almalinux/kernel-doc

Vulnerabilities (1,515)

• CVE-2023-53762HigDec 8, 2025
  affected < 4.18.0-553.105.1.el8_10fixed 4.18.0-553.105.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. To prevent this the code n

• CVE-2025-40322HigDec 8, 2025
  affected < 4.18.0-553.100.1.el8_10fixed 4.18.0-553.100.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and

• CVE-2025-40320CriDec 8, 2025
  affected < 6.12.0-211.7.1.el10_2fixed 6.12.0-211.7.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential cfid UAF in smb2_query_info_compound When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid wasn't reset on replay

• CVE-2025-40318HigDec 8, 2025
  affected < 6.12.0-124.31.1.el10_1fixed 6.12.0-124.31.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the

• CVE-2025-40304HigDec 8, 2025
  affected < 6.12.0-124.35.1.el10_1fixed 6.12.0-124.35.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is of

• CVE-2025-40301HigDec 8, 2025
  affected < 6.12.0-124.31.1.el10_1fixed 6.12.0-124.31.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->data contains the r

• CVE-2025-40294Dec 8, 2025
  affected < 5.14.0-611.26.1.el9_7fixed 5.14.0-611.26.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251). The size of the

• CVE-2025-40277HigDec 6, 2025
  affected < 6.12.0-124.27.1.el10_1fixed 6.12.0-124.27.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds acc

• CVE-2025-40271HigDec 6, 2025
  affected < 4.18.0-553.100.1.el8_10fixed 4.18.0-553.100.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EM

• CVE-2025-40269HigDec 6, 2025
  affected < 5.14.0-611.30.1.el9_7fixed 5.14.0-611.30.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamically. The packet siz

• CVE-2025-40258CriDec 4, 2025
  affected < 5.14.0-611.26.1.el9_7fixed 5.14.0-611.26.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt i

• CVE-2025-40257CriDec 4, 2025
  affected < 6.12.0-211.7.1.el10_2fixed 6.12.0-211.7.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. Add RCU protection

• CVE-2025-40252CriDec 4, 2025
  affected < 4.18.0-553.123.1.el8_10fixed 4.18.0-553.123.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() The loops in 'qede_tpa_cont()' and 'qede_tpa_end()', iterate over 'cqe->len_list[]' using only a zero-length terminator a

• CVE-2025-40251HigDec 4, 2025
  affected < 5.14.0-611.27.1.el9_7fixed 5.14.0-611.27.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driver-specific `rate_l

• CVE-2025-40249HigDec 4, 2025
  affected < 6.12.0-124.43.1.el10_1fixed 6.12.0-124.43.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count

• CVE-2025-40248HigDec 4, 2025
  affected < 4.18.0-553.97.1.el8_10fixed 4.18.0-553.97.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connect() invoking vsock

• CVE-2025-40240HigDec 4, 2025
  affected < 4.18.0-553.92.1.el8_10fixed 4.18.0-553.92.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->head_skb is not. Che

• CVE-2025-40237Dec 4, 2025
  affected < 6.12.0-211.39.1.el10_2fixed 6.12.0-211.39.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: fs/notify: call exportfs_encode_fid with s_umount Calling intotify_show_fdinfo() on fd watching an overlayfs inode, while the overlayfs is being unmounted, can lead to dereferencing NULL ptr. This issue was fo

• CVE-2025-40210HigNov 21, 2025
  affected < 6.12.0-211.7.1.el10_2fixed 6.12.0-211.7.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug int

• CVE-2025-40185Nov 12, 2025
  affected < 5.14.0-611.11.1.el9_7fixed 5.14.0-611.11.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: ice: ice_adapter: release xa entry on adapter allocation failure When ice_adapter_new() fails, the reserved XArray entry created by xa_insert() is not released. This causes subsequent insertions at the same ind