CVE-2026-53256
Security update for the Linux Kernel
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock, but returns the selected listener after dropping that lock without taking a reference. rfcomm_connect_ind() then locks the listener, queues a child socket on it, and may notify it after unlocking it. The buggy scenario involves two paths, with each column showing the order within that path: rfcomm_connect_ind(): listener close: 1. Find parent in 1. close() enters rfcomm_get_sock_by_channel() rfcomm_sock_release(). 2. Drop rfcomm_sk_list.lock 2. rfcomm_sock_shutdown() without pinning parent. closes the listener. 3. Call lock_sock(parent) and 3. rfcomm_sock_kill() bt_accept_enqueue(parent, unlinks and puts parent. sk, true). 4. Read parent flags and may 4. parent can be freed. call sk_state_change(). If close wins the race, parent can be freed before rfcomm_connect_ind() reaches lock_sock(), bt_accept_enqueue(), or the deferred-setup callback. Take a reference on the listener before leaving rfcomm_sk_list.lock. After lock_sock() succeeds, recheck that it is still in BT_LISTEN before queueing a child, cache the deferred-setup bit while the parent is locked, and drop the reference after the last parent use. KASAN reported a slab-use-after-free in lock_sock_nested() from rfcomm_connect_ind(), with the freeing stack going through rfcomm_sock_kill() and rfcomm_sock_release().
Metrics
Affected operating systems
linux
amazon / amazon_linux
linux
suse / basesystem_module15
linux
debian / debian_linux11.0
linux
debian / debian_linux12.0
linux
debian / debian_linux13.0
linux
suse / development_tools_module15
linux
redhat / enterprise_linux10.0
linux
redhat / enterprise_linux8.0
linux
redhat / enterprise_linux9.0
linux
redhat / enterprise_linux_aus8.4
linux
redhat / enterprise_linux_aus8.6
linux
redhat / enterprise_linux_eus10.0
linux
redhat / enterprise_linux_eus8.4
linux
redhat / enterprise_linux_eus9.4
linux
redhat / enterprise_linux_eus9.6
linux
redhat / enterprise_linux_tus8.6
linux
redhat / enterprise_linux_tus8.8
linux
redhat / enterprise_linux_update_services_for_sap_solutions8.6
linux
redhat / enterprise_linux_update_services_for_sap_solutions8.8
linux
redhat / enterprise_linux_update_services_for_sap_solutions9.0
linux
redhat / enterprise_linux_update_services_for_sap_solutions9.2
linux
opensuse / leap15.3
linux
opensuse / leap15.4
linux
opensuse / leap15.5
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
AMD
ProzessorEPYC Series
AMD
ProzessorRyzen
arista
cloudvision_agni2024.4.0 – 2025.2.2
arista
cloudvision_portal2024.2.0 – 2026.1.0
arista
velocloud_edge4.5.0 – 6.4.1
arista
velocloud_gateway
arista
velocloud_orchestrator
Dell
NetWorkerVirtual Edition
Dell
PowerProtect Data Domain7.10.1.70
Dell
PowerProtect Data Domain7.13.1.40
Dell
PowerProtect Data Domain8.3.1.10
Dell
PowerProtect Data Domain8.4.0.0
IBM
QRadar SIEM7.5.0 UP10 IF01
IBM
QRadar SIEM7.5.0 UP11
IBM
QRadar SIEM<7.5.0 UP15 IF06
IBM
Security Guardium12
IBM
Storage Scale6.1.9.5
IBM
Storage Scale6.2.2.0
Juniper
Junos Space24.1R2
Oracle
VM3
redhat
openshift_container_platform4.12 – 4.12.89
redhat
openshift_container_platform4.13 – 4.13.66
redhat
openshift_container_platform4.14 – 4.14.65
redhat
openshift_container_platform4.15 – 4.15.64
References & sources
- https://git.kernel.org/stable/c/d88541ffd56d62a61e77209080001eddd4d69815euvd
- https://git.kernel.org/stable/c/43f5b19fd190fea20d052bc84741b28031d5baa9euvd
- https://git.kernel.org/stable/c/5f4061f8225d18695e5afe9bbf1cb7bd673d7872euvd
- https://git.kernel.org/stable/c/e5a75bf026c686b91a7dc6f9c5caf5016745d1feeuvd
- https://git.kernel.org/stable/c/c4ea7d8907cf72b259bf70bd8c2e791e1c4ff70feuvd
- https://git.kernel.org/stable/c/f12afddfb142587d786df9e3cc4862190d3e2ec8euvd
- https://git.kernel.org/stable/c/168f6fbde0eabd71d1f4133df7d001a950b96977euvd
- https://git.kernel.org/stable/c/f79edef79b6a2161f4124112f9b0c46891bb0b74euvd
- https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3016.html
- https://git.kernel.org/stable/c/76b94cbd32aacf36a641956385a852635c6802b9
- https://git.kernel.org/stable/c/c8e4e0c701d0192a2efb6df059c0f9e19678c23d
- https://git.kernel.org/stable/c/6c344fff2feff9d4d716d8e4ad40e9b5040ee5ea
- https://git.kernel.org/stable/c/427ab81a811dab4bca9d19f82eec5847ae42646e
- https://git.kernel.org/stable/c/012d37a568bfbb2c9686f03ade75560bc7139956
- https://git.kernel.org/stable/c/30aae62e50b4e074a90a9a5e15246548fbdc1182
- https://git.kernel.org/stable/c/41fe0f7b84f0cb822ae10ab08592996a592b2a25
- https://git.kernel.org/stable/c/7d7c9f0fcd19c4d2f0164347c58d49cafa961b72euvd
- https://git.kernel.org/stable/c/11c1431d641e0e4e0529e96957995820600c7287euvd
- https://git.kernel.org/stable/c/012796f9541fcd0c1fa8ae4da7eb4d83931ef838euvd
- https://git.kernel.org/stable/c/7d94f155f354b961c598f71bafa804dceded513feuvd
Linked CVEs
- CVE-2026-64600
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink…
highCVSSv3 7.8 - CVE-2026-64564
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sc…
criticalCVSSv3 9.8 - CVE-2026-64561
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages a…
mediumCVSSv3 5.5 - CVE-2026-64560
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wong…
highCVSSv3 7.8 - CVE-2026-64530
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf…
highCVSSv3 7.0 - CVE-2026-64189
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The…
highCVSSv3 7.1 - CVE-2026-64106
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_even…
criticalCVSSv3 9.0 - CVE-2026-63994
In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_buil…
criticalCVSSv3 9.8 - CVE-2026-63984
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rp…
criticalCVSSv3 9.8 - CVE-2026-63975
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp If dci…
highCVSSv3 8.8 - CVE-2026-63971
In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctp_wait_for_connect and peeloff sctp_wait_…
highCVSSv3 7.8 - CVE-2026-63946
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in iso_recv_frame iso_recv_frame reads conn…
highCVSSv3 8.8 - CVE-2026-63924
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_j…
criticalCVSSv3 9.8 - CVE-2026-63922
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv()…
criticalCVSSv3 9.8 - CVE-2026-63921
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
highCVSSv3 8.8 - CVE-2026-63919
In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Trans…
highCVSSv3 8.8 - CVE-2026-63917
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink().
highCVSSv3 8.8 - CVE-2026-63893
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()…
highCVSSv3 8.1 - CVE-2026-63884
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm o…
highCVSSv3 7.8 - CVE-2026-63829
In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelin…
highCVSSv3 8.2 - CVE-2026-63824
In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl_pkey_params_get_2() The length for the…
criticalCVSSv3 9.8 - CVE-2026-63807
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapp…
highCVSSv3 8.8 - CVE-2026-63806
In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with…
highCVSSv3 7.3 - CVE-2026-63794
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In…
highCVSSv3 7.8
Show 51 more CVEs
- CVE-2026-53402
In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font…
highCVSSv3 7.1 - CVE-2026-53391
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs…
mediumCVSSv3 5.5 - CVE-2026-53388
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_mo…
highCVSSv3 7.8 - CVE-2026-53375
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that on…
highCVSSv3 7.5 - CVE-2026-53357
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del(…
mediumCVSSv3 5.9 - CVE-2026-53324
In the Linux kernel, the following vulnerability has been resolved: net: mana: Use pci_name() for debugfs directory naming Use pci_name…
mediumCVSSv3 5.5 - CVE-2026-53297
In the Linux kernel, the following vulnerability has been resolved: net: mana: Guard mana_remove against double invocation If PM resume…
mediumCVSSv3 5.5 - CVE-2026-53267
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: bail out on template ct in get eval I noticed th…
highCVSSv3 7.8 - CVE-2026-53260
In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
criticalCVSSv3 9.8 - CVE-2026-53246
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processi…
criticalCVSSv3 9.8 - CVE-2026-53224
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cooki…
criticalCVSSv3 9.1 - CVE-2026-53196
In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf…
mediumCVSSv3 6.8 - CVE-2026-53131
In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t…
criticalCVSSv3 9.4 - CVE-2026-53050
In the Linux kernel, the following vulnerability has been resolved: quota: Fix race of dquot_scan_active() with quota deactivation dquo…
highCVSSv3 7.8 - CVE-2026-52986
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsaf…
criticalCVSSv3 9.8 - CVE-2026-52967
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix possible infinite loop and oob read in symlink_data(…
highCVSSv3 8.1 - CVE-2026-52958
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When…
criticalCVSSv3 9.1 - CVE-2026-52956
In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() I…
criticalCVSSv3 9.8 - CVE-2026-52933
In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix signed comparison in io_poll_get_ownership() io_…
highCVSSv3 7.8 - CVE-2026-46333
In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of…
highCVSSv3 7.1 - CVE-2026-46323
In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently co…
highCVSSv3 7.8 - CVE-2026-46243
A privilege escalation vulnerability was found in the Linux kernel's CIFS client implementation.
highCVSSv3 7.8 - CVE-2026-46193
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah: account for ESN high bits in async callbacks AH allocates…
mediumCVSSv3 5.5 - CVE-2026-46174
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2'…
highCVSSv3 8.8 - CVE-2026-46145
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash…
highCVSSv3 7.8 - CVE-2026-46144
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() Sashiko poin…
mediumCVSSv3 5.5 - CVE-2026-46126
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rs…
mediumCVSSv3 5.5 - CVE-2026-46117
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rs…
highCVSSv3 7.8 - CVE-2026-46109
In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix memory leak on ulpi_register() error paths Commit 01…
mediumCVSSv3 5.5 - CVE-2026-46084
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: Disable RX steering on RSS QP destroy When an RSS QP…
highCVSSv3 7.1 - CVE-2026-46080
In the Linux kernel, the following vulnerability has been resolved: ocfs2: split transactions in dio completion to avoid credit exhausti…
highCVSSv3 7.1 - CVE-2026-46056
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci…
highCVSSv3 8.8 - CVE-2026-46052
In the Linux kernel, the following vulnerability has been resolved: ceph: only d_add() negative dentries when they are unhashed Ceph ca…
highCVSSv3 7.5 - CVE-2026-43440
In the Linux kernel, the following vulnerability has been resolved: net/mana: Null service_wq on setup error to prevent double destroy…
—CVSSv3 0.0 - CVE-2026-43276
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroy_workqueue on service rescan PCI path…
—CVSSv3 0.0 - CVE-2026-43211
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PC…
highCVSSv3 7.8 - CVE-2026-43056
In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in add_adev() error path If auxiliary…
highCVSSv3 7.8 - CVE-2026-43033
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-pla…
highCVSSv3 7.8 - CVE-2026-31759
In the Linux kernel, the following vulnerability has been resolved: usb: ulpi: fix double free in ulpi_register_interface() error path…
—CVSSv3 0.0 - CVE-2026-31628
In the Linux kernel, the following vulnerability has been resolved: x86/CPU: Fix FPDSS on Zen1 Zen1's hardware divider can leave, under…
mediumCVSSv3 5.5 - CVE-2026-31598
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible deadlock between unlink and dio_end_io_write oc…
highCVSSv3 7.5 - CVE-2026-31542
In the Linux kernel, the following vulnerability has been resolved: x86/platform/uv: Handle deconfigured sockets When a socket is decon…
—CVSSv3 0.0 - CVE-2026-31431Actively exploited
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly r…
criticalCVSSv3 7.8 - CVE-2025-54518
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instruct…
highCVSSv3 7.0 - CVE-2025-21953
In the Linux kernel, the following vulnerability has been resolved: net: mana: cleanup mana struct after debugfs_remove() When on a MAN…
mediumCVSSv3 5.5 - CVE-2025-21710
In the Linux kernel, the following vulnerability has been resolved: tcp: correct handling of extreme memory squeeze Testing with iperf3…
highCVSSv3 8.2 - CVE-2024-38542
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: boundary check before installing cq callbacks Add a b…
highCVSSv3 7.8 - CVE-2023-53995
In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix one memleak in __inet_del_ifa() I got the below warn…
—CVSSv3 0.0 - CVE-2023-20585
Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigg…
mediumCVSSv3 5.3 - CVE-2023-2058
A vulnerability was found in EyouCms up to 1.6.2.
lowCVSSv3 2.4 - CVE-2022-4994
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: wean fast IN from emulator_pio_in Use __emulator_pio_in()…
—