almalinux/kernel-rt-debug-devel

Vulnerabilities (1,249)

• CVE-2026-68388CriAug 10, 2026
  affected < 4.18.0-553.157.1.rt7.498.el8_10fixed 4.18.0-553.157.1.rt7.498.el8_10

  In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped h

• CVE-2026-17523HigJul 27, 2026
  affected < 4.18.0-553.156.1.rt7.497.el8_10fixed 4.18.0-553.156.1.rt7.497.el8_10

  A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation (LPE). This allows the attacker to gain root privileges and

• CVE-2026-64531HigJul 27, 2026
  affected < 5.14.0-687.38.1.el9_8fixed 5.14.0-687.38.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions lengt

• CVE-2026-64530CriJul 26, 2026
  affected < 5.14.0-687.33.1.el9_8fixed 5.14.0-687.33.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act_ct on out-of-order fragments). When that h

• CVE-2026-64496HigJul 25, 2026
  affected < 4.18.0-553.154.1.rt7.495.el8_10fixed 4.18.0-553.154.1.rt7.495.el8_10

  In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race `iio_event_getfd()` creates the event file descriptor with `anon_inode_getfd()`, which allocates a new fd, creates the anonymous file and installs it in the process fd tabl

• CVE-2026-64379HigJul 25, 2026
  affected < 4.18.0-553.157.1.rt7.498.el8_10fixed 4.18.0-553.157.1.rt7.498.el8_10

  In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without masking to 07777. A

• CVE-2026-64368HigJul 25, 2026
  affected < 5.14.0-687.38.1.el9_8fixed 5.14.0-687.38.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled When init (zeroing) on allocation is requested, for kmalloc() we generally have to zero the full object size even if a smaller size is

• CVE-2026-64300HigJul 25, 2026
  affected < 6.12.0-211.47.1.el10_2fixed 6.12.0-211.47.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are serialized by rb->aux_m

• CVE-2026-64219HigJul 24, 2026
  affected < 4.18.0-553.156.1.rt7.497.el8_10fixed 4.18.0-553.156.1.rt7.497.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[

• CVE-2026-64048HigJul 19, 2026
  affected < 4.18.0-553.157.1.rt7.498.el8_10fixed 4.18.0-553.157.1.rt7.498.el8_10

  In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entri

• CVE-2026-64017HigJul 19, 2026
  affected < 5.14.0-687.31.1.el9_8fixed 5.14.0-687.31.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freei

• CVE-2026-63888CriJul 19, 2026
  affected < 4.18.0-553.157.1.rt7.498.el8_10fixed 4.18.0-553.157.1.rt7.498.el8_10

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target

• CVE-2026-63887CriJul 19, 2026
  affected < 6.12.0-211.47.1.el10_2fixed 6.12.0-211.47.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer alloc

• CVE-2026-63884HigJul 19, 2026
  affected < 4.18.0-553.156.1.rt7.497.el8_10fixed 4.18.0-553.156.1.rt7.497.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right pointer.

• CVE-2026-63879HigJul 19, 2026
  affected < 4.18.0-553.156.1.rt7.497.el8_10fixed 4.18.0-553.156.1.rt7.497.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized retur

• CVE-2026-53374HigJul 19, 2026
  affected < 4.18.0-553.156.1.rt7.497.el8_10fixed 4.18.0-553.156.1.rt7.497.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a single PTE is written

• CVE-2026-53361HigJul 4, 2026
  affected < 6.12.0-211.47.1.el10_2fixed 6.12.0-211.47.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2

• CVE-2026-53359HigJul 4, 2026
  affected < 6.12.0-211.32.1.el10_2fixed 6.12.0-211.32.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and comp

• CVE-2026-53329HigJul 1, 2026
  affected < 4.18.0-553.156.1.rt7.497.el8_10fixed 4.18.0-553.156.1.rt7.497.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap

• CVE-2026-53281HigJun 26, 2026
  affected < 6.12.0-211.40.1.el10_2fixed 6.12.0-211.40.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE") fixed a NULL pointer dereference in an unlikely situation partly. If d