almalinux/kernel-abi-stablelists

Vulnerabilities (1,520)

• CVE-2026-64219HigJul 24, 2026
  affected < 4.18.0-553.156.1.el8_10fixed 4.18.0-553.156.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[

• CVE-2026-64191HigJul 20, 2026
  affected < 5.14.0-687.42.1.el9_8fixed 5.14.0-687.42.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avoid overrunning the

• CVE-2026-64189HigJul 20, 2026
  affected < 5.14.0-687.42.1.el9_8fixed 5.14.0-687.42.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the a

• CVE-2026-64176HigJul 19, 2026
  affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but rather their PLCP va

• CVE-2026-64175HigJul 19, 2026
  affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. However, iw

• CVE-2026-64136CriJul 19, 2026
  affected < 6.12.0-211.50.1.el10_2fixed 6.12.0-211.50.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around

• CVE-2026-64117HigJul 19, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() r

• CVE-2026-64113CriJul 19, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to t

• CVE-2026-64111HigJul 19, 2026
  affected < 6.12.0-211.55.1.el10_2fixed 6.12.0-211.55.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: lsm: hold cred_guard_mutex for lsm_set_self_attr() Just as proc_pid_attr_write() already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptr

• CVE-2026-64051HigJul 19, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remap_pfn_range during mmap The call to remap_pfn_range in qaic_gem_object_mmap is susceptible to (re)mapping beyond the VMA if the BO is too large. This can cause use after fr

• CVE-2026-64048HigJul 19, 2026
  affected < 5.14.0-687.41.1.el9_8fixed 5.14.0-687.41.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entri

• CVE-2026-64042HigJul 19, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting.

• CVE-2026-64037CriJul 19, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled When the TLC notification disables AMSDU for a TID, the MLD driver sets max_tid_amsdu_len to the sentinel value 1. The TSO segmentation

• CVE-2026-64034CriJul 19, 2026
  affected < 5.14.0-687.46.1.el9_8fixed 5.14.0-687.46.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-rea

• CVE-2026-64029HigJul 19, 2026
  affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_ump_client_open() an

• CVE-2026-64018CriJul 19, 2026
  affected < 6.12.0-211.50.1.el10_2fixed 6.12.0-211.50.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access In mana_hwc_rx_event_handler(), rx_req_idx is derived from sge->address in DMA-coherent memory. In Confidential VMs (SEV-SNP/TDX), this memor

• CVE-2026-64017HigJul 19, 2026
  affected < 5.14.0-687.31.1.el9_8fixed 5.14.0-687.31.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freei

• CVE-2026-64015HigJul 19, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc()

• CVE-2026-64007CriJul 19, 2026
  affected < 5.14.0-687.41.1.el9_8fixed 5.14.0-687.41.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-s

• CVE-2026-64002HigJul 19, 2026
  affected < 5.14.0-687.44.1.el9_8fixed 5.14.0-687.44.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports too soon. Only after unregister_net_sysctl