rpm package
almalinux/kernel-abi-stablelists
pkg:rpm/almalinux/kernel-abi-stablelists
Vulnerabilities (1,161)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-38087 | — | < 6.12.0-55.25.1.el10_0 | 6.12.0-55.25.1.el10_0 | Jun 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in taprio_dev_notifier Since taprio’s taprio_dev_notifier() isn’t protected by an RCU read-side critical section, a race with advance_sched() can lead to a use-after-free. Adding | ||
| CVE-2025-38086 | — | < 4.18.0-553.63.1.el8_10 | 4.18.0-553.63.1.el8_10 | Jun 28, 2025 | In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called "buff" | ||
| CVE-2025-38085 | — | < 4.18.0-553.69.1.el8_10 | 4.18.0-553.69.1.el8_10 | Jun 28, 2025 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table us | ||
| CVE-2025-38084 | — | < 5.14.0-570.35.1.el9_6 | 5.14.0-570.35.1.el9_6 | Jun 28, 2025 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables during VMA split, not before Currently, __split_vma() triggers hugetlb page table unsharing through vm_ops->may_split(). This happens before the VMA lock and rmap locks are take | ||
| CVE-2022-50228 | — | < 4.18.0-553.79.1.el8_10 | 4.18.0-553.79.1.el8_10 | Jun 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KVM_SET_VCPU_EVENTS ( | ||
| CVE-2022-50087 | — | < 4.18.0-553.77.1.el8_10 | 4.18.0-553.77.1.el8_10 | Jun 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the probe succeeds. If it | ||
| CVE-2022-50020 | — | < 4.18.0-553.66.1.el8_10 | 4.18.0-553.66.1.el8_10 | Jun 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid resizing to a partial cluster size This patch avoids an attempt to resize the filesystem to an unaligned cluster boundary. An online resize to a size that is not integral to cluster size results in | ||
| CVE-2022-49985 | — | < 4.18.0-553.74.1.el8_10 | 4.18.0-553.74.1.el8_10 | Jun 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: bpf: Don't use tnum_range on array range checking for poke descriptors Hsin-Wei reported a KASAN splat triggered by their BPF runtime fuzzer which is based on a customized syzkaller: BUG: KASAN: slab-out-of- | ||
| CVE-2022-49977 | — | < 4.18.0-553.64.1.el8_10 | 4.18.0-553.64.1.el8_10 | Jun 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_function ftrace_star | ||
| CVE-2025-38079 | Hig | 7.8 | < 4.18.0-553.66.1.el8_10 | 4.18.0-553.66.1.el8_10 | Jun 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_relea | |
| CVE-2025-38052 | — | < 6.12.0-55.25.1.el10_0 | 6.12.0-55.25.1.el10_0 | Jun 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done Syzbot reported a slab-use-after-free with the following call trace: ================================================================== BUG: | ||
| CVE-2025-38051 | — | < 4.18.0-553.94.1.el8_10 | 4.18.0-553.94.1.el8_10 | Jun 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the following KASAN warni | ||
| CVE-2025-38024 | — | < 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 | Jun 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_description mm/kasan/ | ||
| CVE-2025-38022 | — | < 4.18.0-553.100.1.el8_10 | 4.18.0-553.100.1.el8_10 | Jun 18, 2025 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description | ||
| CVE-2025-37994 | — | < 6.12.0-124.8.1.el10_1 | 6.12.0-124.8.1.el10_1 | May 29, 2025 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix NULL pointer access This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before proceeding with the p | ||
| CVE-2025-37958 | — | < 6.12.0-55.22.1.el10_0 | 6.12.0-55.22.1.el10_0 | May 20, 2025 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address access, as illustrate | ||
| CVE-2025-37943 | — | < 5.14.0-570.21.1.el9_6 | 5.14.0-570.21.1.el9_6 | May 20, 2025 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessi | ||
| CVE-2025-37914 | — | < 4.18.0-553.70.1.el8_10 | 4.18.0-553.70.1.el8_10 | May 20, 2025 | In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant | ||
| CVE-2025-37890 | — | < 6.12.0-55.25.1.el10_0 | 6.12.0-55.25.1.el10_0 | May 16, 2025 | In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfs | ||
| CVE-2024-28956 | Med | 5.6 | < 5.14.0-570.35.1.el9_6 | 5.14.0-570.35.1.el9_6 | May 13, 2025 | Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. |
- CVE-2025-38087Jun 30, 2025affected < 6.12.0-55.25.1.el10_0fixed 6.12.0-55.25.1.el10_0
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in taprio_dev_notifier Since taprio’s taprio_dev_notifier() isn’t protected by an RCU read-side critical section, a race with advance_sched() can lead to a use-after-free. Adding
- CVE-2025-38086Jun 28, 2025affected < 4.18.0-553.63.1.el8_10fixed 4.18.0-553.63.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called "buff"
- CVE-2025-38085Jun 28, 2025affected < 4.18.0-553.69.1.el8_10fixed 4.18.0-553.69.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table us
- CVE-2025-38084Jun 28, 2025affected < 5.14.0-570.35.1.el9_6fixed 5.14.0-570.35.1.el9_6
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables during VMA split, not before Currently, __split_vma() triggers hugetlb page table unsharing through vm_ops->may_split(). This happens before the VMA lock and rmap locks are take
- CVE-2022-50228Jun 18, 2025affected < 4.18.0-553.79.1.el8_10fixed 4.18.0-553.79.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KVM_SET_VCPU_EVENTS (
- CVE-2022-50087Jun 18, 2025affected < 4.18.0-553.77.1.el8_10fixed 4.18.0-553.77.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the probe succeeds. If it
- CVE-2022-50020Jun 18, 2025affected < 4.18.0-553.66.1.el8_10fixed 4.18.0-553.66.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid resizing to a partial cluster size This patch avoids an attempt to resize the filesystem to an unaligned cluster boundary. An online resize to a size that is not integral to cluster size results in
- CVE-2022-49985Jun 18, 2025affected < 4.18.0-553.74.1.el8_10fixed 4.18.0-553.74.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: bpf: Don't use tnum_range on array range checking for poke descriptors Hsin-Wei reported a KASAN splat triggered by their BPF runtime fuzzer which is based on a customized syzkaller: BUG: KASAN: slab-out-of-
- CVE-2022-49977Jun 18, 2025affected < 4.18.0-553.64.1.el8_10fixed 4.18.0-553.64.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_function ftrace_star
- affected < 4.18.0-553.66.1.el8_10fixed 4.18.0-553.66.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_relea
- CVE-2025-38052Jun 18, 2025affected < 6.12.0-55.25.1.el10_0fixed 6.12.0-55.25.1.el10_0
In the Linux kernel, the following vulnerability has been resolved: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done Syzbot reported a slab-use-after-free with the following call trace: ================================================================== BUG:
- CVE-2025-38051Jun 18, 2025affected < 4.18.0-553.94.1.el8_10fixed 4.18.0-553.94.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifs_fill_dirent There is a race condition in the readdir concurrency process, which may access the rsp buffer after it has been released, triggering the following KASAN warni
- CVE-2025-38024Jun 18, 2025affected < 4.18.0-553.100.1.el8_10fixed 4.18.0-553.100.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_description mm/kasan/
- CVE-2025-38022Jun 18, 2025affected < 4.18.0-553.100.1.el8_10fixed 4.18.0-553.100.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description
- CVE-2025-37994May 29, 2025affected < 6.12.0-124.8.1.el10_1fixed 6.12.0-124.8.1.el10_1
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix NULL pointer access This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before proceeding with the p
- CVE-2025-37958May 20, 2025affected < 6.12.0-55.22.1.el10_0fixed 6.12.0-55.22.1.el10_0
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address access, as illustrate
- CVE-2025-37943May 20, 2025affected < 5.14.0-570.21.1.el9_6fixed 5.14.0-570.21.1.el9_6
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessi
- CVE-2025-37914May 20, 2025affected < 4.18.0-553.70.1.el8_10fixed 4.18.0-553.70.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant
- CVE-2025-37890May 16, 2025affected < 6.12.0-55.25.1.el10_0fixed 6.12.0-55.25.1.el10_0
In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfs
- affected < 5.14.0-570.35.1.el9_6fixed 5.14.0-570.35.1.el9_6
Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Page 10 of 59