CLSA-2026-1777614769
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1777614769.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1777614769
- Upstream
- Published
- 2026-05-01T13:12:06Z
- Modified
- 2026-06-01T00:33:14.416745508Z
- Summary
- kernel: Fix of 13 CVEs
- Details
-
- crypto: algif_aead - Fix minimum RX size check for decryption
- crypto: afalg - Fix page reassignment overflow in afalgpulltsgl
- crypto: authencesn - Fix src offset when decrypting in-place
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
- crypto: authenc - use memcpy_sglist() instead of null skcipher
- crypto: algif_aead - snapshot IV for async AEAD requests
- crypto: algif_aead - Revert to operating out-of-place
- crypto: algifaead - use memcpysglist() instead of null skcipher
- crypto: scatterwalk - Backport memcpy_sglist()
- crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec
- Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
- Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
- Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
- asix: fix uninit-value in asixmdioread() {CVE-2021-47101}
- net/sched: clsu32: use skbheaderpointercareful() {CVE-2026-23204}
- net: add skbheaderpointer_careful() helper
- ext4: lost matching-pair of trace in ext4_truncate
- usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
- net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
- perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
- VMCI: fix race between vmcihostsetupnotify and vmcictxunsetnotify {CVE-2025-38102}
- scsi: libsas: Fix use-after-free bug in smpexecutetask_sg() {CVE-2022-50422}
- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
- VMCI: check context->notifypage after call to getuserpagesfast() to avoid GPF {CVE-2023-53259}
- net/sched: schqfq: Avoid triggering mightsleep in atomic context in qfqdeleteclass
- References