VYPR

rpm package

almalinux/kernel-modules-core

pkg:rpm/almalinux/kernel-modules-core

Vulnerabilities (1,072)

  • CVE-2026-46166HigMay 28, 2026
    affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-aft

  • CVE-2026-46155CriMay 28, 2026
    affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validati

  • CVE-2026-46152HigMay 28, 2026
    affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent callers then share on

  • CVE-2026-46150HigMay 28, 2026
    affected < 6.12.0-211.37.1.el10_2fixed 6.12.0-211.37.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached mark

  • CVE-2026-46149HigMay 28, 2026
    affected < 5.14.0-687.46.1.el9_8fixed 5.14.0-687.46.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cur_len bytes from th

  • CVE-2026-46145HigMay 28, 2026
    affected < 5.14.0-687.17.1.el9_8fixed 5.14.0-687.17.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds check it so the mem

  • CVE-2026-46135CriMay 28, 2026
    affected < 5.14.0-687.17.1.el9_8fixed 5.14.0-687.17.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing again

  • CVE-2026-46125HigMay 28, 2026
    affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since i

  • CVE-2026-46123HigMay 28, 2026
    affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: clamp rx length before skb_put virtbt_rx_work() calls skb_put(skb, len) where len comes directly from virtqueue_get_buf() with no validation against the buffer we posted to the device. The

  • CVE-2026-46120HigMay 28, 2026
    affected < 5.14.0-687.41.1.el9_8fixed 5.14.0-687.41.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns ip6gre hash via

  • CVE-2026-46117HigMay 28, 2026
    affected < 5.14.0-687.17.1.el9_8fixed 5.14.0-687.17.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WARN_ON() then go on

  • CVE-2026-46116HigMay 28, 2026
    affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on

  • CVE-2026-46113HigMay 28, 2026
    affected < 6.12.0-211.32.1.el10_2fixed 6.12.0-211.32.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest pag

  • CVE-2026-46099HigMay 27, 2026
    affected < 5.14.0-687.29.1.el9_8fixed 5.14.0-687.29.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking dst_hold() uncondi

  • CVE-2026-46090HigMay 27, 2026
    affected < 5.14.0-687.19.1.el9_8fixed 5.14.0-687.19.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa6

  • CVE-2026-46086MedMay 27, 2026
    affected < 5.14.0-687.25.1.el9_8fixed 5.14.0-687.25.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by `fdb_delete_local()`, which updates `f->dst` to another port or to `NULL` while keeping the entry alive.

  • CVE-2026-46056HigMay 27, 2026
    affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connec

  • CVE-2026-46054HigMay 27, 2026
    affected < 6.12.0-211.22.1.el10_2fixed 6.12.0-211.22.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: selinux: fix overlayfs mmap() and mprotect() access checks The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "user" file) and the

  • CVE-2026-46015HigMay 27, 2026
    affected < 5.14.0-687.46.1.el9_8fixed 5.14.0-687.46.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, the target listener

  • CVE-2026-45998HigMay 27, 2026
    affected < 6.12.0-211.30.1.el10_2fixed 6.12.0-211.30.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential UAF after skb_unshare() failure If skb_unshare() fails to unshare a packet due to allocation failure in rxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thread()) will be NULL'

Page 10 of 54