rpm package
almalinux/bpftool
pkg:rpm/almalinux/bpftool
Vulnerabilities (1,073)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-39864 | Hig | 8.8 | < 4.18.0-553.82.1.el8_10 | 4.18.0-553.82.1.el8_10 | Sep 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bss() to free the las | |
| CVE-2025-39849 | Hig | 8.8 | < 4.18.0-553.81.1.el8_10 | 4.18.0-553.81.1.el8_10 | Sep 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking. | |
| CVE-2025-39841 | Cri | 9.8 | < 4.18.0-553.81.1.el8_10 | 4.18.0-553.81.1.el8_10 | Sep 19, 2025 | In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only t | |
| CVE-2023-53401 | Med | 4.7 | < 4.18.0-553.89.1.el8_10 | 4.18.0-553.89.1.el8_10 | Sep 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference: ================== | |
| CVE-2023-53386 | Hig | 7.8 | < 4.18.0-553.81.1.el8_10 | 4.18.0-553.81.1.el8_10 | Sep 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix potential use-after-free when clear keys Similar to commit c5d2b6fa26b5 ("Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk"). We can not access k after kfree_rcu() call. | |
| CVE-2023-53373 | Hig | 7.8 | < 4.18.0-553.80.1.el8_10 | 4.18.0-553.80.1.el8_10 | Sep 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller | |
| CVE-2022-50386 | Hig | 8.8 | < 4.18.0-553.81.1.el8_10 | 4.18.0-553.81.1.el8_10 | Sep 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct | |
| CVE-2022-50367 | Hig | 7.8 | < 4.18.0-553.83.1.el8_10 | 4.18.0-553.83.1.el8_10 | Sep 17, 2025 | In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode( | |
| CVE-2023-53305 | Hig | 8.8 | < 4.18.0-553.79.1.el8_10 | 4.18.0-553.79.1.el8_10 | Sep 16, 2025 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free Fix potential use-after-free in l2cap_le_command_rej. | |
| CVE-2025-39825 | Hig | 7.8 | < 4.18.0-553.87.1.el8_10 | 4.18.0-553.87.1.el8_10 | Sep 16, 2025 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as | |
| CVE-2025-39817 | Hig | 7.1 | < 4.18.0-553.81.1.el8_10 | 4.18.0-553.81.1.el8_10 | Sep 16, 2025 | In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 | |
| CVE-2023-53297 | Hig | 8.8 | < 4.18.0-553.81.1.el8_10 | 4.18.0-553.81.1.el8_10 | Sep 16, 2025 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance' is triggered. | |
| CVE-2023-53257 | Hig | 7.1 | < 4.18.0-553.82.1.el8_10 | 4.18.0-553.82.1.el8_10 | Sep 15, 2025 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check S1G action frame size Before checking the action code, check that it even exists in the frame. | |
| CVE-2023-53226 | Hig | 8.8 | < 4.18.0-553.82.1.el8_10 | 4.18.0-553.82.1.el8_10 | Sep 15, 2025 | In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix OOB and integer underflow when rx packets Make sure mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, mwifiex_uap_queue_bridged_pkt and mwifiex_pro | |
| CVE-2023-53178 | Hig | 7.8 | < 4.18.0-553.83.1.el8_10 | 4.18.0-553.83.1.el8_10 | Sep 15, 2025 | In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was written to a different | |
| CVE-2025-40300 | Med | 5.5 | < 4.18.0-553.83.1.el8_10 | 4.18.0-553.83.1.el8_10 | Sep 11, 2025 | In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already | |
| CVE-2025-39760 | Hig | 7.1 | < 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 | Sep 11, 2025 | In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this | |
| CVE-2025-39757 | Hig | 7.1 | < 4.18.0-553.80.1.el8_10 | 4.18.0-553.80.1.el8_10 | Sep 11, 2025 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer s | |
| CVE-2025-39730 | Hig | 7.8 | < 4.18.0-553.78.1.el8_10 | 4.18.0-553.78.1.el8_10 | Sep 7, 2025 | In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle. | |
| CVE-2025-39718 | Hig | 8.4 | < 4.18.0-553.84.1.el8_10 | 4.18.0-553.84.1.el8_10 | Sep 5, 2025 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_ |
- affected < 4.18.0-553.82.1.el8_10fixed 4.18.0-553.82.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bss() to free the las
- affected < 4.18.0-553.81.1.el8_10fixed 4.18.0-553.81.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking.
- affected < 4.18.0-553.81.1.el8_10fixed 4.18.0-553.81.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only t
- affected < 4.18.0-553.89.1.el8_10fixed 4.18.0-553.89.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference: ==================
- affected < 4.18.0-553.81.1.el8_10fixed 4.18.0-553.81.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix potential use-after-free when clear keys Similar to commit c5d2b6fa26b5 ("Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk"). We can not access k after kfree_rcu() call.
- affected < 4.18.0-553.80.1.el8_10fixed 4.18.0-553.80.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller
- affected < 4.18.0-553.81.1.el8_10fixed 4.18.0-553.81.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct
- affected < 4.18.0-553.83.1.el8_10fixed 4.18.0-553.83.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode(
- affected < 4.18.0-553.79.1.el8_10fixed 4.18.0-553.79.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free Fix potential use-after-free in l2cap_le_command_rej.
- affected < 4.18.0-553.87.1.el8_10fixed 4.18.0-553.87.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as
- affected < 4.18.0-553.81.1.el8_10fixed 4.18.0-553.81.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190
- affected < 4.18.0-553.81.1.el8_10fixed 4.18.0-553.81.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance' is triggered.
- affected < 4.18.0-553.82.1.el8_10fixed 4.18.0-553.82.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check S1G action frame size Before checking the action code, check that it even exists in the frame.
- affected < 4.18.0-553.82.1.el8_10fixed 4.18.0-553.82.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix OOB and integer underflow when rx packets Make sure mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, mwifiex_uap_queue_bridged_pkt and mwifiex_pro
- affected < 4.18.0-553.83.1.el8_10fixed 4.18.0-553.83.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was written to a different
- affected < 4.18.0-553.83.1.el8_10fixed 4.18.0-553.83.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already
- affected < 4.18.0-553.100.1.el8_10fixed 4.18.0-553.100.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this
- affected < 4.18.0-553.80.1.el8_10fixed 4.18.0-553.80.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer s
- affected < 4.18.0-553.78.1.el8_10fixed 4.18.0-553.78.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle.
- affected < 4.18.0-553.84.1.el8_10fixed 4.18.0-553.84.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_
Page 12 of 54