LSN-0121-1: Kernel Live Patch Security Notice

In the Linux kernel, the following vulnerability has been
resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request
ipc_msg_send_request() waits for a generic netlink reply using an
ipc_msg_table_entry on the stack.

In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix use-after-free of share_conf in compound request
smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without
validating tcon->t_state.

In the Linux kernel, the following vulnerability has been
resolved: netfilter: nf_conntrack_h323: check for zero length in
DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit
length from the packet, then decrements it by 1 to skip the protocol
discriminator byte before passing it to DecodeH323_UserInformation().

In the Linux kernel, the following vulnerability has been
resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0
replay cache uses a fixed 112-byte inline buffer
(rp_ibuf.

In the Linux kernel, the following vulnerability has been
resolved: media: dvb-net: fix OOB access in ULE extension header tables The
ule_mandatory_ext_handlers.

It was discovered that the Linux kernel algif_aead module did not properly
handle in-place cryptographic operations. This flaw is known as Copy Fail.
A local attacker could use this to escalate privileges, or possibly escape
a container.)(CVE-2026-31431)

In the Linux kernel, the following vulnerability has been
resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in
smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 'ksmbd: add
support for read compound'), response buffer management was changed to use
dynamic iov array.

In the Linux kernel, the following vulnerability has been
resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When
a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit()
unconditionally overwrites urb->number_of_packets from the network PDU.
This value is subsequently used as the loop bound in usbip_recv_iso() and
usbip_pad_iso() to iterate over urb->iso_frame_desc.

In the Linux kernel, the following vulnerability has been
resolved: rxrpc: reject undecryptable rxkad response tickets
rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses
the buffer as plaintext without checking whether crypto_skcipher_decrypt()
succeeded.

In the Linux kernel, the following vulnerability has been
resolved: batman-adv: hold claim backbone gateways by reference
batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
gateway's last reference while readers still follow the pointer.

In the Linux kernel, the following vulnerability has been
resolved: batman-adv: reject oversized global TT response buffers
batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
global TT response in 16-bit temporaries.

In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment
smb2_get_ea() applies 4-byte alignment padding via memset() after writing
each EA entry.

In the Linux kernel, the following vulnerability has been
resolved: net/x25: Fix potential double free of skb When alloc_skb fails in
x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1
(error).

In the Linux kernel, the following vulnerability has been
resolved: ip6_tunnel: clear skb2->cb.

In the Linux kernel, the following vulnerability has been
resolved: ipv6: icmp: clear skb2->cb.

In the Linux kernel, the following vulnerability has been
resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
smb_direct_prepare_negotiation() casts an unsigned __u32 value from
sp->max_recv_size and req->preferred_send_size to a signed int before
computing min_t(int, ...).

In the Linux kernel, the following vulnerability has been
resolved: ipv6: ioam: fix heap buffer overflow in ioam6_fill_trace_data()
On the receive path, ioam6_fill_trace_data() uses trace->nodelen to
decide how much data to write for each node.

In the Linux kernel, the following vulnerability has been
resolved: libceph: define and enforce CEPH_MAX_KEY_LEN When decoding the
key, verify that the key material would fit into a fixed-size buffer in
process_auth_done() and generally has a sane length.

In the Linux kernel, the following vulnerability has been
resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill
ioam6_fill_trace_data() stores the schema contribution to the trace length
in a u8.

In the Linux kernel, the following vulnerability has been
resolved: libceph: prevent potential out-of-bounds reads in
process_message_header() If the message frame is (maliciously) corrupted in
a way that the length of the control segment ends up being less than the
size of the message header or a different frame is made to look like a
message frame, out-of-bounds reads may ensue in process_message_header().
Perform an explicit bounds check before decoding the message header.)(CVE-2026-43406).

In the Linux kernel, the following vulnerability has been
resolved: libceph: Fix potential out-of-bounds access in
ceph_handle_auth_reply() This patch fixes an out-of-bounds access in
ceph_handle_auth_reply() that can be triggered by a message of type
CEPH_MSG_AUTH_REPLY.

In the Linux kernel, the following vulnerability has been
resolved: crypto: pcrypt - Fix handling of MAY_BACKLOG requests MAY_BACKLOG
requests can return EBUSY.

In the Linux kernel, the following vulnerability has been
resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps
the next segment into ipv6_hdr->daddr, recompresses, then pulls the old
header and pushes the new one plus the IPv6 header back.

In the Linux kernel, the following vulnerability has been
resolved: rxrpc: Fix re-decryption of RESPONSE packets If a RESPONSE packet
gets a temporary failure during processing, it may end up in a partially
decrypted state - and then get requeued for a retry.

In the Linux kernel, the following vulnerability has been
resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
rxe_rcv() currently checks only that the incoming packet is at least
header_size(pkt) bytes long before payload_size() is used.

In the Linux kernel, the following vulnerability has been
resolved: libceph: Fix slab-out-of-bounds access in auth message processing
If a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY contains a
positive value in its result field, it is treated as an error code by
ceph_handle_auth_reply() and returned to handle_auth_reply().

In the Linux kernel, the following vulnerability has been
resolved: nvmet-tcp: fix race between ICReq handling and queue teardown
nvmet_tcp_handle_icreq() updates queue->state after sending an
Initialization Connection Response (ICResp), but it does so without
serializing against target-side queue teardown.

In the Linux kernel, the following vulnerability has been
resolved: smb/client: fix out-of-bounds read in symlink_data() Since
smb2_check_message() returns success without length validation for the
symlink error response, in symlink_data() it is possible for iov->iov_len
to be smaller than sizeof(struct smb2_err_rsp).

In the Linux kernel, the following vulnerability has been
resolved: smb: client: validate dacloffset before building DACL pointers
parse_sec_desc(), build_sec_desc(), and the chown path in
id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd
before proving a DACL header fits inside the returned security descriptor.
On 32-bit builds a malicious server can return dacloffset near U32_MAX,
wrap the derived DACL pointer below end_of_acl, and then slip past the
later pointer-based bounds checks.

In the Linux kernel, the following vulnerability has been
resolved: procfs: fix missing RCU protection when reading real_parent in
do_task_stat() When reading /proc/.

In the Linux kernel, the following vulnerability has been
resolved: io-wq: check that the predecessor is hashed in
io_wq_remove_pending() io_wq_remove_pending() needs to fix up
wq->hash_tail.

In the Linux kernel, the following vulnerability has been
resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free
nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final
controller reference through nvmet_cq_put().

In the Linux kernel, the following vulnerability has been
resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When
looking up a flow table in act_ct in tcf_ct_flow_table_get(),
rhashtable_lookup_fast() internally opens and closes an RCU read critical
section before returning ct_ft.

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0
contained a out-of-bounds (OOB) read when handling AppArmor notifications.
A local attacker could use this to cause kernel memory corruption and,
theoretically, influence processing of AppArmor policies.)(CVE-2026-47333)