almalinux/kernel-devel

Vulnerabilities (1,549)

• CVE-2026-23002MedJan 25, 2026
  affected < 5.14.0-687.31.1.el9_8fixed 5.14.0-687.31.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: lib/buildid: use __kernel_read() for sleepable context Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio". For the sleepable context, convert freader to use __kernel_read()

• CVE-2026-23001HigJan 25, 2026
  affected < 4.18.0-553.111.1.el8_10fixed 4.18.0-553.111.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace

• CVE-2026-22998HigJan 25, 2026
  affected < 4.18.0-553.104.1.el8_10fixed 4.18.0-553.104.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset va

• CVE-2026-22990HigJan 23, 2026
  affected < 5.14.0-687.10.1.el9_8fixed 5.14.0-687.10.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is no need to BUG. In

• CVE-2026-22984CriJan 23, 2026
  affected < 5.14.0-687.10.1.el9_8fixed 5.14.0-687.10.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: changelog ]

• CVE-2026-22979MedJan 23, 2026
  affected < 5.14.0-687.25.1.el9_8fixed 5.14.0-687.25.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO packets When skb_segment_list() is called during packet forwarding, it handles packets that were aggregated by the GRO engine. Historically, the segmentation lo

• CVE-2025-71147MedJan 23, 2026
  affected < 6.12.0-211.37.1.el10_2fixed 6.12.0-211.37.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix a memory leak in tpm2_load_cmd 'tpm2_load_cmd' allocates a tempoary blob indirectly via 'tpm2_key_decode' but it is not freed in the failure paths. Address this by wrapping the blob into with

• CVE-2025-71132HigJan 14, 2026
  affected < 4.18.0-553.159.1.el8_10fixed 4.18.0-553.159.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: smc91x: fix broken irq-context in PREEMPT_RT When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC: [ 13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 [

• CVE-2025-71127HigJan 14, 2026
  affected < 4.18.0-553.163.1.el8_10fixed 4.18.0-553.163.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Discard Beacon frames to non-broadcast address Beacon frames are required to be sent to the broadcast address, see IEEE Std 802.11-2020, 11.1.3.1 ("The Address 1 field of the Beacon .. frame sha

• CVE-2025-71116CriJan 14, 2026
  affected < 5.14.0-687.10.1.el9_8fixed 5.14.0-687.10.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expected for a particular

• CVE-2025-71113MedJan 14, 2026
  affected < 6.12.0-211.37.1.el10_2fixed 6.12.0-211.37.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, relying on callers to set fields explicitl

• CVE-2025-71089HigJan 13, 2026
  affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual Addressing (SVA).

• CVE-2025-71085HigJan 13, 2026
  affected < 5.14.0-611.36.1.el9_7fixed 5.14.0-611.36.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of t

• CVE-2025-71082HigJan 13, 2026
  affected < 4.18.0-553.166.1.el8_10fixed 4.18.0-553.166.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This

• CVE-2025-71072HigJan 13, 2026
  affected < 6.12.0-211.46.1.el10_2fixed 6.12.0-211.46.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on rename failures maple_tree insertions can fail if we are seriously short on memory; simple_offset_rename() does not recover well if it runs into that. The same goes for simple_offset_rena

• CVE-2025-71066HigJan 13, 2026
  affected < 6.12.0-211.32.1.el10_2fixed 6.12.0-211.32.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change [email protected] says: The vulnerability is a race condition between `ets_qdisc_dequeue` and `ets_qdisc_ch

• CVE-2025-68811CriJan 13, 2026
  affected < 5.14.0-611.34.1.el9_7fixed 5.14.0-611.34.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_range added rc_curpage (page index) to the page base instead of the byte offset rc_pageoff. Use rc_pageoff so copies land within the current p

• CVE-2025-68800HigJan 13, 2026
  affected < 4.18.0-553.107.1.el8_10fixed 4.18.0-553.107.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not change while the driver

• CVE-2023-54214HigDec 30, 2025
  affected < 4.18.0-553.166.1.el8_10fixed 4.18.0-553.166.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix potential user-after-free This fixes all instances of which requires to allocate a buffer calling alloc_skb which may release the chan lock and reacquire later which makes it possible that

• CVE-2022-50865HigDec 30, 2025
  affected < 4.18.0-553.100.1.el8_10fixed 4.18.0-553.100.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_rcvbuf, sk_sndbuf an