Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CentOS Stream kernel update stops crashes and data leaks

published 23 days ago
Summary

The latest CentOS Stream kernel packages fix dozens of coding errors that could cause programs to stop working or expose data. These issues affect core kernel components like networking, Bluetooth, and device drivers. Apply the updated kernel packages from CentOS Stream as soon as possible to keep systems stable and secure.

What to do
  • Update centos-stream bpftool to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-core to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-cross-headers to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-debug to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-debug-core to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-debug-devel to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-debug-modules to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-debug-modules-extra to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-debug-modules-internal to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-devel to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-headers to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-ipaclones-internal to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-modules to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-modules-extra to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-modules-internal to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-selftests-internal to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-tools to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-tools-libs to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream kernel-tools-libs-devel to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream perf to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
  • Update centos-stream python3-perf to version 4.18.0-553.6.1.el8_10.tuxcare.els31.
Affected software
Ecosystem VendorProductAffected versions
TuxCare:CentOS-Stream:8 centos-stream bpftool < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-core < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-cross-headers < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-debug < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-debug-core < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-debug-devel < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-debug-modules < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-debug-modules-extra < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-debug-modules-internal < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-devel < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-headers < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-ipaclones-internal < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-modules < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-modules-extra < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-modules-internal < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-selftests-internal < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-tools < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-tools-libs < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream kernel-tools-libs-devel < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream perf < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
TuxCare:CentOS-Stream:8 centos-stream python3-perf < 4.18.0-553.6.1.el8_10.tuxcare.els31
Fix: upgrade to 4.18.0-553.6.1.el8_10.tuxcare.els31
Original advisory text
kernel: Fix of 72 CVEs
- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
- Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
- ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
- ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
- net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
- netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
- usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
- ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
- ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
- Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
- thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}
- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
- ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
- inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
- libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
- SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
- SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
- openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487}
- nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
- sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
- net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
- ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971}
- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
- Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
- cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
- RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
- drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
- scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
- xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
- drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
- RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
- nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261}
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
- crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
- tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
- sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
- bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
- scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
- rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
- mpls: reload header after pskb_may_pull() {CVE-2026-89555}
- net: tun: bound receive headroom {CVE-2026-81000}
- netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
- netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
- net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
- firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
- firewire: net: remove unused variable 'guid' {CVE-2023-53432}
- gfs2: Fix slab-use-after-free in gfs2_qd_dealloc {CVE-2023-52760}
- gfs2: fix kernel BUG in gfs2_quota_cleanup {CVE-2023-52760}
- gfs2: Fix asynchronous thread destruction {CVE-2023-52760}
- gfs2: Stop using gfs2_make_fs_ro for withdraw {CVE-2023-52760}
- crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
- crypto: scompress - initialize per-CPU variables on each CPU {CVE-2023-52612}
- crypto: scompress - Use per-CPU struct instead multiple variables {CVE-2023-52612}
- crypto: scompress - return proper error code for allocation failure {CVE-2023-52612}
- bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data {CVE-2022-50536}
- virtio_net: fix xdp_rxq_info bug after suspend/resume {CVE-2022-49687}
- virtio_net: avoid using netif_tx_disable() for serializing tx routine {CVE-2022-49687}
- mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
- mm/khugepaged: unify collapse pmd clear, flush and free {CVE-2022-48991}
- KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() {CVE-2024-35791}
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149}
- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
- perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
- xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
- ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}
- net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
- sctp: validate cookie AUTH state before use {CVE-2026-74752}
- packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582}
- net: tunnels: annotate lockless accesses to dev->needed_headroom {CVE-2023-53109}
- net/sched: act_ct: fix sk_buff leak when the header checks reject a packet {CVE-2026-74621}
- Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013}
- USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
- drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
- net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
- vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
- NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
- NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
- enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
- drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
References
Timeline
Published12 Oct 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1791780738 · OSV
Track software like this
Free during beta