From 92b91480506fa385438474bf098f4d06ac346e5d Mon Sep 17 00:00:00 2001 From: Piyush Jena Date: Fri, 2 Oct 2026 00:16:48 +0000 Subject: [PATCH 1/2] advisories: add BRSAs for kernel-kit v9.3.0 Signed-off-by: Piyush Jena --- advisories/9.3.0/BRSA-1mo4ndvw1gas.toml | 17 ++++++++++++++++ advisories/9.3.0/BRSA-5jw6xh5no5xc.toml | 17 ++++++++++++++++ advisories/9.3.0/BRSA-9qgydx8htmdh.toml | 17 ++++++++++++++++ advisories/9.3.0/BRSA-aj54yq9963od.toml | 17 ++++++++++++++++ advisories/9.3.0/BRSA-citvpl53ypa1.toml | 17 ++++++++++++++++ advisories/9.3.0/BRSA-dya77m460e9r.toml | 27 +++++++++++++++++++++++++ advisories/9.3.0/BRSA-hr7vf473g1p9.toml | 16 +++++++++++++++ advisories/9.3.0/BRSA-if2iijg8itxm.toml | 16 +++++++++++++++ advisories/9.3.0/BRSA-lj56i0r9ce4p.toml | 17 ++++++++++++++++ advisories/9.3.0/BRSA-mzmgg9jyr6xg.toml | 27 +++++++++++++++++++++++++ advisories/9.3.0/BRSA-qqjzrp0dxff8.toml | 17 ++++++++++++++++ advisories/9.3.0/BRSA-ufhk7pp1glia.toml | 16 +++++++++++++++ 12 files changed, 221 insertions(+) create mode 100644 advisories/9.3.0/BRSA-1mo4ndvw1gas.toml create mode 100644 advisories/9.3.0/BRSA-5jw6xh5no5xc.toml create mode 100644 advisories/9.3.0/BRSA-9qgydx8htmdh.toml create mode 100644 advisories/9.3.0/BRSA-aj54yq9963od.toml create mode 100644 advisories/9.3.0/BRSA-citvpl53ypa1.toml create mode 100644 advisories/9.3.0/BRSA-dya77m460e9r.toml create mode 100644 advisories/9.3.0/BRSA-hr7vf473g1p9.toml create mode 100644 advisories/9.3.0/BRSA-if2iijg8itxm.toml create mode 100644 advisories/9.3.0/BRSA-lj56i0r9ce4p.toml create mode 100644 advisories/9.3.0/BRSA-mzmgg9jyr6xg.toml create mode 100644 advisories/9.3.0/BRSA-qqjzrp0dxff8.toml create mode 100644 advisories/9.3.0/BRSA-ufhk7pp1glia.toml diff --git a/advisories/9.3.0/BRSA-1mo4ndvw1gas.toml b/advisories/9.3.0/BRSA-1mo4ndvw1gas.toml new file mode 100644 index 00000000..15c0d29e --- /dev/null +++ b/advisories/9.3.0/BRSA-1mo4ndvw1gas.toml @@ -0,0 +1,17 @@ +[advisory] +id = "BRSA-1mo4ndvw1gas" +title = "kernel CVE-2026-72288" +cve = "CVE-2026-72288" +severity = "high" +description = "In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling" + +[[advisory.products]] +package-name = "kernel-6.12" +patched-version = "6.12.103" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-09-30T00:47:47Z +arches = ["aarch64", "x86_64"] +version = "9.3.0" diff --git a/advisories/9.3.0/BRSA-5jw6xh5no5xc.toml b/advisories/9.3.0/BRSA-5jw6xh5no5xc.toml new file mode 100644 index 00000000..471273a6 --- /dev/null +++ b/advisories/9.3.0/BRSA-5jw6xh5no5xc.toml @@ -0,0 +1,17 @@ +[advisory] +id = "BRSA-5jw6xh5no5xc" +title = "kernel CVE-2026-74347" +cve = "CVE-2026-74347" +severity = "high" +description = "In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount" + +[[advisory.products]] +package-name = "kernel-6.12" +patched-version = "6.12.103" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-09-30T00:47:47Z +arches = ["aarch64", "x86_64"] +version = "9.3.0" diff --git a/advisories/9.3.0/BRSA-9qgydx8htmdh.toml b/advisories/9.3.0/BRSA-9qgydx8htmdh.toml new file mode 100644 index 00000000..650c8d61 --- /dev/null +++ b/advisories/9.3.0/BRSA-9qgydx8htmdh.toml @@ -0,0 +1,17 @@ +[advisory] +id = "BRSA-9qgydx8htmdh" +title = "kernel CVE-2026-72413" +cve = "CVE-2026-72413" +severity = "high" +description = "In the Linux kernel, the following vulnerability has been resolved: sctp: fix err_chunk memory leaks in INIT handling" + +[[advisory.products]] +package-name = "kernel-6.12" +patched-version = "6.12.103" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-09-30T00:47:47Z +arches = ["aarch64", "x86_64"] +version = "9.3.0" diff --git a/advisories/9.3.0/BRSA-aj54yq9963od.toml b/advisories/9.3.0/BRSA-aj54yq9963od.toml new file mode 100644 index 00000000..bf285ec6 --- /dev/null +++ b/advisories/9.3.0/BRSA-aj54yq9963od.toml @@ -0,0 +1,17 @@ +[advisory] +id = "BRSA-aj54yq9963od" +title = "kernel CVE-2026-64068" +cve = "CVE-2026-64068" +severity = "high" +description = "In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs" + +[[advisory.products]] +package-name = "kernel-6.12" +patched-version = "6.12.103" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-09-30T00:47:47Z +arches = ["aarch64", "x86_64"] +version = "9.3.0" diff --git a/advisories/9.3.0/BRSA-citvpl53ypa1.toml b/advisories/9.3.0/BRSA-citvpl53ypa1.toml new file mode 100644 index 00000000..d850c6f6 --- /dev/null +++ b/advisories/9.3.0/BRSA-citvpl53ypa1.toml @@ -0,0 +1,17 @@ +[advisory] +id = "BRSA-citvpl53ypa1" +title = "kernel CVE-2026-74405" +cve = "CVE-2026-74405" +severity = "high" +description = "In the Linux kernel, the following vulnerability has been resolved: OPP: Fix race between OPP addition and lookup" + +[[advisory.products]] +package-name = "kernel-6.12" +patched-version = "6.12.103" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-09-30T00:47:47Z +arches = ["aarch64", "x86_64"] +version = "9.3.0" diff --git a/advisories/9.3.0/BRSA-dya77m460e9r.toml b/advisories/9.3.0/BRSA-dya77m460e9r.toml new file mode 100644 index 00000000..ba59f5e7 --- /dev/null +++ b/advisories/9.3.0/BRSA-dya77m460e9r.toml @@ -0,0 +1,27 @@ +[advisory] +id = "BRSA-dya77m460e9r" +title = "kernel CVE-2026-80844" +cve = "CVE-2026-80844" +severity = "high" +description = "In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left" + +[[advisory.products]] +package-name = "kernel-6.1" +patched-version = "6.1.186" +patched-epoch = "0" + +[[advisory.products]] +package-name = "kernel-6.12" +patched-version = "6.12.103" +patched-epoch = "0" + +[[advisory.products]] +package-name = "kernel-6.18" +patched-version = "6.18.48" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-09-30T00:47:47Z +arches = ["aarch64", "x86_64"] +version = "9.3.0" diff --git a/advisories/9.3.0/BRSA-hr7vf473g1p9.toml b/advisories/9.3.0/BRSA-hr7vf473g1p9.toml new file mode 100644 index 00000000..6fd1e4ca --- /dev/null +++ b/advisories/9.3.0/BRSA-hr7vf473g1p9.toml @@ -0,0 +1,16 @@ +[advisory] +id = "BRSA-hr7vf473g1p9" +title = "Bottlerocket Kernel 6.18 Updates" +severity = "high" +description = "Kernel version 6.18.51 is now available with important fixes. All users must upgrade. Advisory information for kernel is often published after new kernels become available. Bottlerocket recommends that you consume the latest kernel release for your LTS version." + +[[advisory.products]] +package-name = "kernel-6.18" +patched-version = "6.18.51" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-09-30T00:47:47Z +arches = ["aarch64", "x86_64"] +version = "9.3.0" diff --git a/advisories/9.3.0/BRSA-if2iijg8itxm.toml b/advisories/9.3.0/BRSA-if2iijg8itxm.toml new file mode 100644 index 00000000..ddd72d24 --- /dev/null +++ b/advisories/9.3.0/BRSA-if2iijg8itxm.toml @@ -0,0 +1,16 @@ +[advisory] +id = "BRSA-if2iijg8itxm" +title = "Bottlerocket Kernel 6.12 Updates" +severity = "high" +description = "Kernel version 6.12.110 is now available with important fixes. All users must upgrade. Advisory information for kernel is often published after new kernels become available. Bottlerocket recommends that you consume the latest kernel release for your LTS version." + +[[advisory.products]] +package-name = "kernel-6.12" +patched-version = "6.12.110" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-09-30T00:47:47Z +arches = ["aarch64", "x86_64"] +version = "9.3.0" diff --git a/advisories/9.3.0/BRSA-lj56i0r9ce4p.toml b/advisories/9.3.0/BRSA-lj56i0r9ce4p.toml new file mode 100644 index 00000000..121d0438 --- /dev/null +++ b/advisories/9.3.0/BRSA-lj56i0r9ce4p.toml @@ -0,0 +1,17 @@ +[advisory] +id = "BRSA-lj56i0r9ce4p" +title = "kernel CVE-2026-72398" +cve = "CVE-2026-72398" +severity = "high" +description = "In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking" + +[[advisory.products]] +package-name = "kernel-6.12" +patched-version = "6.12.103" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-09-30T00:47:47Z +arches = ["aarch64", "x86_64"] +version = "9.3.0" diff --git a/advisories/9.3.0/BRSA-mzmgg9jyr6xg.toml b/advisories/9.3.0/BRSA-mzmgg9jyr6xg.toml new file mode 100644 index 00000000..4bbe8b17 --- /dev/null +++ b/advisories/9.3.0/BRSA-mzmgg9jyr6xg.toml @@ -0,0 +1,27 @@ +[advisory] +id = "BRSA-mzmgg9jyr6xg" +title = "kernel CVE-2026-81000" +cve = "CVE-2026-81000" +severity = "high" +description = "In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom" + +[[advisory.products]] +package-name = "kernel-6.1" +patched-version = "6.1.186" +patched-epoch = "0" + +[[advisory.products]] +package-name = "kernel-6.12" +patched-version = "6.12.103" +patched-epoch = "0" + +[[advisory.products]] +package-name = "kernel-6.18" +patched-version = "6.18.48" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-09-30T00:47:47Z +arches = ["aarch64", "x86_64"] +version = "9.3.0" diff --git a/advisories/9.3.0/BRSA-qqjzrp0dxff8.toml b/advisories/9.3.0/BRSA-qqjzrp0dxff8.toml new file mode 100644 index 00000000..dfa38ebd --- /dev/null +++ b/advisories/9.3.0/BRSA-qqjzrp0dxff8.toml @@ -0,0 +1,17 @@ +[advisory] +id = "BRSA-qqjzrp0dxff8" +title = "kernel CVE-2026-64058" +cve = "CVE-2026-64058" +severity = "high" +description = "In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_folio() to wait on writeback" + +[[advisory.products]] +package-name = "kernel-6.12" +patched-version = "6.12.103" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-09-30T00:47:47Z +arches = ["aarch64", "x86_64"] +version = "9.3.0" diff --git a/advisories/9.3.0/BRSA-ufhk7pp1glia.toml b/advisories/9.3.0/BRSA-ufhk7pp1glia.toml new file mode 100644 index 00000000..4c19f75d --- /dev/null +++ b/advisories/9.3.0/BRSA-ufhk7pp1glia.toml @@ -0,0 +1,16 @@ +[advisory] +id = "BRSA-ufhk7pp1glia" +title = "Bottlerocket Kernel 6.1 Updates" +severity = "high" +description = "Kernel version 6.1.188 is now available with important fixes. All users must upgrade. Advisory information for kernel is often published after new kernels become available. Bottlerocket recommends that you consume the latest kernel release for your LTS version." + +[[advisory.products]] +package-name = "kernel-6.1" +patched-version = "6.1.188" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-09-30T00:47:47Z +arches = ["aarch64", "x86_64"] +version = "9.3.0" From 8906368d0c90fc36671fdf591a4e43319dc7a8f7 Mon Sep 17 00:00:00 2001 From: Piyush Jena Date: Fri, 2 Oct 2026 00:30:33 +0000 Subject: [PATCH 2/2] advisories: add BRSAs for kernel-kit v9.4.0 Signed-off-by: Piyush Jena --- advisories/9.4.0/BRSA-2guzc3e6ng3v.toml | 16 +++++++++++++++ advisories/9.4.0/BRSA-552kjxdvhx36.toml | 16 +++++++++++++++ advisories/9.4.0/BRSA-6hwsn2qrbtk5.toml | 27 +++++++++++++++++++++++++ advisories/9.4.0/BRSA-u22ue727cp0l.toml | 16 +++++++++++++++ 4 files changed, 75 insertions(+) create mode 100644 advisories/9.4.0/BRSA-2guzc3e6ng3v.toml create mode 100644 advisories/9.4.0/BRSA-552kjxdvhx36.toml create mode 100644 advisories/9.4.0/BRSA-6hwsn2qrbtk5.toml create mode 100644 advisories/9.4.0/BRSA-u22ue727cp0l.toml diff --git a/advisories/9.4.0/BRSA-2guzc3e6ng3v.toml b/advisories/9.4.0/BRSA-2guzc3e6ng3v.toml new file mode 100644 index 00000000..29a1fc78 --- /dev/null +++ b/advisories/9.4.0/BRSA-2guzc3e6ng3v.toml @@ -0,0 +1,16 @@ +[advisory] +id = "BRSA-2guzc3e6ng3v" +title = "Bottlerocket Kernel 6.18 Updates" +severity = "high" +description = "Kernel version 6.18.51 is now available with important fixes. All users must upgrade. Advisory information for kernel is often published after new kernels become available. Bottlerocket recommends that you consume the latest kernel release for your LTS version." + +[[advisory.products]] +package-name = "kernel-6.18" +patched-version = "6.18.51" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-10-01T22:15:51Z +arches = ["aarch64", "x86_64"] +version = "9.4.0" diff --git a/advisories/9.4.0/BRSA-552kjxdvhx36.toml b/advisories/9.4.0/BRSA-552kjxdvhx36.toml new file mode 100644 index 00000000..cd5930ed --- /dev/null +++ b/advisories/9.4.0/BRSA-552kjxdvhx36.toml @@ -0,0 +1,16 @@ +[advisory] +id = "BRSA-552kjxdvhx36" +title = "Bottlerocket Kernel 6.1 Updates" +severity = "high" +description = "Kernel version 6.1.188 is now available with important fixes. All users must upgrade. Advisory information for kernel is often published after new kernels become available. Bottlerocket recommends that you consume the latest kernel release for your LTS version." + +[[advisory.products]] +package-name = "kernel-6.1" +patched-version = "6.1.188" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-10-01T22:15:51Z +arches = ["aarch64", "x86_64"] +version = "9.4.0" diff --git a/advisories/9.4.0/BRSA-6hwsn2qrbtk5.toml b/advisories/9.4.0/BRSA-6hwsn2qrbtk5.toml new file mode 100644 index 00000000..a3828de3 --- /dev/null +++ b/advisories/9.4.0/BRSA-6hwsn2qrbtk5.toml @@ -0,0 +1,27 @@ +[advisory] +id = "BRSA-6hwsn2qrbtk5" +title = "kernel CVE-2026-80521" +cve = "CVE-2026-80521" +severity = "high" +description = "In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge()." + +[[advisory.products]] +package-name = "kernel-6.1" +patched-version = "6.1.188" +patched-epoch = "0" + +[[advisory.products]] +package-name = "kernel-6.12" +patched-version = "6.12.110" +patched-epoch = "0" + +[[advisory.products]] +package-name = "kernel-6.18" +patched-version = "6.18.51" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-10-01T22:15:51Z +arches = ["aarch64", "x86_64"] +version = "9.4.0" diff --git a/advisories/9.4.0/BRSA-u22ue727cp0l.toml b/advisories/9.4.0/BRSA-u22ue727cp0l.toml new file mode 100644 index 00000000..525a2b8c --- /dev/null +++ b/advisories/9.4.0/BRSA-u22ue727cp0l.toml @@ -0,0 +1,16 @@ +[advisory] +id = "BRSA-u22ue727cp0l" +title = "Bottlerocket Kernel 6.12 Updates" +severity = "high" +description = "Kernel version 6.12.110 is now available with important fixes. All users must upgrade. Advisory information for kernel is often published after new kernels become available. Bottlerocket recommends that you consume the latest kernel release for your LTS version." + +[[advisory.products]] +package-name = "kernel-6.12" +patched-version = "6.12.110" +patched-epoch = "0" + +[updateinfo] +author = "jepiyush" +issue-date = 2026-10-01T22:15:51Z +arches = ["aarch64", "x86_64"] +version = "9.4.0"