almalinux/kernel-modules-core

Vulnerabilities (1,072)

• CVE-2025-68285CriDec 16, 2025
  affected < 5.14.0-611.24.1.el9_7fixed 5.14.0-611.24.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both

• CVE-2025-68214MedDec 16, 2025
  affected < 5.14.0-687.34.1.el9_8fixed 5.14.0-687.34.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: timers: Fix NULL function pointer race in timer_shutdown_sync() There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timers(). The issue occ

• CVE-2025-68211MedDec 16, 2025
  affected < 6.12.0-211.42.1.el10_2fixed 6.12.0-211.42.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when

• CVE-2025-68183HigDec 16, 2025
  affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in se

• CVE-2025-40322HigDec 8, 2025
  affected < 5.14.0-611.34.1.el9_7fixed 5.14.0-611.34.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bit_putcs* bit_putcs_aligned()/unaligned() derived the glyph pointer from the character value masked by 0xff/0x1ff, which may exceed the actual font's glyph count and

• CVE-2025-40320CriDec 8, 2025
  affected < 6.12.0-211.7.1.el10_2fixed 6.12.0-211.7.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential cfid UAF in smb2_query_info_compound When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid wasn't reset on replay

• CVE-2025-40318HigDec 8, 2025
  affected < 5.14.0-611.30.1.el9_7fixed 5.14.0-611.30.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once hci_cmd_sync_dequeue_once() does lookup and then cancel the entry under two separate lock sections. Meanwhile, hci_cmd_sync_work() can also delete the

• CVE-2025-40304HigDec 8, 2025
  affected < 5.14.0-611.34.1.el9_7fixed 5.14.0-611.34.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is of

• CVE-2025-40301HigDec 8, 2025
  affected < 6.12.0-124.31.1.el10_1fixed 6.12.0-124.31.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->data contains the r

• CVE-2025-40294Dec 8, 2025
  affected < 5.14.0-611.26.1.el9_7fixed 5.14.0-611.26.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251). The size of the

• CVE-2025-40277HigDec 6, 2025
  affected < 5.14.0-611.24.1.el9_7fixed 5.14.0-611.24.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds acc

• CVE-2025-40271HigDec 6, 2025
  affected < 5.14.0-611.30.1.el9_7fixed 5.14.0-611.30.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EM

• CVE-2025-40269HigDec 6, 2025
  affected < 5.14.0-611.30.1.el9_7fixed 5.14.0-611.30.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamically. The packet siz

• CVE-2025-40258CriDec 4, 2025
  affected < 5.14.0-611.26.1.el9_7fixed 5.14.0-611.26.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt i

• CVE-2025-40257CriDec 4, 2025
  affected < 6.12.0-211.7.1.el10_2fixed 6.12.0-211.7.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. Add RCU protection

• CVE-2025-40251HigDec 4, 2025
  affected < 5.14.0-611.27.1.el9_7fixed 5.14.0-611.27.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driver-specific `rate_l

• CVE-2025-40249HigDec 4, 2025
  affected < 6.12.0-124.43.1.el10_1fixed 6.12.0-124.43.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. The reference count

• CVE-2025-40248HigDec 4, 2025
  affected < 5.14.0-611.26.1.el9_7fixed 5.14.0-611.26.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connect() invoking vsock

• CVE-2025-40240HigDec 4, 2025
  affected < 5.14.0-611.20.1.el9_7fixed 5.14.0-611.20.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->head_skb is not. Che

• CVE-2025-40237Dec 4, 2025
  affected < 6.12.0-211.39.1.el10_2fixed 6.12.0-211.39.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: fs/notify: call exportfs_encode_fid with s_umount Calling intotify_show_fdinfo() on fd watching an overlayfs inode, while the overlayfs is being unmounted, can lead to dereferencing NULL ptr. This issue was fo