption {CVE-2026-43033}\n- crypto: algif_aead - snapshot IV for async AEAD requests {CVE-2026-46028}\n- crypto: algif_aead - Revert to operating out-of-place {CVE-2026-31431}\n- SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf {CVE-2025-71120}\n- net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}","modified":"2026-10-26T09:43:47.142239854Z","published":"2026-10-19T14:18:25Z","upstream":["CVE-2022-43945","CVE-2022-49641","CVE-2022-49900","CVE-2022-50073","CVE-2024-40929","CVE-2024-42159","CVE-2024-43900","CVE-2024-44940","CVE-2024-46724","CVE-2024-46731","CVE-2024-47745","CVE-2024-49991","CVE-2024-50073","CVE-2024-50115","CVE-2024-56664","CVE-2025-22083","CVE-2025-37885","CVE-2025-38068","CVE-2025-38556","CVE-2025-39760","CVE-2025-39866","CVE-2025-68285","CVE-2025-68349","CVE-2025-71075","CVE-2025-71093","CVE-2025-71116","CVE-2025-71120","CVE-2025-71154","CVE-2026-22977","CVE-2026-22991","CVE-2026-22999","CVE-2026-23060","CVE-2026-23061","CVE-2026-23074","CVE-2026-23089","CVE-2026-23193","CVE-2026-23216","CVE-2026-23318","CVE-2026-23356","CVE-2026-23365","CVE-2026-23367","CVE-2026-23381","CVE-2026-23382","CVE-2026-23388","CVE-2026-23396","CVE-2026-23397","CVE-2026-23398","CVE-2026-31399","CVE-2026-31402","CVE-2026-31405","CVE-2026-31431","CVE-2026-31452","CVE-2026-31504","CVE-2026-31532","CVE-2026-31581","CVE-2026-31597","CVE-2026-31598","CVE-2026-31602","CVE-2026-31657","CVE-2026-31659","CVE-2026-31778","CVE-2026-43020","CVE-2026-43027","CVE-2026-43033","CVE-2026-43037","CVE-2026-43038","CVE-2026-43040","CVE-2026-43050","CVE-2026-43077","CVE-2026-43078","CVE-2026-43088","CVE-2026-43089","CVE-2026-43158","CVE-2026-43206","CVE-2026-43284","CVE-2026-43370","CVE-2026-43427","CVE-2026-43450","CVE-2026-43499","CVE-2026-43503","CVE-2026-46028","CVE-2026-46043","CVE-2026-46113","CVE-2026-46116","CVE-2026-46243","CVE-2026-46300","CVE-2026-46320","CVE-2026-46321","CVE-2026-46322","CVE-2026-46331","CVE-2026-46333","CVE-2026-52943","CVE-2026-52995","CVE-2026-53043","CVE-2026-53163","CVE-2026-53166","CVE-2026-53309","CVE-2026-53359","CVE-2026-63887","CVE-2026-63888","CVE-2026-63890","CVE-2026-64103","CVE-2026-64113","CVE-2026-64114","CVE-2026-64266","CVE-2026-64298","CVE-2026-64564"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1787304608.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50073"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54518"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71120"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23074"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23318"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31399"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31402"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31504"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31598"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31657"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43033"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43038"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43077"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46028"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46043"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46113"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46116"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46300"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46320"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46322"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46331"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52943"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52995"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53043"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53309"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53359"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64103"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64113"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64114"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64266"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64298"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64564"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64600"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68480"}],"affected":[{"package":{"name":"bpftool","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/bpftool?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.17-2136.357.2.el7uek.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1787304608.json"}},{"package":{"name":"kernel-uek","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/kernel-uek?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.17-2136.357.2.el7uek.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1787304608.json"}},{"package":{"name":"kernel-uek-container","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/kernel-uek-container?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.17-2136.357.2.el7uek.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1787304608.json"}},{"package":{"name":"kernel-uek-container-debug","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/kernel-uek-container-debug?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.17-2136.357.2.el7uek.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1787304608.json"}},{"package":{"name":"kernel-uek-debug","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/kernel-uek-debug?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.17-2136.357.2.el7uek.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1787304608.json"}},{"package":{"name":"kernel-uek-debug-devel","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/kernel-uek-debug-devel?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.17-2136.357.2.el7uek.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1787304608.json"}},{"package":{"name":"kernel-uek-devel","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/kernel-uek-devel?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.17-2136.357.2.el7uek.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1787304608.json"}},{"package":{"name":"kernel-uek-headers","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/kernel-uek-headers?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.17-2136.357.2.el7uek.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1787304608.json"}},{"package":{"name":"kernel-uek-tools","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/kernel-uek-tools?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.17-2136.357.2.el7uek.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1787304608.json"}},{"package":{"name":"perf","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/perf?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.17-2136.357.2.el7uek.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1787304608.json"}},{"package":{"name":"python-perf","ecosystem":"TuxCare:OracleLinux:7","purl":"pkg:rpm/tuxcare/python-perf?distro=oraclelinux-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.17-2136.357.2.el7uek.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/oraclelinux7els/CLSA-2026-1787304608.json"}}],"schema_version":"1.9.0"}