almalinux/kernel-doc

Vulnerabilities (1,156)

• CVE-2026-23074HigFeb 4, 2026
  affected < 4.18.0-553.107.1.el8_10fixed 4.18.0-553.107.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not important, I will desc

• CVE-2026-23097Feb 4, 2026
  affected < 4.18.0-553.109.1.el8_10fixed 4.18.0-553.109.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2) Task (5754): Hol

• CVE-2026-23010HigJan 25, 2026
  affected < 6.12.0-124.45.1.el10_1fixed 6.12.0-124.45.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del(). [0] The cited commit accidentally moved ipv6_del_addr() for mngtmpaddr before reading its ifp->

• CVE-2026-23001HigJan 25, 2026
  affected < 4.18.0-553.111.1.el8_10fixed 4.18.0-553.111.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace

• CVE-2026-22998HigJan 25, 2026
  affected < 4.18.0-553.104.1.el8_10fixed 4.18.0-553.104.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking and data_offset va

• CVE-2025-68811Jan 13, 2026
  affected < 6.12.0-124.35.1.el10_1fixed 6.12.0-124.35.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: svcrdma: use rc_pageoff for memcpy byte offset svc_rdma_copy_inline_range added rc_curpage (page index) to the page base instead of the byte offset rc_pageoff. Use rc_pageoff so copies land within the current p

• CVE-2025-68800Jan 13, 2026
  affected < 4.18.0-553.107.1.el8_10fixed 4.18.0-553.107.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats Cited commit added a dedicated mutex (instead of RTNL) to protect the multicast route list, so that it will not change while the driver

• CVE-2025-71085Jan 13, 2026
  affected < 5.14.0-611.36.1.el9_7fixed 5.14.0-611.36.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of t

• CVE-2022-50865Dec 30, 2025
  affected < 4.18.0-553.100.1.el8_10fixed 4.18.0-553.100.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_rcvbuf, sk_sndbuf an

• CVE-2025-68741Dec 24, 2025
  affected < 5.14.0-611.49.1.el9_7fixed 5.14.0-611.49.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The qla24xx_alloc_pur

• CVE-2025-68724Dec 24, 2025
  affected < 4.18.0-553.123.1.el8_10fixed 4.18.0-553.123.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetric_k

• CVE-2025-68349Dec 24, 2025
  affected < 4.18.0-553.104.1.el8_10fixed 4.18.0-553.104.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode pnfs

• CVE-2025-68305Dec 16, 2025
  affected < 5.14.0-611.26.1.el9_7fixed 5.14.0-611.26.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending before write iter se

• CVE-2025-68301Dec 16, 2025
  affected < 4.18.0-553.94.1.el8_10fixed 4.18.0-553.94.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of-b

• CVE-2025-68287Dec 16, 2025
  affected < 6.12.0-124.27.1.el10_1fixed 6.12.0-124.27.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths This patch addresses a race condition caused by unsynchronized execution of multiple call paths invoking `dwc3_remove_requests(

• CVE-2025-68285Dec 16, 2025
  affected < 4.18.0-553.92.1.el8_10fixed 4.18.0-553.92.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both

• CVE-2022-50673Dec 9, 2025
  affected < 4.18.0-553.104.1.el8_10fixed 4.18.0-553.104.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+0x28/0x1a0 Read o

• CVE-2023-53762Dec 8, 2025
  affected < 4.18.0-553.105.1.el8_10fixed 4.18.0-553.105.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. To prevent this the code n

• CVE-2025-40322Dec 8, 2025
  affected < 4.18.0-553.100.1.el8_10fixed 4.18.0-553.100.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and

• CVE-2025-40318Dec 8, 2025
  affected < 6.12.0-124.31.1.el10_1fixed 6.12.0-124.31.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the