VYPR

rpm package

almalinux/kernel-doc

pkg:rpm/almalinux/kernel-doc

Vulnerabilities (1,545)

  • CVE-2026-68406Aug 10, 2026
    affected < 5.14.0-687.47.1.el9_8fixed 5.14.0-687.47.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate PMSR FTM preamble range PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range. Reject out-of-range values before using them in the parser capab

  • CVE-2026-68402HigAug 10, 2026
    affected < 5.14.0-687.47.1.el9_8fixed 5.14.0-687.47.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211_is_element_inherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inh

  • CVE-2026-68388CriAug 10, 2026
    affected < 6.12.0-211.49.1.el10_2fixed 6.12.0-211.49.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped h

  • CVE-2026-68376HigAug 10, 2026
    affected < 4.18.0-553.162.1.el8_10fixed 4.18.0-553.162.1.el8_10

    In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp_cookie The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed

  • CVE-2026-68363Aug 10, 2026
    affected < 4.18.0-553.163.1.el8_10fixed 4.18.0-553.163.1.el8_10

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_dev as the completi

  • CVE-2026-68343CriAug 10, 2026
    affected < 5.14.0-687.41.1.el9_8fixed 5.14.0-687.41.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response

  • CVE-2026-68315HigAug 10, 2026
    affected < 4.18.0-553.162.1.el8_10fixed 4.18.0-553.162.1.el8_10

    In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctp_process_strreset_inreq() When processing a RESET_IN_REQUEST from a peer, sctp_process_strreset_inreq() derives the stream count from the parameter length but does not check w

  • CVE-2026-68307Aug 10, 2026
    affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925_vif_connect_iter() replays firmware state for links tracked in mvif->valid_links. After MLO link changes or MCU timeout recovery,

  • CVE-2026-68300CriAug 10, 2026
    affected < 4.18.0-553.162.1.el8_10fixed 4.18.0-553.162.1.el8_10

    In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when auth_chunk is NULL sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, silently skipping authentication. This is incorrect when: 1. sk

  • CVE-2026-68294HigAug 10, 2026
    affected < 5.14.0-687.48.1.el9_8fixed 5.14.0-687.48.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_local_nid is a sing

  • CVE-2026-68293HigAug 10, 2026
    affected < 4.18.0-553.166.1.el8_10fixed 4.18.0-553.166.1.el8_10

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5_ifc_mcia_reg_bits

  • CVE-2026-68264HigAug 10, 2026
    affected < 5.14.0-687.47.1.el9_8fixed 5.14.0-687.47.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() xe_pt_update_ops_init() fails to reset current_op to 0. On the vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside the xe_validation_guard(

  • CVE-2026-68200HigAug 10, 2026
    affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two threads triggering the

  • CVE-2026-68193Aug 10, 2026
    affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses PKT_TYPE_TXRX_NOTIFY is an mmio-only event, but mt7925_rx_check() and mt7925_queue_rx_skb() dispatch it to mt7925_mac_tx_free() on every bus. mt7925_mac_tx

  • CVE-2026-68188Aug 10, 2026
    affected < 4.18.0-553.166.1.el8_10fixed 4.18.0-553.166.1.el8_10

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in set_termios rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and later passes the pointer to rfcomm_send_rpn(). The latter dereferences both session->initia

  • CVE-2026-68166Aug 10, 2026
    affected < 6.12.0-211.50.1.el10_2fixed 6.12.0-211.50.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ...

  • CVE-2026-68159CriAug 10, 2026
    affected < 5.14.0-687.49.1.el9_8fixed 5.14.0-687.49.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it t

  • CVE-2026-68145HigAug 10, 2026
    affected < 6.12.0-211.51.1.el10_2fixed 6.12.0-211.51.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmap_set() with zero-length range ifs_set_range_dirty() and ifs_set_range_uptodate() compute last_blk as (off + len - 1) >> i_blkbits. When off is 0 and len is 0, the unsigned subtra

  • CVE-2026-68143HigAug 10, 2026
    affected < 5.14.0-687.48.1.el9_8fixed 5.14.0-687.48.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through rbuff without hold

  • CVE-2026-68128HigAug 10, 2026
    affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF from providing ptype

Page 2 of 78