almalinux/bpftool

Vulnerabilities (996)

• CVE-2026-46086MedMay 27, 2026
  affected < 4.18.0-553.144.1.el8_10fixed 4.18.0-553.144.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by `fdb_delete_local()`, which updates `f->dst` to another port or to `NULL` while keeping the entry alive.

• CVE-2026-46056HigMay 27, 2026
  affected < 4.18.0-553.134.1.el8_10fixed 4.18.0-553.134.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connec

• CVE-2026-46054HigMay 27, 2026
  affected < 4.18.0-553.137.1.el8_10fixed 4.18.0-553.137.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: selinux: fix overlayfs mmap() and mprotect() access checks The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "user" file) and the

• CVE-2026-45991HigMay 27, 2026
  affected < 4.18.0-553.155.1.el8_10fixed 4.18.0-553.155.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in part_descs_loc[]. handle_partition_descriptor() dedup

• CVE-2026-45984HigMay 27, 2026
  affected < 4.18.0-553.139.1.el8_10fixed 4.18.0-553.139.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data still points to di

• CVE-2026-45852HigMay 27, 2026
  affected < 4.18.0-553.132.1.el8_10fixed 4.18.0-553.132.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fails, the function cal

• CVE-2026-46300HigMay 23, 2026
  affected < 4.18.0-553.125.1.el8_10fixed 4.18.0-553.125.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally

• CVE-2026-46333HigMay 15, 2026
  affected < 4.18.0-553.125.1.el8_10fixed 4.18.0-553.125.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when y

• CVE-2025-54518HigMay 15, 2026
  affected < 4.18.0-553.153.1.el8_10fixed 4.18.0-553.153.1.el8_10

  Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.

• CVE-2026-43450HigMay 8, 2026
  affected < 4.18.0-553.140.1.el8_10fixed 4.18.0-553.140.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->arg

• CVE-2026-43329HigMay 8, 2026
  affected < 4.18.0-553.134.1.el8_10fixed 4.18.0-553.134.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethernet address) * SN

• CVE-2026-43284HigMay 8, 2026
  affected < 4.18.0-553.124.1.el8_10fixed 4.18.0-553.124.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths th

• CVE-2026-43279HigMay 6, 2026
  affected < 4.18.0-553.136.1.el8_10fixed 4.18.0-553.136.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received packets fit with the b

• CVE-2026-43206HigMay 6, 2026
  affected < 4.18.0-553.156.1.el8_10fixed 4.18.0-553.156.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivile

• CVE-2026-43198CriMay 6, 2026
  affected < 4.18.0-553.140.1.el8_10fixed 4.18.0-553.140.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible fro

• CVE-2026-43190HigMay 6, 2026
  affected < 4.18.0-553.126.1.el8_10fixed 4.18.0-553.126.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validating the remaining

• CVE-2026-43163MedMay 6, 2026
  affected < 4.18.0-553.126.1.el8_10fixed 4.18.0-553.126.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-free race between bit

• CVE-2026-43158HigMay 6, 2026
  affected < 4.18.0-553.126.1.el8_10fixed 4.18.0-553.126.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test VMs: ASSERT(ichdr-

• CVE-2026-43125CriMay 6, 2026
  affected < 4.18.0-553.132.1.el8_10fixed 4.18.0-553.132.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-bounds write in dlm

• CVE-2026-43116HigMay 6, 2026
  affected < 4.18.0-553.150.1.el8_10fixed 4.18.0-553.150.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->mas