almalinux/kernel-rt-debug-modules-core

Vulnerabilities (1,112)

• CVE-2026-46242HigMay 30, 2026
  affected < 6.12.0-211.31.1.el10_2fixed 6.12.0-211.31.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist

• CVE-2026-46230HigMay 28, 2026
  affected < 5.14.0-687.52.1.el9_8fixed 5.14.0-687.52.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg.

• CVE-2026-46227HigMay 28, 2026
  affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before t

• CVE-2026-46215HigMay 28, 2026
  affected < 6.12.0-211.37.1.el10_2fixed 6.12.0-211.37.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could del

• CVE-2026-46209HigMay 28, 2026
  affected < 6.12.0-211.30.1.el10_2fixed 6.12.0-211.30.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned int width = mo

• CVE-2026-46204HigMay 28, 2026
  affected < 5.14.0-687.52.1.el9_8fixed 5.14.0-687.52.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the bounds checks.

• CVE-2026-46199HigMay 28, 2026
  affected < 5.14.0-687.52.1.el9_8fixed 5.14.0-687.52.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg.

• CVE-2026-46189HigMay 28, 2026
  affected < 5.14.0-687.19.1.el9_8fixed 5.14.0-687.19.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before triggers a double free.

• CVE-2026-46185CriMay 28, 2026
  affected < 6.12.0-211.49.1.el10_2fixed 6.12.0-211.49.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlink_data() Since smb2_check_message() returns success without length validation for the symlink error response, in symlink_data() it is possible for iov->iov_len to be

• CVE-2026-46181HigMay 28, 2026
  affected < 5.14.0-687.15.1.el9_8fixed 5.14.0-687.15.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within the RCU critical se

• CVE-2026-46176HigMay 28, 2026
  affected < 5.14.0-687.19.1.el9_8fixed 5.14.0-687.19.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() mlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When ib_create_srq() fails for s1, the error branch destroys s0 but falls through a

• CVE-2026-46173HigMay 28, 2026
  affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dead() calls __schedu

• CVE-2026-46166HigMay 28, 2026
  affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-aft

• CVE-2026-46155CriMay 28, 2026
  affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validati

• CVE-2026-46152HigMay 28, 2026
  affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent callers then share on

• CVE-2026-46150HigMay 28, 2026
  affected < 6.12.0-211.37.1.el10_2fixed 6.12.0-211.37.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached mark

• CVE-2026-46149HigMay 28, 2026
  affected < 5.14.0-687.46.1.el9_8fixed 5.14.0-687.46.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cur_len bytes from th

• CVE-2026-46145HigMay 28, 2026
  affected < 5.14.0-687.17.1.el9_8fixed 5.14.0-687.17.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds check it so the mem

• CVE-2026-46135CriMay 28, 2026
  affected < 5.14.0-687.17.1.el9_8fixed 5.14.0-687.17.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing again

• CVE-2026-46133HigMay 28, 2026
  affected < 5.14.0-687.49.1.el9_8fixed 5.14.0-687.49.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated UDP packet can stil