almalinux/kernel-debug-modules-core

Vulnerabilities (1,109)

• CVE-2026-53268HigJun 25, 2026
  affected < 5.14.0-687.42.1.el9_8fixed 5.14.0-687.42.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This helper should be depr

• CVE-2026-53266HigKEVJun 25, 2026
  affected < 5.14.0-687.23.1.el9_8fixed 5.14.0-687.23.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks th

• CVE-2026-53264HigJun 25, 2026
  affected < 6.12.0-211.47.1.el10_2fixed 6.12.0-211.47.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 r

• CVE-2026-53256HigJun 25, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock, but returns the selected listener after dropping that lock without taking a

• CVE-2026-53254HigJun 25, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb->data to protocol-specific structs without validating skb->len first. A malicious remote device can send truncated MCC fra

• CVE-2026-53246CriJun 25, 2026
  affected < 5.14.0-687.47.1.el9_8fixed 5.14.0-687.47.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its paramete

• CVE-2026-53239HigJun 25, 2026
  affected < 6.12.0-211.55.1.el10_2fixed 6.12.0-211.55.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_prune_bin() directl

• CVE-2026-53223HigJun 25, 2026
  affected < 5.14.0-687.46.1.el9_8fixed 5.14.0-687.46.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packe

• CVE-2026-53209HigJun 25, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broad

• CVE-2026-53202HigJun 25, 2026
  affected < 6.12.0-211.47.1.el10_2fixed 6.12.0-211.47.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied data_size is cast to signed int before being used in min_t(). Large unsigned values (>= 0x80000000)

• CVE-2026-53196MedJun 25, 2026
  affected < 6.12.0-211.50.1.el10_2fixed 6.12.0-211.50.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which is sizeof(struct e

• CVE-2026-53193HigJun 25, 2026
  affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tries to unlink all i

• CVE-2026-53192HigJun 25, 2026
  affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances an

• CVE-2026-53189HigJun 25, 2026
  affected < 5.14.0-687.41.1.el9_8fixed 5.14.0-687.41.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: update file PMD counter before folio_put() __split_huge_pmd_locked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. If folio_put() drops the last reference

• CVE-2026-53185HigJun 25, 2026
  affected < 5.14.0-687.42.1.el9_8fixed 5.14.0-687.42.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio

• CVE-2026-53182HigJun 25, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211_parse_rnr_elems() stores the parsed element count in a u8-backed cfg80211_rnr_elems::cnt field and uses that count to size the flexible array allocation. R

• CVE-2026-53176CriJun 25, 2026
  affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN wit

• CVE-2026-53166Jun 25, 2026
  affected < 5.14.0-687.25.1.el9_8fixed 5.14.0-687.25.1.el9_8

  Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

• CVE-2026-53153HigJun 25, 2026
  affected < 6.12.0-211.50.1.el10_2fixed 6.12.0-211.50.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. Th

• CVE-2026-53143HigJun 25, 2026
  affected < 6.12.0-211.49.1.el10_2fixed 6.12.0-211.49.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These funct