rpm package
almalinux/kernel-64k-debug-modules
pkg:rpm/almalinux/kernel-64k-debug-modules
Vulnerabilities (1,125)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-46331 | Hig | 7.8 | < 6.12.0-211.26.1.el10_2 | 6.12.0-211.26.1.el10_2 | Jun 16, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account | |
| CVE-2026-46330 | Hig | 7.8 | < 5.14.0-687.46.1.el9_8 | 5.14.0-687.46.1.el9_8 | Jun 9, 2026 | In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The implementation attempt | |
| CVE-2026-46323 | Hig | 7.8 | < 5.14.0-687.22.1.el9_8 | 5.14.0-687.22.1.el9_8 | Jun 9, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_ | |
| CVE-2026-46316 | Cri | 9.3 | < 6.12.0-211.28.1.el10_2 | 6.12.0-211.28.1.el10_2 | Jun 9, 2026 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's reference on each en | |
| CVE-2025-10263 | Cri | 9.1 | < 6.12.0-211.30.1.el10_2 | 6.12.0-211.30.1.el10_2 | Jun 9, 2026 | Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher ex | |
| CVE-2026-46311 | Hig | 7.8 | < 5.14.0-687.52.1.el9_8 | 5.14.0-687.52.1.el9_8 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while | |
| CVE-2026-46306 | Hig | 7.5 | < 5.14.0-687.46.1.el9_8 | 5.14.0-687.46.1.el9_8 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE session | |
| CVE-2026-46303 | Hig | 8.2 | < 6.12.0-211.42.1.el10_2 | 6.12.0-211.42.1.el10_2 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block num | |
| CVE-2026-46266 | Cri | 9.1 | < 5.14.0-687.46.1.el9_8 | 5.14.0-687.46.1.el9_8 | Jun 3, 2026 | In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious in | |
| CVE-2026-46259 | Hig | 7.8 | < 5.14.0-687.22.1.el9_8 | 5.14.0-687.22.1.el9_8 | Jun 3, 2026 | In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 | |
| CVE-2026-46244 | Cri | 9.1 | < 6.12.0-211.30.1.el10_2 | 6.12.0-211.30.1.el10_2 | Jun 3, 2026 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, | |
| CVE-2026-46243 | Hig | 7.1 | < 6.12.0-211.20.1.el10_2 | 6.12.0-211.20.1.el10_2 | Jun 1, 2026 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating in | |
| CVE-2026-46242 | Hig | 7.8 | < 6.12.0-211.31.1.el10_2 | 6.12.0-211.31.1.el10_2 | May 30, 2026 | In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist | |
| CVE-2026-46230 | Hig | 7.1 | < 5.14.0-687.52.1.el9_8 | 5.14.0-687.52.1.el9_8 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg. | |
| CVE-2026-46227 | Hig | 7.8 | < 5.14.0-687.22.1.el9_8 | 5.14.0-687.22.1.el9_8 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before t | |
| CVE-2026-46215 | Hig | 7.8 | < 6.12.0-211.37.1.el10_2 | 6.12.0-211.37.1.el10_2 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could del | |
| CVE-2026-46209 | Hig | 7.8 | < 6.12.0-211.30.1.el10_2 | 6.12.0-211.30.1.el10_2 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned int width = mo | |
| CVE-2026-46204 | Hig | 7.1 | < 5.14.0-687.52.1.el9_8 | 5.14.0-687.52.1.el9_8 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the bounds checks. | |
| CVE-2026-46199 | Hig | 7.1 | < 5.14.0-687.52.1.el9_8 | 5.14.0-687.52.1.el9_8 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg. | |
| CVE-2026-46189 | Hig | 7.8 | < 5.14.0-687.19.1.el9_8 | 5.14.0-687.19.1.el9_8 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before triggers a double free. |
- affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account
- affected < 5.14.0-687.46.1.el9_8fixed 5.14.0-687.46.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The implementation attempt
- affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_
- affected < 6.12.0-211.28.1.el10_2fixed 6.12.0-211.28.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's reference on each en
- affected < 6.12.0-211.30.1.el10_2fixed 6.12.0-211.30.1.el10_2
Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher ex
- affected < 5.14.0-687.52.1.el9_8fixed 5.14.0-687.52.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while
- affected < 5.14.0-687.46.1.el9_8fixed 5.14.0-687.46.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE session
- affected < 6.12.0-211.42.1.el10_2fixed 6.12.0-211.42.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block num
- affected < 5.14.0-687.46.1.el9_8fixed 5.14.0-687.46.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious in
- affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0
- affected < 6.12.0-211.30.1.el10_2fixed 6.12.0-211.30.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers,
- affected < 6.12.0-211.20.1.el10_2fixed 6.12.0-211.20.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating in
- affected < 6.12.0-211.31.1.el10_2fixed 6.12.0-211.31.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist
- affected < 5.14.0-687.52.1.el9_8fixed 5.14.0-687.52.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg.
- affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before t
- affected < 6.12.0-211.37.1.el10_2fixed 6.12.0-211.37.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could del
- affected < 6.12.0-211.30.1.el10_2fixed 6.12.0-211.30.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned int width = mo
- affected < 5.14.0-687.52.1.el9_8fixed 5.14.0-687.52.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the bounds checks.
- affected < 5.14.0-687.52.1.el9_8fixed 5.14.0-687.52.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg.
- affected < 5.14.0-687.19.1.el9_8fixed 5.14.0-687.19.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before triggers a double free.
Page 11 of 57