CVE-2026-63802
Security update for the Linux Kernel
Description
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries. Move the flush from __blkg_release() (RCU callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent flush's rcu_read_lock() section to complete before freeing.
Metrics
Reanalysis & status changes
Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.
- CVE Modified2026-08-17 05:17 UTC· 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- Affected: Linux, Linux → Linux, Linux
- New CVE Received2026-07-19 12:16 UTC· 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- Affected: Linux, Linux
- Description: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries. Move the flush from __blkg_release() (RCU callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent flush's rcu_read_lock() section to complete before freeing.
- Reference: https://git.kernel.org/stable/c/0ab5ee5a1badb58cbb2242617cb01a4972b1f2a2
- Reference: https://git.kernel.org/stable/c/5e5b7f2ef854936e95dceb6a2fdfefcb7152d2c6
Affected operating systems
linux
amazon / amazon_linux
linux
suse / basesystem_module15
linux
debian / debian_linux11.0
linux
debian / debian_linux12.0
linux
debian / debian_linux13.0
linux
suse / development_tools_module15
linux
redhat / enterprise_linux10.0
linux
redhat / enterprise_linux8.0
linux
redhat / enterprise_linux9.0
linux
redhat / enterprise_linux_aus8.4
linux
redhat / enterprise_linux_aus8.6
linux
redhat / enterprise_linux_eus10.0
linux
redhat / enterprise_linux_eus8.4
linux
redhat / enterprise_linux_eus9.4
linux
redhat / enterprise_linux_eus9.6
linux
redhat / enterprise_linux_tus8.6
linux
redhat / enterprise_linux_tus8.8
linux
redhat / enterprise_linux_update_services_for_sap_solutions8.6
linux
redhat / enterprise_linux_update_services_for_sap_solutions8.8
linux
redhat / enterprise_linux_update_services_for_sap_solutions9.0
linux
redhat / enterprise_linux_update_services_for_sap_solutions9.2
linux
opensuse / leap15.3
linux
opensuse / leap15.4
linux
opensuse / leap15.5
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
arista
cloudvision_agni2024.4.0 – 2025.2.2
arista
cloudvision_portal2024.2.0 – 2026.1.0
arista
velocloud_edge4.5.0 – 6.4.1
arista
velocloud_gateway
arista
velocloud_orchestrator
IBM
QRadar SIEM<7.5.0 UP15 IF06
redhat
openshift_container_platform4.12 – 4.12.89
redhat
openshift_container_platform4.13 – 4.13.66
redhat
openshift_container_platform4.14 – 4.14.65
redhat
openshift_container_platform4.15 – 4.15.64
redhat
openshift_container_platform4.16 – 4.16.61
redhat
openshift_container_platform4.17 – 4.17.53
redhat
openshift_container_platform4.18 – 4.18.40
redhat
openshift_container_platform4.19 – 4.19.30
redhat
openshift_container_platform4.20 – 4.20.21
redhat
openshift_container_platform4.21 – 4.21.14
redhat
openshift_container_platform
siemens
simatic_ax_runtime
suse
caas_platform
suse
enterprise_storage
suse
manager_proxy
suse
manager_retail_branch_server
suse
manager_server
suse
openstack_cloud
References & sources
- https://git.kernel.org/stable/c/d88541ffd56d62a61e77209080001eddd4d69815euvd
- https://git.kernel.org/stable/c/43f5b19fd190fea20d052bc84741b28031d5baa9euvd
- https://git.kernel.org/stable/c/5f4061f8225d18695e5afe9bbf1cb7bd673d7872euvd
- https://git.kernel.org/stable/c/e5a75bf026c686b91a7dc6f9c5caf5016745d1feeuvd
- https://git.kernel.org/stable/c/c4ea7d8907cf72b259bf70bd8c2e791e1c4ff70feuvd
- https://git.kernel.org/stable/c/76b94cbd32aacf36a641956385a852635c6802b9
- https://git.kernel.org/stable/c/c8e4e0c701d0192a2efb6df059c0f9e19678c23d
- https://git.kernel.org/stable/c/6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea
- https://git.kernel.org/stable/c/427ab81a811dab4bca9d19f82eec5847ae42646e
- https://git.kernel.org/stable/c/012d37a568bfbb2c9686f03ade75560bc7139956
- https://git.kernel.org/stable/c/30aae62e50b4e074a90a9a5e15246548fbdc1182
- https://git.kernel.org/stable/c/41fe0f7b84f0cb822ae10ab08592996a592b2a25
- https://git.kernel.org/stable/c/7d7c9f0fcd19c4d2f0164347c58d49cafa961b72euvd
- https://git.kernel.org/stable/c/11c1431d641e0e4e0529e96957995820600c7287euvd
- https://git.kernel.org/stable/c/012796f9541fcd0c1fa8ae4da7eb4d83931ef838euvd
- https://git.kernel.org/stable/c/7d94f155f354b961c598f71bafa804dceded513feuvd
- https://git.kernel.org/stable/c/6dd2d4ad9c8429523b1c220c5132bd551c006425euvd
- https://access.redhat.com/security/cve/CVE-2026-46145vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2482581issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46145.jsonx_sadp-csaf-vex
Linked CVEs
- CVE-2026-64600
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink…
highCVSSv3 7.8 - CVE-2026-64564
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sc…
criticalCVSSv3 9.8 - CVE-2026-64561
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages a…
mediumCVSSv3 5.5 - CVE-2026-64560
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wong…
highCVSSv3 7.8 - CVE-2026-64530
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf…
highCVSSv3 7.0 - CVE-2026-64189
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The…
highCVSSv3 7.1 - CVE-2026-64106
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_even…
criticalCVSSv3 9.0 - CVE-2026-63994
In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_buil…
criticalCVSSv3 9.8 - CVE-2026-63984
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rp…
criticalCVSSv3 9.8 - CVE-2026-63975
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dci…
highCVSSv3 8.8 - CVE-2026-63971
In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctp_wait_for_connect and peeloff sctp_wait_…
highCVSSv3 7.8 - CVE-2026-63968
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_select_path() Found while…
highCVSSv3 7.5 - CVE-2026-63952
In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEAL_WRITE When SEAL_E…
highCVSSv3 8.4 - CVE-2026-63946
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn…
highCVSSv3 8.8 - CVE-2026-63924
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_j…
criticalCVSSv3 9.8 - CVE-2026-63922
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv()…
criticalCVSSv3 9.8 - CVE-2026-63921
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
highCVSSv3 8.8 - CVE-2026-63919
In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Trans…
highCVSSv3 8.8 - CVE-2026-63917
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink().
highCVSSv3 8.8 - CVE-2026-63912
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-…
criticalCVSSv3 9.8 - CVE-2026-63893
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()…
highCVSSv3 8.1 - CVE-2026-63884
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm o…
highCVSSv3 7.8 - CVE-2026-63829
In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelin…
highCVSSv3 8.2 - CVE-2026-63826
In the Linux kernel, the following vulnerability has been resolved: fbdev: fix use-after-free in store_modes() store_modes() replaces a…
highCVSSv3 7.1
Show 52 more CVEs
- CVE-2026-63824
In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl_pkey_params_get_2() The length for the…
criticalCVSSv3 9.8 - CVE-2026-63807
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapp…
highCVSSv3 8.8 - CVE-2026-63806
In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with…
highCVSSv3 7.3 - CVE-2026-63794
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In…
highCVSSv3 7.8 - CVE-2026-53402
In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font…
highCVSSv3 7.1 - CVE-2026-53391
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs…
mediumCVSSv3 5.5 - CVE-2026-53388
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_mo…
highCVSSv3 7.8 - CVE-2026-53375
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that on…
highCVSSv3 7.5 - CVE-2026-53354
In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI errata on various Arm CPUs A number of…
highCVSSv3 7.1 - CVE-2026-53324
In the Linux kernel, the following vulnerability has been resolved: net: mana: Use pci_name() for debugfs directory naming Use pci_name…
mediumCVSSv3 5.5 - CVE-2026-53297
In the Linux kernel, the following vulnerability has been resolved: net: mana: Guard mana_remove against double invocation If PM resume…
mediumCVSSv3 5.5 - CVE-2026-53267
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: bail out on template ct in get eval I noticed th…
highCVSSv3 7.8 - CVE-2026-53262
In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol…
highCVSSv3 7.8 - CVE-2026-53250
In the Linux kernel, the following vulnerability has been resolved: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata(…
highCVSSv3 7.8 - CVE-2026-53246
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processi…
criticalCVSSv3 9.8 - CVE-2026-53224
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cooki…
criticalCVSSv3 9.1 - CVE-2026-53177
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix NULL pointer dereference PCIe errors detected by a Roo…
mediumCVSSv3 5.5 - CVE-2026-53131
In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t…
criticalCVSSv3 9.4 - CVE-2026-53129
In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work before destroying the cache mb_cache…
mediumCVSSv3 5.5 - CVE-2026-53050
In the Linux kernel, the following vulnerability has been resolved: quota: Fix race of dquot_scan_active() with quota deactivation dquo…
highCVSSv3 7.8 - CVE-2026-52986
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsaf…
criticalCVSSv3 9.8 - CVE-2026-52967
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix possible infinite loop and oob read in symlink_data(…
highCVSSv3 8.1 - CVE-2026-46333
In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of…
highCVSSv3 7.1 - CVE-2026-46324
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use list_del_rcu for netlink hooks nft_netdev…
highCVSSv3 7.8 - CVE-2026-46323
In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently co…
highCVSSv3 7.8 - CVE-2026-46243
A privilege escalation vulnerability was found in the Linux kernel's CIFS client implementation.
highCVSSv3 7.8 - CVE-2026-46193
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah: account for ESN high bits in async callbacks AH allocates…
mediumCVSSv3 5.5 - CVE-2026-46174
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2'…
highCVSSv3 8.8 - CVE-2026-46145
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash…
highCVSSv3 7.8 - CVE-2026-46144
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Sashiko poin…
mediumCVSSv3 5.5 - CVE-2026-46126
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rs…
mediumCVSSv3 5.5 - CVE-2026-46117
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rs…
highCVSSv3 7.8 - CVE-2026-46109
In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix memory leak on ulpi_register() error paths Commit 01…
mediumCVSSv3 5.5 - CVE-2026-46084
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: Disable RX steering on RSS QP destroy When an RSS QP…
highCVSSv3 7.1 - CVE-2026-46080
In the Linux kernel, the following vulnerability has been resolved: ocfs2: split transactions in dio completion to avoid credit exhausti…
highCVSSv3 7.1 - CVE-2026-46056
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci…
highCVSSv3 8.8 - CVE-2026-45904
In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH eve…
mediumCVSSv3 5.5 - CVE-2026-43475
In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT This resol…
—CVSSv3 0.0 - CVE-2026-43440
In the Linux kernel, the following vulnerability has been resolved: net/mana: Null service_wq on setup error to prevent double destroy…
—CVSSv3 0.0 - CVE-2026-43276
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroy_workqueue on service rescan PCI path…
—CVSSv3 0.0 - CVE-2026-43056
In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in add_adev() error path If auxiliary…
highCVSSv3 7.8 - CVE-2026-43046
In the Linux kernel, the following vulnerability has been resolved: btrfs: reject root items with drop_progress and zero drop_level [BU…
—CVSSv3 0.0 - CVE-2026-43033
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-pla…
highCVSSv3 7.8 - CVE-2026-31759
In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix double free in ulpi_register_interface() error path…
—CVSSv3 0.0 - CVE-2026-31628
In the Linux kernel, the following vulnerability has been resolved: x86/CPU: Fix FPDSS on Zen1 Zen1's hardware divider can leave, under…
mediumCVSSv3 5.5 - CVE-2026-31598
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible deadlock between unlink and dio_end_io_write oc…
highCVSSv3 7.5 - CVE-2026-31542
In the Linux kernel, the following vulnerability has been resolved: x86/platform/uv: Handle deconfigured sockets When a socket is decon…
—CVSSv3 0.0 - CVE-2026-31483
In the Linux kernel, the following vulnerability has been resolved: s390/syscalls: Add spectre boundary for syscall dispatch table The…
highCVSSv3 7.8 - CVE-2026-31482
In the Linux kernel, the following vulnerability has been resolved: s390/entry: Scrub r12 register on kernel entry Before commit f33f2d…
highCVSSv3 7.1 - CVE-2026-31431Actively exploited
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly r…
criticalCVSSv3 7.8 - CVE-2025-54518
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instruct…
highCVSSv3 7.0 - CVE-2023-2058
A vulnerability was found in EyouCms up to 1.6.2.
lowCVSSv3 2.4