almalinux/kernel-rt-kvm

Vulnerabilities (523)

• CVE-2025-38124MedJul 3, 2025
  affected < 5.14.0-570.35.1.el9_6fixed 5.14.0-570.35.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skbs and redirects the

• CVE-2025-38159Jul 3, 2025
  affected < 5.14.0-570.35.1.el9_6fixed 5.14.0-570.35.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', which reads 5 bytes:

• CVE-2025-38110Jul 3, 2025
  affected < 5.14.0-570.30.1.el9_6fixed 5.14.0-570.30.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via C45 (clause 45) mdiobus, t

• CVE-2025-38089Jun 30, 2025
  affected < 5.14.0-570.28.1.el9_6fixed 5.14.0-570.28.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC rep

• CVE-2025-38087Jun 30, 2025
  affected < 5.14.0-570.32.1.el9_6fixed 5.14.0-570.32.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in taprio_dev_notifier Since taprio’s taprio_dev_notifier() isn’t protected by an RCU read-side critical section, a race with advance_sched() can lead to a use-after-free. Adding

• CVE-2025-38086Jun 28, 2025
  affected < 5.14.0-570.30.1.el9_6fixed 5.14.0-570.30.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called "buff"

• CVE-2025-38085Jun 28, 2025
  affected < 5.14.0-570.35.1.el9_6fixed 5.14.0-570.35.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table us

• CVE-2025-38084Jun 28, 2025
  affected < 5.14.0-570.35.1.el9_6fixed 5.14.0-570.35.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables during VMA split, not before Currently, __split_vma() triggers hugetlb page table unsharing through vm_ops->may_split(). This happens before the VMA lock and rmap locks are take

• CVE-2022-50087Jun 18, 2025
  affected < 5.14.0-570.55.1.el9_6fixed 5.14.0-570.55.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the probe succeeds. If it

• CVE-2025-38079HigJun 18, 2025
  affected < 5.14.0-570.33.2.el9_6fixed 5.14.0-570.33.2.el9_6

  In the Linux kernel, the following vulnerability has been resolved: crypto: algif_hash - fix double free in hash_accept If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_relea

• CVE-2025-38052Jun 18, 2025
  affected < 5.14.0-570.32.1.el9_6fixed 5.14.0-570.32.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done Syzbot reported a slab-use-after-free with the following call trace: ================================================================== BUG:

• CVE-2025-37958May 20, 2025
  affected < 5.14.0-570.30.1.el9_6fixed 5.14.0-570.30.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address access, as illustrate

• CVE-2025-37943May 20, 2025
  affected < 5.14.0-570.21.1.el9_6fixed 5.14.0-570.21.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessi

• CVE-2025-37914May 20, 2025
  affected < 5.14.0-570.37.1.el9_6fixed 5.14.0-570.37.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report [1], there are use cases where a netem child qdisc will make the parent qdisc's enqueue callback reentrant

• CVE-2025-37890May 16, 2025
  affected < 5.14.0-570.32.1.el9_6fixed 5.14.0-570.32.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report [1], we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfs

• CVE-2024-28956MedMay 13, 2025
  affected < 5.14.0-570.35.1.el9_6fixed 5.14.0-570.35.1.el9_6

  Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

• CVE-2025-37823May 8, 2025
  affected < 5.14.0-570.39.1.el9_6fixed 5.14.0-570.39.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.

• CVE-2025-37810May 8, 2025
  affected < 5.14.0-570.46.1.el9_6fixed 5.14.0-570.46.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that event count does not exceed event buffer length The event count is read from register DWC3_GEVNTCOUNT. There is a check for the count being zero, but not for exceeding the event bu

• CVE-2025-37803May 8, 2025
  affected < 5.14.0-570.41.1.el9_6fixed 5.14.0-570.41.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: udmabuf: fix a buf size overflow issue during udmabuf creation by casting size_limit_mb to u64 when calculate pglimit.

• CVE-2025-37799May 3, 2025
  affected < 5.14.0-570.25.1.el9_6fixed 5.14.0-570.25.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 driver's XDP handling is buggy for packet sizes using ring0 (that is, packet sizes between 128 - 3k bytes). We noticed MTU-related connectivi