almalinux/kernel-doc

Vulnerabilities (1,515)

• CVE-2025-22026MedApr 16, 2025
  affected < 4.18.0-553.77.1.el8_10fixed 4.18.0-553.77.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: nfsd: don't ignore the return code of svc_proc_register() Currently, nfsd_proc_stat_init() ignores the return value of svc_proc_register(). If the procfile creation fails, then the kernel will WARN when it trie

• CVE-2023-53034HigApr 16, 2025
  affected < 6.12.0-124.38.1.el10_1fixed 6.12.0-124.38.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23.734156] switcht

• CVE-2025-22020HigApr 16, 2025
  affected < 6.12.0-55.25.1.el10_0fixed 6.12.0-55.25.1.el10_0

  In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rt

• CVE-2025-22004HigApr 3, 2025
  affected < 5.14.0-570.25.1.el9_6fixed 5.14.0-570.25.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.

• CVE-2025-21999HigApr 3, 2025
  affected < 5.14.0-570.22.1.el9_6fixed 5.14.0-570.22.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc

• CVE-2025-21997MedApr 3, 2025
  affected < 5.14.0-570.21.1.el9_6fixed 5.14.0-570.21.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: xsk: fix an integer overflow in xp_create_and_assign_umem() Since the i and pool->chunk_size variables are of type 'u32', their product can wrap around and then be cast to 'u64'. This can lead to two different

• CVE-2025-21993HigApr 2, 2025
  affected < 5.14.0-570.16.1.el9_6fixed 5.14.0-570.16.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 pref

• CVE-2025-21991HigApr 2, 2025
  affected < 6.12.0-55.20.1.el10_0fixed 6.12.0-55.20.1.el10_0

  In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their CPU masks and unconditionally accesses per-CPU data for the

• CVE-2025-21979HigApr 1, 2025
  affected < 5.14.0-570.22.1.el9_6fixed 5.14.0-570.22.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel wiphy_work before freeing wiphy A wiphy_work can be queued from the moment the wiphy is allocated and initialized (i.e. wiphy_new_nm). When a wiphy_work is queued, the rdev::wiphy_work is

• CVE-2025-21976HigApr 1, 2025
  affected < 6.12.0-124.8.1.el10_1fixed 6.12.0-124.8.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: fbdev: hyperv_fb: Allow graceful removal of framebuffer When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to release the framebuffer forcefully. If this framebuffer is in use it produce the fo

• CVE-2025-21969HigApr 1, 2025
  affected < 5.14.0-570.22.1.el9_6fixed 5.14.0-570.22.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd After the hci sync command releases l2cap_conn, the hci receive data work queue references the released l2cap_conn when sending to the upper laye

• CVE-2025-21966HigApr 1, 2025
  affected < 5.14.0-570.17.1.el9_6fixed 5.14.0-570.17.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature Fix memory corruption due to incorrect parameter being passed to bio_init

• CVE-2025-21964MedApr 1, 2025
  affected < 5.14.0-570.18.1.el9_6fixed 5.14.0-570.18.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acregmax mount option User-provided mount parameter acregmax of type u32 is intended to have an upper limit, but before it is validated, the value is converted from s

• CVE-2025-21963MedApr 1, 2025
  affected < 5.14.0-570.22.1.el9_6fixed 5.14.0-570.22.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acdirmax mount option User-provided mount parameter acdirmax of type u32 is intended to have an upper limit, but before it is validated, the value is converted from s

• CVE-2025-21962MedApr 1, 2025
  affected < 5.14.0-570.32.1.el9_6fixed 5.14.0-570.32.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing closetimeo mount option User-provided mount parameter closetimeo of type u32 is intended to have an upper limit, but before it is validated, the value is converted fr

• CVE-2025-21961HigApr 1, 2025
  affected < 5.14.0-570.22.1.el9_6fixed 5.14.0-570.22.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: fix truesize for mb-xdp-pass case When mb-xdp is set and return is XDP_PASS, packet is converted from xdp_buff to sk_buff with xdp_update_skb_shared_info() in bnxt_xdp_build_skb(). bnxt_xdp_build_skb

• CVE-2025-21929HigApr 1, 2025
  affected < 6.12.0-55.25.1.el10_0fixed 6.12.0-55.25.1.el10_0

  In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() During the `rmmod` operation for the `intel_ishtp_hid` driver, a use-after-free issue can occur in the hid_ishtp_cl_remove() function. The f

• CVE-2025-21928HigApr 1, 2025
  affected < 6.12.0-55.25.1.el10_0fixed 6.12.0-55.25.1.el10_0

  In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freein

• CVE-2025-21927CriApr 1, 2025
  affected < 5.14.0-570.16.1.el9_6fixed 5.14.0-570.16.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a packet with an invali

• CVE-2025-21926HigApr 1, 2025
  affected < 5.14.0-570.21.1.el9_6fixed 5.14.0-570.21.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in __udp_gso_segment In __udp_gso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the original skb is later or