{"id":"CLSA-2026-1789960079","summary":"kernel: Fix of 56 CVEs","details":"- usb: free iso schedules on failed submit {CVE-2026-64348}\n- udf: validate VAT header length against the VAT inode size {CVE-2026-64323}\n- USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}\n- USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}\n- USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}\n- USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}\n- can: bcm: restore op-\u003eflags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}\n- can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}\n- dm-log: fix a bitset_size overflow on 32bit machines {CVE-2026-72105}\n- scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}\n- dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}\n- netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}\n- phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}\n- ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 {CVE-2026-64114}\n- Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}\n- IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}\n- wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() {CVE-2026-68413}\n- Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}\n- sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}\n- net: slip: serialize receive against buffer reallocation {CVE-2026-68143}\n- pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}\n- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-53254}\n- net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}\n- netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986}\n- tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}\n- netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}\n- scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}\n- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}\n- Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}\n- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() {CVE-2026-31408}\n- ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}\n- RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186}\n- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}\n- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}\n- ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}\n- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}\n- RDMA/umad: Reject negative data_len in ib_umad_write() {CVE-2026-23243}\n- can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}\n- netfilter: xt_tcpmss: check remaining length before reading option length {CVE-2026-43190}\n- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}\n- netfilter: nf_conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}\n- scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}\n- drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() {CVE-2022-50185}\n- wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}\n- ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit {CVE-2019-15117}\n- vfs: introduce FMODE_UNSIGNED_OFFSET for allowing negative f_pos {CVE-2019-18675}\n- infiniband: fix a possible use-after-free bug {CVE-2018-14734}\n- phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}\n- Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}\n- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}\n- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}\n- netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}\n- ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err() {CVE-2026-43037}\n- btrfs: tree-checker: Enhance chunk checker to validate chunk profile {CVE-2019-19816}\n- atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}\n- scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}\n- usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}\n- btrfs: Don't submit any btree write bio if the fs has errors {CVE-2019-19377}\n- HID: make arrays usage and value to be the same {CVE-2021-0512}\n- Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}\n- ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5 {CVE-2026-64114}\n- netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}\n- ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err() {CVE-2026-43037}\n- dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}\n- ALSA: caiaq: fix stack out-of-bounds read in init_card\n- ext4: make sure bitmaps and the inode table don't overlap with bg descriptors {CVE-2018-10879}\n- ext4: always check block group bounds in ext4_init_block_bitmap() {CVE-2018-10879}\n- sctp: validate embedded INIT chunk and address list lengths in COOKIE_ECHO {CVE-2026-53224}\n- sctp: validate cached peer INIT chunk length in COOKIE_ECHO {CVE-2026-53246}","modified":"2026-10-26T09:43:10.115225201Z","published":"2026-09-21T03:08:55Z","upstream":["CVE-2018-10879","CVE-2018-14734","CVE-2019-15117","CVE-2019-18675","CVE-2019-19377","CVE-2019-19816","CVE-2021-0512","CVE-2022-49114","CVE-2022-50185","CVE-2023-52922","CVE-2023-52974","CVE-2025-38004","CVE-2025-71075","CVE-2026-23243","CVE-2026-23281","CVE-2026-23455","CVE-2026-31402","CVE-2026-31408","CVE-2026-43037","CVE-2026-43050","CVE-2026-43088","CVE-2026-43116","CVE-2026-43190","CVE-2026-43198","CVE-2026-43427","CVE-2026-45942","CVE-2026-46116","CVE-2026-46266","CVE-2026-52920","CVE-2026-52986","CVE-2026-52998","CVE-2026-53059","CVE-2026-53131","CVE-2026-53186","CVE-2026-53224","CVE-2026-53246","CVE-2026-53253","CVE-2026-53254","CVE-2026-53256","CVE-2026-53268","CVE-2026-53275","CVE-2026-64114","CVE-2026-64271","CVE-2026-64323","CVE-2026-64341","CVE-2026-64342","CVE-2026-64343","CVE-2026-64344","CVE-2026-64348","CVE-2026-68121","CVE-2026-68143","CVE-2026-68144","CVE-2026-68188","CVE-2026-68376","CVE-2026-68413","CVE-2026-68425","CVE-2026-72105"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1789960079.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10878"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14734"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15117"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18675"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19039"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19377"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19816"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49114"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50185"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2162"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52922"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52974"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71075"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23243"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23281"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23455"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31402"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31408"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43037"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43050"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43088"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43116"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43190"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43198"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43427"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45942"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46116"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46266"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52920"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52986"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52998"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53059"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53131"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53186"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53224"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53246"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53253"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53254"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53256"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53268"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53275"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64114"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64271"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64323"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64341"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64342"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64343"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64344"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64348"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68121"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68143"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68144"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68188"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68376"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68413"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68425"}],"affected":[{"package":{"name":"kernel","ecosystem":"TuxCare:CentOS:6","purl":"pkg:rpm/tuxcare/kernel?distro=centos-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.8.el6.tuxcare.els35"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos6els/CLSA-2026-1789960079.json"}},{"package":{"name":"kernel-abi-whitelists","ecosystem":"TuxCare:CentOS:6","purl":"pkg:rpm/tuxcare/kernel-abi-whitelists?distro=centos-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.8.el6.tuxcare.els35"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos6els/CLSA-2026-1789960079.json"}},{"package":{"name":"kernel-debug","ecosystem":"TuxCare:CentOS:6","purl":"pkg:rpm/tuxcare/kernel-debug?distro=centos-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.8.el6.tuxcare.els35"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos6els/CLSA-2026-1789960079.json"}},{"package":{"name":"kernel-debug-devel","ecosystem":"TuxCare:CentOS:6","purl":"pkg:rpm/tuxcare/kernel-debug-devel?distro=centos-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.8.el6.tuxcare.els35"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos6els/CLSA-2026-1789960079.json"}},{"package":{"name":"kernel-devel","ecosystem":"TuxCare:CentOS:6","purl":"pkg:rpm/tuxcare/kernel-devel?distro=centos-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.8.el6.tuxcare.els35"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos6els/CLSA-2026-1789960079.json"}},{"package":{"name":"kernel-doc","ecosystem":"TuxCare:CentOS:6","purl":"pkg:rpm/tuxcare/kernel-doc?distro=centos-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.8.el6.tuxcare.els35"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos6els/CLSA-2026-1789960079.json"}},{"package":{"name":"kernel-firmware","ecosystem":"TuxCare:CentOS:6","purl":"pkg:rpm/tuxcare/kernel-firmware?distro=centos-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.8.el6.tuxcare.els35"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos6els/CLSA-2026-1789960079.json"}},{"package":{"name":"kernel-headers","ecosystem":"TuxCare:CentOS:6","purl":"pkg:rpm/tuxcare/kernel-headers?distro=centos-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.8.el6.tuxcare.els35"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos6els/CLSA-2026-1789960079.json"}},{"package":{"name":"perf","ecosystem":"TuxCare:CentOS:6","purl":"pkg:rpm/tuxcare/perf?distro=centos-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.8.el6.tuxcare.els35"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos6els/CLSA-2026-1789960079.json"}},{"package":{"name":"python-perf","ecosystem":"TuxCare:CentOS:6","purl":"pkg:rpm/tuxcare/python-perf?distro=centos-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.32-754.35.8.el6.tuxcare.els35"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos6els/CLSA-2026-1789960079.json"}}],"schema_version":"1.9.0"}