almalinux/bpftool

Vulnerabilities (1,073)

• CVE-2025-68741CriDec 24, 2025
  affected < 4.18.0-553.120.1.el8_10fixed 4.18.0-553.120.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The qla24xx_alloc_pur

• CVE-2025-68724HigDec 24, 2025
  affected < 4.18.0-553.123.1.el8_10fixed 4.18.0-553.123.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetric_k

• CVE-2025-68366Dec 24, 2025
  affected < 4.18.0-553.132.1.el8_10fixed 4.18.0-553.132.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 nbd_start_devic

• CVE-2025-68349HigDec 24, 2025
  affected < 4.18.0-553.104.1.el8_10fixed 4.18.0-553.104.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode pnfs

• CVE-2025-68347HigDec 24, 2025
  affected < 4.18.0-553.126.1.el8_10fixed 4.18.0-553.126.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events The DSP event handling code in hwdep_read() could write more bytes to the user buffer than requested, when a user provides a buffer smaller

• CVE-2025-68301CriDec 16, 2025
  affected < 4.18.0-553.94.1.el8_10fixed 4.18.0-553.94.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of-b

• CVE-2025-68285CriDec 16, 2025
  affected < 4.18.0-553.92.1.el8_10fixed 4.18.0-553.92.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both

• CVE-2025-68183HigDec 16, 2025
  affected < 4.18.0-553.126.1.el8_10fixed 4.18.0-553.126.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in se

• CVE-2022-50673HigDec 9, 2025
  affected < 4.18.0-553.104.1.el8_10fixed 4.18.0-553.104.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+0x28/0x1a0 Read o

• CVE-2023-53781HigDec 9, 2025
  affected < 4.18.0-553.132.1.el8_10fixed 4.18.0-553.132.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in tcp_write_timer_handler(). With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC creates a kernel so

• CVE-2023-53762HigDec 8, 2025
  affected < 4.18.0-553.105.1.el8_10fixed 4.18.0-553.105.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. To prevent this the code n

• CVE-2025-40322HigDec 8, 2025
  affected < 4.18.0-553.100.1.el8_10fixed 4.18.0-553.100.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and

• CVE-2025-40304HigDec 8, 2025
  affected < 4.18.0-553.105.1.el8_10fixed 4.18.0-553.105.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is of

• CVE-2025-40277HigDec 6, 2025
  affected < 4.18.0-553.97.1.el8_10fixed 4.18.0-553.97.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds acc

• CVE-2025-40271HigDec 6, 2025
  affected < 4.18.0-553.100.1.el8_10fixed 4.18.0-553.100.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EM

• CVE-2025-40269HigDec 6, 2025
  affected < 4.18.0-553.104.1.el8_10fixed 4.18.0-553.104.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamically. The packet siz

• CVE-2025-40258CriDec 4, 2025
  affected < 4.18.0-553.100.1.el8_10fixed 4.18.0-553.100.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt i

• CVE-2025-40252CriDec 4, 2025
  affected < 4.18.0-553.123.1.el8_10fixed 4.18.0-553.123.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator a

• CVE-2025-40248HigDec 4, 2025
  affected < 4.18.0-553.97.1.el8_10fixed 4.18.0-553.97.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connect() invoking vsock

• CVE-2025-40240HigDec 4, 2025
  affected < 4.18.0-553.92.1.el8_10fixed 4.18.0-553.92.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->head_skb is not. Che