almalinux/kernel-64k-debug-modules

Vulnerabilities (1,140)

• CVE-2026-64382HigJul 25, 2026
  affected < 6.12.0-211.49.1.el10_2fixed 6.12.0-211.49.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, cleanup retains the prev

• CVE-2026-64379HigJul 25, 2026
  affected < 6.12.0-211.49.1.el10_2fixed 6.12.0-211.49.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without masking to 07777. A

• CVE-2026-64368HigJul 25, 2026
  affected < 5.14.0-687.38.1.el9_8fixed 5.14.0-687.38.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled When init (zeroing) on allocation is requested, for kmalloc() we generally have to zero the full object size even if a smaller size is

• CVE-2026-64320CriJul 25, 2026
  affected < 6.12.0-211.50.1.el10_2fixed 6.12.0-211.50.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-supplied Log Page Offset (lpo). The 64-bit offset is then

• CVE-2026-64319CriJul 25, 2026
  affected < 5.14.0-687.45.1.el9_8fixed 5.14.0-687.45.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_reply() accesses the variable-length rval[] array using attacker-controlled hl (hash length) and dhvlen (DH value length) fie

• CVE-2026-64304HigJul 25, 2026
  affected < 6.12.0-211.50.1.el10_2fixed 6.12.0-211.50.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size D

• CVE-2026-64300HigJul 25, 2026
  affected < 6.12.0-211.47.1.el10_2fixed 6.12.0-211.47.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are serialized by rb->aux_m

• CVE-2026-64298HigJul 25, 2026
  affected < 6.12.0-211.50.1.el10_2fixed 6.12.0-211.50.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMO

• CVE-2026-64287HigJul 25, 2026
  affected < 5.14.0-687.45.1.el9_8fixed 5.14.0-687.45.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loo

• CVE-2026-64277HigJul 25, 2026
  affected < 5.14.0-687.42.1.el9_8fixed 5.14.0-687.42.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gp

• CVE-2026-64276HigJul 25, 2026
  affected < 5.14.0-687.42.1.el9_8fixed 5.14.0-687.42.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() itera

• CVE-2026-64268CriJul 25, 2026
  affected < 5.14.0-687.44.1.el9_8fixed 5.14.0-687.44.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accum

• CVE-2026-64255HigJul 24, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mas

• CVE-2026-64219HigJul 24, 2026
  affected < 6.12.0-211.49.1.el10_2fixed 6.12.0-211.49.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[

• CVE-2026-64191HigJul 20, 2026
  affected < 5.14.0-687.42.1.el9_8fixed 5.14.0-687.42.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avoid overrunning the

• CVE-2026-64189HigJul 20, 2026
  affected < 5.14.0-687.42.1.el9_8fixed 5.14.0-687.42.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the a

• CVE-2026-64176HigJul 19, 2026
  affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but rather their PLCP va

• CVE-2026-64175HigJul 19, 2026
  affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. However, iw

• CVE-2026-64174MedJul 19, 2026
  affected < 5.14.0-687.49.1.el9_8fixed 5.14.0-687.49.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its

• CVE-2026-64136CriJul 19, 2026
  affected < 6.12.0-211.50.1.el10_2fixed 6.12.0-211.50.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around