almalinux/kernel-modules-core

Vulnerabilities (1,072)

• CVE-2026-43341CriMay 8, 2026
  affected < 6.12.0-211.31.1.el10_2fixed 6.12.0-211.31.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: net/ipv6: ioam6: prevent schema length wraparound in trace fill ioam6_fill_trace_data() stores the schema contribution to the trace length in a u8. With bit 22 enabled and the largest schema payload, sclen beco

• CVE-2026-43339HigMay 8, 2026
  affected < 5.14.0-687.46.1.el9_8fixed 5.14.0-687.46.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 after its possible del

• CVE-2026-43334HigMay 8, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM requirements before building the pairing response smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECUR

• CVE-2026-43330HigMay 8, 2026
  affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix overflow on long hmac keys When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be rounded to DMA cache a

• CVE-2026-43329HigMay 8, 2026
  affected < 6.12.0-211.20.1.el10_2fixed 6.12.0-211.20.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: strictly check for maximum number of actions The maximum number of flowtable hardware offload actions in IPv6 is: * ethernet mangling (4 payload actions, 2 for each ethernet address) * SN

• CVE-2026-43322HigMay 8, 2026
  affected < 6.12.0-211.20.1.el10_2fixed 6.12.0-211.20.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in le_read_features_complete This fixes the following backtrace caused by hci_conn being freed before le_read_features_complete but after hci_le_read_remote_features_sync so hci_con

• CVE-2026-43303HigMay 8, 2026
  affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: clear page->private in free_pages_prepare() Several subsystems (slub, shmem, ttm, etc.) use page->private but don't clear it before freeing pages. When these pages are later allocated as high-or

• CVE-2026-43284HigMay 8, 2026
  affected < 5.14.0-611.55.1.el9_7fixed 5.14.0-611.55.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths th

• CVE-2026-43279HigMay 6, 2026
  affected < 5.14.0-687.17.1.el9_8fixed 5.14.0-687.17.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received packets fit with the b

• CVE-2026-43276HigMay 6, 2026
  affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroy_workqueue on service rescan PCI path While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path. When mana_serv_reset() calls mana_g

• CVE-2026-43260HigMay 6, 2026
  affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the VNIC in FW only when

• CVE-2026-43248HigMay 6, 2026
  affected < 5.14.0-687.48.1.el9_8fixed 5.14.0-687.48.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in vdpa_sim where a v

• CVE-2026-43237HigMay 6, 2026
  affected < 6.12.0-211.49.1.el10_2fixed 6.12.0-211.49.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 This commit simplifies the amdgpu_gem_va_ioctl function, key updates include: - Moved the logic for managing t

• CVE-2026-43233HigMay 6, 2026
  affected < 5.14.0-687.41.1.el9_8fixed 5.14.0-687.41.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`, which is still 0 from its initialization at the top of the function

• CVE-2026-43206HigMay 6, 2026
  affected < 6.12.0-211.49.1.el10_2fixed 6.12.0-211.49.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivile

• CVE-2026-43205HigMay 6, 2026
  affected < 6.12.0-211.18.1.el10_2fixed 6.12.0-211.18.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: validate num_ifs to prevent out-of-bounds write The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes() but never validates it against DPSW_MAX_IF (64). This value controls iter

• CVE-2026-43198CriMay 6, 2026
  affected < 6.12.0-211.28.1.el10_2fixed 6.12.0-211.28.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible fro

• CVE-2026-43190HigMay 6, 2026
  affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validating the remaining

• CVE-2026-43186CriMay 6, 2026
  affected < 6.12.0-211.44.1.el10_2fixed 6.12.0-211.44.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide how much data to write for each node. It trusts this field as-is fr

• CVE-2026-43163MedMay 6, 2026
  affected < 5.14.0-687.10.1.el9_8fixed 5.14.0-687.10.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-free race between bit