almalinux/kernel-debug-core

Vulnerabilities (1,153)

• CVE-2025-40133Nov 12, 2025
  affected < 6.12.0-124.35.1.el10_1fixed 6.12.0-124.35.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable(). mptcp_active_enable() is called from subflow_finish_connect(), which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always under RCU. U

• CVE-2025-40096Oct 30, 2025
  affected < 4.18.0-553.94.1.el8_10fixed 4.18.0-553.94.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on success and failure,

• CVE-2025-40064Oct 28, 2025
  affected < 6.12.0-124.38.1.el10_1fixed 6.12.0-124.38.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in __pnet_find_base_ndev(). syzbot reported use-after-free of net_device in __pnet_find_base_ndev(), which was called during connect(). [0] smc_pnet_find_ism_resource() fetches sk_dst_g

• CVE-2025-40058Oct 28, 2025
  affected < 5.14.0-611.11.1.el9_7fixed 5.14.0-611.11.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succeed, the paging- st

• CVE-2025-40047Oct 28, 2025
  affected < 6.12.0-124.20.1.el10_1fixed 6.12.0-124.20.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful return, always remove our entry from the wait queue entry list. Previously this was skipped if a cancelation was in progress,

• CVE-2025-39993Oct 15, 2025
  affected < 4.18.0-553.92.1.el8_10fixed 4.18.0-553.92.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0

• CVE-2025-39984Oct 15, 2025
  affected < 6.12.0-124.21.1.el10_1fixed 6.12.0-124.21.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: net: tun: Update napi->skb after XDP process The syzbot report a UAF issue: BUG: KASAN: slab-use-after-free in skb_reset_mac_header include/linux/skbuff.h:3150 [inline] BUG: KASAN: slab-use-after-free in n

• CVE-2025-39983Oct 15, 2025
  affected < 6.12.0-124.20.1.el10_1fixed 6.12.0-124.20.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue This fixes the following UAF caused by not properly locking hdev when processing HCI_EV_NUM_COMP_PKTS: BUG: KASAN: slab-use-after-free in hci_conn_tx_dequeu

• CVE-2025-39982Oct 15, 2025
  affected < 6.12.0-124.20.1.el10_1fixed 6.12.0-124.20.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync This fixes the following UFA in hci_acl_create_conn_sync where a connection still pending is command submission (conn->state == BT_OPEN) maybe freed, al

• CVE-2025-39981Oct 15, 2025
  affected < 5.14.0-611.11.1.el9_7fixed 5.14.0-611.11.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible UAFs This attemps to fix possible UAFs caused by struct mgmt_pending being freed while still being processed like in the following trace, in order to fix mgmt_pending_valid is intr

• CVE-2025-39979Oct 15, 2025
  affected < 6.12.0-124.20.1.el10_1fixed 6.12.0-124.20.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, fix UAF in flow counter release Fix a kernel trace [1] caused by releasing an HWS action of a local flow counter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and mutex were not init

• CVE-2025-39971Oct 15, 2025
  affected < 4.18.0-553.85.1.el8_10fixed 4.18.0-553.85.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_vc_config_queues_msg().

• CVE-2025-39966Oct 15, 2025
  affected < 5.14.0-611.16.1.el9_7fixed 5.14.0-611.16.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_operations release() synchronously, it puts the file on a work queue and it will be released eventually. This is normally f

• CVE-2025-39955Oct 9, 2025
  affected < 6.12.0-124.13.1.el10_1fixed 6.12.0-124.13.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported the splat below where a socket had tcp_sk(sk)->fastopen_rsk in the TCP_ESTABLISHED state. [0] syzbot reused the server-side TCP Fast Ope

• CVE-2023-53673HigOct 7, 2025
  affected < 4.18.0-553.97.1.el8_10fixed 4.18.0-553.97.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connections refer to the hci_conn without hci_conn_

• CVE-2022-50543Oct 7, 2025
  affected < 4.18.0-553.89.1.el8_10fixed 4.18.0-553.89.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix mr->map double free rxe_mr_cleanup() which tries to free mr->map again will be called when rxe_mr_init_user() fails: CPU: 0 PID: 4917 Comm: rdma_flush_serv Kdump: loaded Not tainted 6.1.0-rc1-

• CVE-2023-53552Oct 4, 2025
  affected < 4.18.0-553.94.1.el8_10fixed 4.18.0-553.94.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References to i915_requests may be trapped by userspace inside a sync_file or dmabuf (dma-resv) and held indefinitely across different pro

• CVE-2023-53539Oct 4, 2025
  affected < 4.18.0-553.89.1.el8_10fixed 4.18.0-553.89.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix incomplete state save in rxe_requester If a send packet is dropped by the IP layer in rxe_requester() the call to rxe_xmit_packet() can fail with err == -EAGAIN. To recover, the state of the wqe i

• CVE-2025-39933Oct 4, 2025
  affected < 4.18.0-553.94.1.el8_10fixed 4.18.0-553.94.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes.

• CVE-2023-53513MedOct 1, 2025
  affected < 4.18.0-553.87.1.el8_10fixed 4.18.0-553.87.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: nbd: fix incomplete validation of ioctl arg We tested and found an alarm caused by nbd_ioctl arg without verification. The UBSAN warning calltrace like below: UBSAN: Undefined behaviour in fs/buffer.c:1709:35