almalinux/kernel-rt-64k-debug-devel

Vulnerabilities (523)

• CVE-2026-23455CriApr 3, 2026
  affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator by

• CVE-2026-23415HigApr 2, 2026
  affected < 5.14.0-687.36.1.el9_8fixed 5.14.0-687.36.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() During futex_key_to_node_opt() execution, vma->vm_policy is read under speculative mmap lock and RCU. Concurrently, mbind() may call vma_r

• CVE-2026-23401MedApr 1, 2026
  affected < 5.14.0-687.10.1.el9_8fixed 5.14.0-687.10.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa

• CVE-2026-23392HigMar 25, 2026
  affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release flowtable after rcu grace period on error Call synchronize_rcu() after unregistering the hooks from error path, since a hook that already refers to this flowtable can be already re

• CVE-2026-23375MedMar 25, 2026
  affected < 6.12.0-211.18.1.el10_2fixed 6.12.0-211.18.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: mm: thp: deny THP for files on anonymous inodes file_thp_enabled() incorrectly allows THP for files on anonymous inodes (e.g. guest_memfd and secretmem). These files are created via alloc_file_pseudo(), which d

• CVE-2026-23270HigMar 18, 2026
  affected < 5.14.0-611.54.1.el9_7fixed 5.14.0-611.54.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the current skb being held b

• CVE-2026-23243HigMar 18, 2026
  affected < 6.12.0-211.7.1.el10_2fixed 6.12.0-211.7.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len

• CVE-2025-71238HigMar 4, 2026
  affected < 6.12.0-124.47.1.el10_1fixed 6.12.0-124.47.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353358.825194] #PF: supervisor write access

• CVE-2026-23231HigMar 4, 2026
  affected < 5.14.0-611.47.1.el9_7fixed 5.14.0-611.47.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_reg

• CVE-2026-23216HigFeb 18, 2026
  affected < 5.14.0-687.15.1.el9_8fixed 5.14.0-687.15.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked

• CVE-2026-23210MedFeb 14, 2026
  affected < 6.12.0-211.7.1.el10_2fixed 6.12.0-211.7.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: ice: Fix PTP NULL pointer dereference during VSI rebuild Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings. The sequence was: 1. ice_ptp_prepare_for_reset

• CVE-2026-23209HigFeb 14, 2026
  affected < 5.14.0-611.45.1.el9_7fixed 5.14.0-611.45.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link set up dev p1 ip l

• CVE-2026-23204HigFeb 14, 2026
  affected < 5.14.0-687.10.1.el9_8fixed 5.14.0-687.10.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a report and a repro f

• CVE-2026-23199MedFeb 14, 2026
  affected < 6.12.0-211.43.1.el10_2fixed 6.12.0-211.43.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: procfs: avoid fetching build ID while holding VMA lock Fix PROCMAP_QUERY to fetch optional build ID only after dropping mmap_lock or per-VMA lock, whichever was used to lock VMA under question, to avoid deadloc

• CVE-2026-23193HigFeb 14, 2026
  affected < 5.14.0-611.45.1.el9_7fixed 5.14.0-611.45.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connecti

• CVE-2026-23191HigFeb 14, 2026
  affected < 5.14.0-611.45.1.el9_7fixed 5.14.0-611.45.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop

• CVE-2026-23171HigFeb 14, 2026
  affected < 5.14.0-611.45.1.el9_7fixed 5.14.0-611.45.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be use

• CVE-2026-23168MedFeb 14, 2026
  affected < 6.12.0-211.37.1.el10_2fixed 6.12.0-211.37.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: flex_proportions: make fprop_new_period() hardirq safe Bernd has reported a lockdep splat from flexible proportions code that is essentially complaining about the following race: run_timer_softir

• CVE-2026-23156HigFeb 14, 2026
  affected < 6.12.0-124.43.1.el10_1fixed 6.12.0-124.43.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: efivarfs: fix error propagation in efivar_entry_get() efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors. This may result in uninitialized heap memory b

• CVE-2026-23144MedFeb 14, 2026
  affected < 5.14.0-611.45.1.el9_7fixed 5.14.0-611.45.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure When a context DAMON sysfs directory setup is failed after setup of attrs/ directory, subdirectories of attrs/ directory are not cleaned up. A