almalinux/kernel-debug-uki-virt

Vulnerabilities (1,072)

• CVE-2026-31786HigApr 30, 2026
  affected < 5.14.0-687.13.1.el9_8fixed 5.14.0-687.13.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as sprintf in buildid

• CVE-2026-31692MedApr 30, 2026
  affected < 6.12.0-211.39.1.el10_2fixed 6.12.0-211.39.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: rtnetlink: add missing netlink_ns_capable() check for peer netns rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allo

• CVE-2026-31685CriApr 25, 2026
  affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 source address. The ex

• CVE-2026-31684MedApr 25, 2026
  affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net: sched: act_csum: validate nested VLAN headers tcf_csum_act() walks nested VLAN headers directly from skb->data when an skb still carries in-payload VLAN tags. The current code reads vlan->h_vlan_encapsulat

• CVE-2026-31677MedApr 25, 2026
  affected < 6.12.0-211.7.3.el10_2fixed 6.12.0-211.7.3.el10_2

  In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - limit RX SG extraction by receive buffer budget Make af_alg_get_rsgl() limit each RX scatterlist extraction to the remaining receive buffer budget. af_alg_get_rsgl() currently uses af_alg_read

• CVE-2026-31669CriApr 24, 2026
  affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side critical sections. Bot

• CVE-2026-31663HigApr 24, 2026
  affected < 6.12.0-211.55.1.el10_2fixed 6.12.0-211.55.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The skb->dev pointer is

• CVE-2026-31656HigApr 24, 2026
  affected < 5.14.0-687.47.1.el9_8fixed 5.14.0-687.47.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat A use-after-free / refcount underflow is possible when the heartbeat worker and intel_engine_park_heartbeat() race to release the same engine->

• CVE-2026-31641HigApr 24, 2026
  affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix RxGK token loading to check bounds rxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length from the XDR token as u32 values and passes each through round_up(x, 4) before using the ro

• CVE-2026-31636CriApr 24, 2026
  affected < 6.12.0-211.28.1.el10_2fixed 6.12.0-211.28.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix RESPONSE authenticator parser OOB read rxgk_verify_authenticator() copies auth_len bytes into a temporary buffer and then passes p + auth_len as the parser limit to rxgk_do_verify_authenticator(). Si

• CVE-2026-31613HigApr 24, 2026
  affected < 6.12.0-211.20.1.el10_2fixed 6.12.0-211.20.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the symlink parsers as the

• CVE-2026-31607CriApr 24, 2026
  affected < 5.14.0-687.10.1.el9_8fixed 5.14.0-687.10.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU.

• CVE-2026-31581HigApr 24, 2026
  affected < 6.12.0-211.22.1.el10_2fixed 6.12.0-211.22.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_card_free_when_closed

• CVE-2026-31566HigApr 24, 2026
  affected < 5.14.0-687.47.1.el9_8fixed 5.14.0-687.47.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence from amdgpu_ib_schedule(). This fence is used to wait for job completion. Currently

• CVE-2026-31539HigApr 24, 2026
  affected < 6.12.0-211.55.1.el10_2fixed 6.12.0-211.55.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might already consumed a

• CVE-2026-31532HigApr 23, 2026
  affected < 5.14.0-687.10.1.el9_8fixed 5.14.0-687.10.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a window where raw_rc

• CVE-2026-31530HigApr 22, 2026
  affected < 6.12.0-211.37.1.el10_2fixed 6.12.0-211.37.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each port in the hierar

• CVE-2026-31508HigApr 22, 2026
  affected < 5.14.0-687.15.1.el9_8fixed 5.14.0-687.15.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Avoid releasing netdev before teardown completes The patch cited in the Fixes tag below changed the teardown code for OVS ports to no longer unconditionally take the RTNL. After this change, t

• CVE-2026-31488HigApr 22, 2026
  affected < 5.14.0-687.19.1.el9_8fixed 5.14.0-687.19.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commit 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in atomic check"), amdgpu resets the CRTC state mode_changed fla

• CVE-2026-31479HigApr 22, 2026
  affected < 5.14.0-687.47.1.el9_8fixed 5.14.0-687.47.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: always keep track of remap prev/next During 3D workload, user is reporting hitting: [ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe], CPU#7: vkd3d_qu