huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-43501: kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
Component: kernel
Severity: Important
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 7.5 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-21T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker can exploit an out-of-bounds write vulnerability when the kernel recomputes an IPv6 Source Routing Header (SRH). This issue occurs because insufficient headroom is reserved during the recompression process, leading to memory corruption. Successful exploitation could result in a denial of service or potentially arbitrary code execution.

Statement: This is an Important flaw. A local attacker can exploit an out-of-bounds write in the Linux kernel's IPv6 Source Routing Header (SRH) recompression, which could lead to a denial of service or arbitrary code execution. This vulnerability impacts Red Hat Enterprise Linux 9 and 10, and Red Hat In-Vehicle OS 2, due to insufficient memory handling during SRH processing.

Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.258, 5.15.209, 6.1.175, 6.12.86, 6.18.27, 6.6.140, 7.0.4, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bde199c72d319a4e207f88daabc888317504e2fb
CVE-2026-43503: kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers
Component: kernel
Severity: Important
CWE: CWE-664 (Improper Control of a Resource Through its Lifetime)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-23T00:00:00+00:00

A flaw was found in the Linux kernel's networking (skbuff) component. When skb_try_coalesce() attaches paged fragments, it can lose the SKBFL_SHARED_FRAG marker. This can lead to the Encapsulating Security Payload (ESP) input decrypting data in place over page-cache backed fragments, potentially resulting in data corruption.

Statement: Impact is rated as Important because the privileged file-backed cache pages may be modified through a shared-page ownership bypass. Within Red Hat Enterprise Linux and Red Hat OpenShift Container Platform, this vulnerability was fixed at the same time as CVE-2026-46300.

Affected upstream versions: 3.9
Fixed upstream versions: 0, 5.10.257, 5.15.208, 6.1.174, 6.12.91, 6.18.33, 6.6.141, 7.0.10, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fbeab9555564a1b98e8582cd106dfe46c4606991
CVE-2026-4367: libXpm: libXpm: Denial of Service via out-of-bounds read in XPM file parsing
Component: libXpm
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-04-21T13:26:00+00:00

A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted or very small XPM (X PixMap) image file. This improper validation of file boundaries can cause an internal pointer to read beyond the file's end, leading to application crashes and Denial of Service conditions.

Statement: The vulnerability is assessed as Medium severity due to its impact being limited to availability. While exploitation requires local access and low privileges, it does not require user interaction. Successful exploitation can cause applications processing XPM files to crash, which may affect batch processing systems or graphical applications. The absence of confidentiality and integrity impact reduces the overall severity, but the ease of triggering the issue still presents a reliability concern.

Affected upstream versions: <= xf86-012804-2330
Fixed upstream versions: 3.5.17-7.2.hum1, 3.5.19-4.hum1
Upstream repository: https://gitlab.freedesktop.org/xorg/lib/libxpm
Upstream fix commit: 5448e1bd
CVE-2026-44660: python-ujson: UltraJSON: Memory leak leading to Denial of Service
Component: python-ujson
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-05-27T20:42:59.830000+00:00

A flaw was found in UltraJSON, a fast JSON encoder and decoder. When the `ujson.dump()` function attempts to write data to a file-like object and an error occurs during this operation, the memory allocated for the serialized JSON string is not properly released. This continuous failure to deallocate memory can lead to a memory leak, potentially causing resource exhaustion and a Denial of Service (DoS) for the affected system.

Statement: This Moderate flaw in UltraJSON can lead to a denial of service due to a memory leak when `ujson.dump()` attempts to write to a file-like object and encounters an exception. Applications utilizing `ujson.dump()` with attacker-controlled input or file-like objects are susceptible to resource exhaustion. Deployments that only use `ujson.dumps()` or JSON decoding functions are not affected.

Affected upstream versions: < 5.12.1
Fixed upstream versions: 5.12.1
Upstream repository: https://github.com/ultrajson/ultrajson
Upstream fix commit: 82af1d0ac01d09aa40c887b460d44b9d9f4bccd9
CVE-2026-44727: jupyter-server: Jupyter Server: Remote Code Execution via stored Cross-Site Scripting in nbconvert handlers
Component: jupyter-server
Severity: Important
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Public date: 2026-06-22T19:56:56.776000+00:00

A flaw was found in Jupyter Server. The nbconvert HTTP handlers in Jupyter Server render user-authored notebook HTML without a sandbox directive in their Content-Security-Policy. This, combined with nbconvert.HTMLExporter's default non-sanitizing behavior, allows a notebook containing an HTML payload to trigger a stored Cross-Site Scripting (XSS) vulnerability. A remote attacker could exploit this to gain cookie access, full API authority, and achieve kernel Remote Code Execution (RCE).


Affected upstream versions: < 2.20
Fixed upstream versions: v2.20.0
Upstream repository: https://github.com/jupyter-server/jupyter_server
Upstream fix commit: 6cbee8d65e71abac851c4492fea987ad080580bd
CVE-2026-4519: python: Python: Command-line option injection in webbrowser.open() via crafted URLs
Component: python
Severity: Important
CWE: CWE-88 (Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'))
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L)
Public date: 2026-03-20T15:08:32.576000+00:00

A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.


Affected upstream versions: 3.14.0 < 3.14.4, 3.15.0a1 < 3.15.0a8
Fixed upstream versions: v3.13.13
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 43fe06b96f6a6cf5cfd5bdab20b8649374956866
CVE-2026-45287: go.opentelemetry.io/otel: go.opentelemetry.io/otel/schema/v1.0: go.opentelemetry.io/otel/schema/v1.1: OpenTelemetry-Go: Denial of Service due to file descriptor leak
Component: go.opentelemetry.io/otel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-06-04T14:45:54.522000+00:00

A flaw was found in OpenTelemetry-Go (before schema package version 0.0.17). ParseFile in go.opentelemetry.io/otel/schema/v1.0 and v1.1 opens a schema file and passes it to Parse without closing it, leaking one file descriptor per successful call. Repeated parsing in a long-running process can exhaust the file descriptor limit and cause denial of service.

Statement: OpenTelemetry-Go schema parsing is vulnerable to file descriptor leak in ParseFile for otel/schema v1.0 and v1.1. An attacker who can cause repeated schema parsing against an attacker-influenced file path in a long-running Go process may exhaust file descriptors and crash or stall the service. Exposure is limited to applications that expose schema parsing to untrusted paths; many Red Hat Go services bundle the library transitively without hitting this code path.

Affected upstream versions: < 0.0.17, < 0.0.17
Fixed upstream versions: schema/v0.0.1
Upstream repository: https://github.com/open-telemetry/opentelemetry-go
Upstream fix commit: e72a235518cb773137efd80336a179028bc34684
CVE-2026-45292: opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage
Component: opentelemetry-java
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-05-28T16:37:29.490000+00:00

A flaw was found in OpenTelemetry Java, specifically within the baggage propagation implementation of opentelemetry-api and opentelemetry-extension-trace-propagators. A remote attacker can exploit this vulnerability by sending oversized baggage, which leads to unbounded memory allocation and high CPU consumption. This can result in a Denial of Service (DoS) for the affected service. Furthermore, because baggage is automatically re-injected into outgoing requests, the impact can spread to other downstream services.

Statement: This is an Important denial of service vulnerability in OpenTelemetry Java's baggage propagation, affecting Red Hat products that use OpenTelemetry for telemetry. A remote attacker can exploit this by sending excessively large baggage, leading to uncontrolled memory and CPU usage. The vulnerability's impact can extend to downstream services due to automatic re-injection of baggage into outgoing requests.

Affected upstream versions: < 1.62.0, 1.62.0, 1.62.0
Fixed upstream versions: v1.62.0
Upstream repository: https://github.com/open-telemetry/opentelemetry-java
Upstream fix commit: 03837d3c1763bc35464aea1078671e2ef2336a5f
CVE-2026-45445: openssl: AES-OCB IV Ignored on EVP_Cipher() Path
Component: openssl
Severity: Moderate
CWE: CWE-1204 (Generation of Weak Initialization Vector (IV))
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface (EVP_Cipher()) will have their provided Initialization Vector (IV) silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the confidentiality of encrypted data. Additionally, this issue allows for the universal forgery of authentication tags, undermining the integrity of communications.

Statement: This is a Moderate severity flaw where applications utilizing the AES-OCB cipher through OpenSSL's EVP_Cipher() one-shot interface may silently discard the provided initialization vector (IV). This leads to nonce reuse, compromising confidentiality and enabling universal forgery of authentication tags. Red Hat products are primarily affected if they include or rely on third-party applications that specifically employ this less common and discouraged API usage with AES-OCB, as standard OpenSSL SSL/TLS implementations and applications using the recommended streaming AEAD API are not impacted.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6, 3.0.0 < 3.0.21
Fixed upstream versions: 3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 843c9b94ca9c2ed248bb30127bb4f3d7af0d607c
CVE-2026-45446: openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes
Component: openssl
Severity: Low
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL. The implementations of AES-SIV (Advanced Encryption Standard - SIV) and AES-GCM-SIV (Advanced Encryption Standard - Galois/Counter Mode - SIV) incorrectly process authentication tags for empty messages. This vulnerability allows a remote attacker to forge empty messages with arbitrary Additional Authenticated Data (AAD) in applications that utilize these specific cipher modes within custom protocols and do not properly handle zero-length ciphertexts. This could lead to unauthorized data manipulation.

Statement: This flaw is rated as Low impact. It affects applications that utilize OpenSSL's AES-SIV or AES-GCM-SIV modes within custom protocols and specifically mishandle empty ciphertexts. Standard OpenSSL protocols, such as TLS, are not affected. Successful exploitation requires an application to use the EVP interface and to skip ciphertext updates when processing zero-length ciphertexts, representing an uncommon and non-default configuration.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6, 3.0.0 < 3.0.21
Fixed upstream versions: 3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc
CVE-2026-45447: openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()
Component: openssl
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution.

Statement: This High severity heap use-after-free flaw in OpenSSL's PKCS7_verify() function can be triggered by processing a specially crafted PKCS#7 or S/MIME signed message. This could lead to application crashes, memory corruption, or potentially remote code execution, impacting services that handle such messages. The vulnerability specifically affects applications utilizing OpenSSL PKCS#7 APIs, while those using CMS APIs are not impacted.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6, 3.0.0 < 3.0.21, 1.1.1 < 1.1.1zh, 1.0.2 < 1.0.2zq
Fixed upstream versions: 1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 3aad5eb7af4de4ee0633c30a8541a54d9bbde63c
CVE-2026-45736: ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
Component: ws
Severity: Important
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-05-15T14:53:57.263000+00:00

A flaw was found in ws, an open source WebSocket client and server for Node.js. The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray` is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memory.

Statement: This Important vulnerability in the `ws` WebSocket library for Node.js could lead to sensitive information disclosure. The flaw occurs when a `TypedArray` is specifically provided as the `reason` argument to the `websocket.close()` function, potentially exposing uninitialized memory. Red Hat products utilizing this library may be affected if their implementations allow for such a crafted `close()` call.

Affected upstream versions: >= 8.0.0, < 8.20.1
Fixed upstream versions: 8.20.1
Upstream repository: https://github.com/websockets/ws
Upstream fix commit: c0327ec15a54d701eb6ccefaa8bef328cfc03086
CVE-2026-45822: decode-uri-component: decode-uri-component: Denial of Service via crafted input
Component: decode-uri-component
Severity: Important
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-06-30T08:05:36.399000+00:00

A flaw was found in the `decode-uri-component` library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by submitting specially crafted input. The `decode()` function, when processing a large number of encoded URI components, consumes excessive CPU resources, which can lead to the application becoming unresponsive and unavailable.

Statement: A denial of service flaw was found in the decode-uri-component npm package. The decode() function exhibits super-linear time complexity when processing input containing many percent-encoded sequences, allowing an attacker to cause significant CPU consumption and event-loop blocking. In Red Hat products where this package is bundled (OpenShift Console, Quay, Pipelines, RHOAI, and others), exploitation requires that attacker-controlled input containing crafted percent-encoded strings reaches the decode() function without prior length validation. Red Hat rates this as Moderate severity since the impact is limited to availability with no confidentiality or integrity impact, consistent with the CNA's CVSS 4.0 assessment of 6.6 Medium.

Affected upstream versions: 0.1.0 < 0.5.0
Fixed upstream versions: 0.5.0
Upstream repository: https://github.com/SamVerschueren/decode-uri-component
Upstream fix commit: fa479dafeede7bedf04e5c89aa78f2a78c664005
CVE-2026-45852: kernel: RDMA/rxe: Fix double free in rxe_srq_from_init
Component: kernel
Severity: Important
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-27T00:00:00+00:00

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem, specifically within the `rxe` driver. An error in the `rxe_srq_from_init` function's memory management can lead to a double free vulnerability. This occurs when an attempt to copy data to user space fails, causing the same memory region to be freed twice. A local attacker could potentially exploit this flaw to cause a denial of service (DoS) by crashing the system.


Affected upstream versions: 4.19.86 < 4.20, 4.20
Fixed upstream versions: 0, 4.20, 5.10.259, 5.15.210, 6.1.176, 6.12.75, 6.18.14, 6.19.4, 6.6.128, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b98ab5494dbd48652561aa0b9c32f10500220745
CVE-2026-45898: kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list
Component: kernel
Severity: Important
CWE: CWE-1341 (Multiple Releases of Same Resource or Handle)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-27T00:00:00+00:00

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) Internet Wide Area RDMA Protocol (iWARP) subsystem. Incorrect work submission logic in the `iwcm` component can lead to multiple queueing of work items. This allows a work item to be processed and freed while still present in the workqueue, causing list corruption. A successful exploitation of this vulnerability can result in a kernel bug and system crash, leading to a Denial of Service (DoS).


Affected upstream versions: 6.11
Fixed upstream versions: 0, 6.12.75, 6.18.14, 6.19.4, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 38c5b49fffa1b760959af74f11806eeb3ef4706d
CVE-2026-4598: jsrsasign: jsrsasign: Denial of Service via infinite loop in bnModInverse function with crafted inputs
Component: jsrsasign
Severity: Important
CWE: CWE-1287 (Improper Validation of Specified Type of Input)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-03-23T05:00:11.571000+00:00

A flaw was found in jsrsasign. A remote attacker could exploit this vulnerability by providing specially crafted zero or negative inputs to the bnModInverse function within the BigInteger.modInverse implementation. This could lead to an infinite loop, causing a permanent denial of service (DoS) by hanging the process.

Statement: IMPORTANT: A denial of service flaw was found in jsrsasign. This vulnerability allows a remote attacker to cause a permanent denial of service by providing specially crafted zero or negative inputs to the bnModInverse function, leading to an infinite loop. This affects Red Hat Migration Toolkit for Virtualization and Red Hat Quay, which utilize the vulnerable jsrsasign component.

Affected upstream versions: <= 11.1.0
Fixed upstream versions: *, 11.1.1
Upstream repository: https://github.com/kjur/jsrsasign
Upstream fix commit: ca5b027240287a1e71fe63019fc4400332594323
CVE-2026-45984: kernel: gfs2: Fix use-after-free in iomap inline data write path
Component: kernel
Severity: Important
CWE: CWE-826 (Premature Release of Resource During Expected Lifetime)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-27T00:00:00+00:00

A flaw was found in the Linux kernel's GFS2 filesystem. This memory corruption vulnerability, a use-after-free, occurs in the iomap inline data write path. The issue arises because a data buffer is released prematurely while still being referenced, leading to a write to freed memory. This could allow a local attacker to cause system instability or a denial of service (DoS).


Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.10.252, 5.15.202, 6.1.165, 6.12.75, 6.18.14, 6.19.4, 6.6.128, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1403989d1b502f4a2c0d0b42ccf1c25748442eff
CVE-2026-4599: jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces
Component: jsrsasign
Severity: Important
CWE: CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG))
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-03-23T05:00:12.522000+00:00

A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.


Affected upstream versions: 7.0.0 < 11.1.1, 8.0.12 < *
Fixed upstream versions: *, 11.1.1
Upstream repository: https://github.com/kjur/jsrsasign
Upstream fix commit: ee4b013478366cb16cea9a4bdfb218b6077f83b1
CVE-2026-45998: kernel: rxrpc: Fix potential UAF after skb_unshare() failure
Component: kernel
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-27T00:00:00+00:00

A flaw was found in the Linux kernel's `rxrpc` subsystem. This vulnerability arises when the system attempts to unshare a packet buffer, and the operation fails due to an allocation issue. This failure can lead to a Use-After-Free (UAF) condition, where the system attempts to access memory that has been freed, potentially causing a system crash.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.12.86, 6.18.27, 6.6.140, 7.0.4, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e3bf143b1e98fb3d6d9e6825bcd683974d478e8c