Skip to content
Heist/ feed
UnratedFix available

Important: kernel security, bug fix, and enhancement update

Type: advisorySource: OSV1 source record

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964) * kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread (CVE-2023-54120) * kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214) * kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053) * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256) * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254) * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823) * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975) * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_r

Announced Source revision 1
Original source ↗

RLSA-2026:70402

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:RLSA-2026:70402

kernel

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
0:4.18.0-553.166.1.el8_10

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "0:4.18.0-553.166.1.el8_10"
          }
        ],
        "database_specific": {
          "yum_repository": "BaseOS"
        }
      }
    ],
    "package": {
      "name": "kernel",
      "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-8&epoch=0",
      "ecosystem": "Rocky Linux:8"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:70402.json"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#6063 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement