almalinux/kernel-rt-core

Vulnerabilities (1,061)

• CVE-2023-53297Sep 16, 2025
  affected < 4.18.0-553.81.1.rt7.422.el8_10fixed 4.18.0-553.81.1.rt7.422.el8_10

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance' is triggered.

• CVE-2023-53257Sep 15, 2025
  affected < 4.18.0-553.82.1.rt7.423.el8_10fixed 4.18.0-553.82.1.rt7.423.el8_10

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check S1G action frame size Before checking the action code, check that it even exists in the frame.

• CVE-2023-53226Sep 15, 2025
  affected < 4.18.0-553.82.1.rt7.423.el8_10fixed 4.18.0-553.82.1.rt7.423.el8_10

  In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix OOB and integer underflow when rx packets Make sure mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, mwifiex_uap_queue_bridged_pkt and mwifiex_pro

• CVE-2023-53178Sep 15, 2025
  affected < 4.18.0-553.83.1.rt7.424.el8_10fixed 4.18.0-553.83.1.rt7.424.el8_10

  In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was written to a different

• CVE-2025-40300MedSep 11, 2025
  affected < 5.14.0-570.62.1.el9_6fixed 5.14.0-570.62.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already

• CVE-2025-39766HigSep 11, 2025
  affected < 5.14.0-611.49.1.el9_7fixed 5.14.0-611.49.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add

• CVE-2025-39760HigSep 11, 2025
  affected < 4.18.0-553.100.1.rt7.441.el8_10fixed 4.18.0-553.100.1.rt7.441.el8_10

  In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this

• CVE-2025-39757HigSep 11, 2025
  affected < 5.14.0-570.52.1.el9_6fixed 5.14.0-570.52.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer s

• CVE-2025-39761Sep 11, 2025
  affected < 5.14.0-570.51.1.el9_6fixed 5.14.0-570.51.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not decremented before peer cleanup, during error handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to out-of-bo

• CVE-2025-39730Sep 7, 2025
  affected < 4.18.0-553.78.1.rt7.419.el8_10fixed 4.18.0-553.78.1.rt7.419.el8_10

  In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle.

• CVE-2025-39718MedSep 5, 2025
  affected < 4.18.0-553.84.1.rt7.425.el8_10fixed 4.18.0-553.84.1.rt7.425.el8_10

  In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_

• CVE-2025-39702HigSep 5, 2025
  affected < 5.14.0-570.60.1.el9_6fixed 5.14.0-570.60.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

• CVE-2025-39697MedSep 5, 2025
  affected < 4.18.0-553.85.1.rt7.426.el8_10fixed 4.18.0-553.85.1.rt7.426.el8_10

  In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succ

• CVE-2025-39694MedSep 5, 2025
  affected < 5.14.0-570.46.1.el9_6fixed 5.14.0-570.46.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtu

• CVE-2025-39682HigSep 5, 2025
  affected < 5.14.0-570.49.1.el9_6fixed 5.14.0-570.49.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type

• CVE-2025-39698Sep 5, 2025
  affected < 5.14.0-570.49.1.el9_6fixed 5.14.0-570.49.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with REQ_F_ASYNC_DATA at t

• CVE-2025-38737Sep 5, 2025
  affected < 6.12.0-124.20.1.el10_1fixed 6.12.0-124.20.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise buffer to NULL before calling netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it is given. Setti

• CVE-2025-38731Sep 5, 2025
  affected < 5.14.0-611.26.1.el9_7fixed 5.14.0-611.26.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. =====================

• CVE-2025-38724HigSep 4, 2025
  affected < 4.18.0-553.87.1.rt7.428.el8_10fixed 4.18.0-553.87.1.rt7.428.el8_10

  In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM c

• CVE-2025-38730Sep 4, 2025
  affected < 5.14.0-611.30.1.el9_7fixed 5.14.0-611.30.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and invalidates them on r