rpm package
almalinux/bpftool
pkg:rpm/almalinux/bpftool
Vulnerabilities (901)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-46333 | Hig | 7.1 | < 4.18.0-553.125.1.el8_10 | 4.18.0-553.125.1.el8_10 | May 15, 2026 | In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when y | |
| CVE-2026-46300 | imp | 7.8 | < 4.18.0-553.125.1.el8_10 | 4.18.0-553.125.1.el8_10 | May 13, 2026 | kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel | |
| CVE-2026-43284 | Hig | 8.8 | < 4.18.0-553.124.1.el8_10 | 4.18.0-553.124.1.el8_10 | May 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths th | |
| CVE-2026-31431 | Hig | 7.8 | KEV | < 4.18.0-553.123.1.el8_10 | 4.18.0-553.123.1.el8_10 | Apr 22, 2026 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the so |
| CVE-2026-31402 | Cri | 9.8 | < 4.18.0-553.123.1.el8_10 | 4.18.0-553.123.1.el8_10 | Apr 3, 2026 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size was calculated bas | |
| CVE-2026-23401 | Med | 5.5 | < 4.18.0-553.123.1.el8_10 | 4.18.0-553.123.1.el8_10 | Apr 1, 2026 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa | |
| CVE-2025-71238 | — | < 4.18.0-553.117.1.el8_10 | 4.18.0-553.117.1.el8_10 | Mar 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353358.825194] #PF: supervisor write access | ||
| CVE-2026-23231 | Hig | 7.8 | < 4.18.0-553.117.1.el8_10 | 4.18.0-553.117.1.el8_10 | Mar 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_reg | |
| CVE-2026-23209 | Hig | 7.8 | < 4.18.0-553.115.1.el8_10 | 4.18.0-553.115.1.el8_10 | Feb 14, 2026 | In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip l | |
| CVE-2026-23204 | Hig | 7.1 | < 4.18.0-553.115.1.el8_10 | 4.18.0-553.115.1.el8_10 | Feb 14, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a report and a repro f | |
| CVE-2026-23193 | Hig | 8.8 | < 4.18.0-553.117.1.el8_10 | 4.18.0-553.117.1.el8_10 | Feb 14, 2026 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connecti | |
| CVE-2026-23191 | Hig | 7.8 | < 4.18.0-553.120.1.el8_10 | 4.18.0-553.120.1.el8_10 | Feb 14, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop | |
| CVE-2026-23074 | Hig | 7.8 | < 4.18.0-553.107.1.el8_10 | 4.18.0-553.107.1.el8_10 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not important, I will desc | |
| CVE-2026-23097 | — | < 4.18.0-553.109.1.el8_10 | 4.18.0-553.109.1.el8_10 | Feb 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2) Task (5754): Hol | ||
| CVE-2026-23001 | Hig | 7.8 | < 4.18.0-553.111.1.el8_10 | 4.18.0-553.111.1.el8_10 | Jan 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace | |
| CVE-2026-22998 | Hig | 7.5 | < 4.18.0-553.104.1.el8_10 | 4.18.0-553.104.1.el8_10 | Jan 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset va | |
| CVE-2025-68800 | — | < 4.18.0-553.107.1.el8_10 | 4.18.0-553.107.1.el8_10 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not change while the driver | ||
| CVE-2025-71085 | — | < 4.18.0-553.111.1.el8_10 | 4.18.0-553.111.1.el8_10 | Jan 13, 2026 | In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of t | ||
| CVE-2022-50865 | — | < 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_rcvbuf, sk_sndbuf an | ||
| CVE-2025-68741 | — | < 4.18.0-553.120.1.el8_10 | 4.18.0-553.120.1.el8_10 | Dec 24, 2025 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The qla24xx_alloc_pur |
- affected < 4.18.0-553.125.1.el8_10fixed 4.18.0-553.125.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when y
- affected < 4.18.0-553.125.1.el8_10fixed 4.18.0-553.125.1.el8_10
kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel
- affected < 4.18.0-553.124.1.el8_10fixed 4.18.0-553.124.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths th
- affected < 4.18.0-553.123.1.el8_10fixed 4.18.0-553.123.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the so
- affected < 4.18.0-553.123.1.el8_10fixed 4.18.0-553.123.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size was calculated bas
- affected < 4.18.0-553.123.1.el8_10fixed 4.18.0-553.123.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa
- CVE-2025-71238Mar 4, 2026affected < 4.18.0-553.117.1.el8_10fixed 4.18.0-553.117.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353358.825194] #PF: supervisor write access
- affected < 4.18.0-553.117.1.el8_10fixed 4.18.0-553.117.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_reg
- affected < 4.18.0-553.115.1.el8_10fixed 4.18.0-553.115.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip l
- affected < 4.18.0-553.115.1.el8_10fixed 4.18.0-553.115.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a report and a repro f
- affected < 4.18.0-553.117.1.el8_10fixed 4.18.0-553.117.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connecti
- affected < 4.18.0-553.120.1.el8_10fixed 4.18.0-553.120.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop
- affected < 4.18.0-553.107.1.el8_10fixed 4.18.0-553.107.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not important, I will desc
- CVE-2026-23097Feb 4, 2026affected < 4.18.0-553.109.1.el8_10fixed 4.18.0-553.109.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2) Task (5754): Hol
- affected < 4.18.0-553.111.1.el8_10fixed 4.18.0-553.111.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace
- affected < 4.18.0-553.104.1.el8_10fixed 4.18.0-553.104.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset va
- CVE-2025-68800Jan 13, 2026affected < 4.18.0-553.107.1.el8_10fixed 4.18.0-553.107.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not change while the driver
- CVE-2025-71085Jan 13, 2026affected < 4.18.0-553.111.1.el8_10fixed 4.18.0-553.111.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of t
- CVE-2022-50865Dec 30, 2025affected < 4.18.0-553.100.1.el8_10fixed 4.18.0-553.100.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_rcvbuf, sk_sndbuf an
- CVE-2025-68741Dec 24, 2025affected < 4.18.0-553.120.1.el8_10fixed 4.18.0-553.120.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The qla24xx_alloc_pur
Page 1 of 46