almalinux/kernel-rt

Vulnerabilities (1,515)

• CVE-2026-64304HigJul 25, 2026
  affected < 6.12.0-211.50.1.el10_2fixed 6.12.0-211.50.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size D

• CVE-2026-64300HigJul 25, 2026
  affected < 6.12.0-211.47.1.el10_2fixed 6.12.0-211.47.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are serialized by rb->aux_m

• CVE-2026-64298HigJul 25, 2026
  affected < 6.12.0-211.50.1.el10_2fixed 6.12.0-211.50.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMO

• CVE-2026-64287HigJul 25, 2026
  affected < 5.14.0-687.45.1.el9_8fixed 5.14.0-687.45.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loo

• CVE-2026-64277HigJul 25, 2026
  affected < 5.14.0-687.42.1.el9_8fixed 5.14.0-687.42.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gp

• CVE-2026-64276HigJul 25, 2026
  affected < 5.14.0-687.42.1.el9_8fixed 5.14.0-687.42.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f30_attention() itera

• CVE-2026-64268CriJul 25, 2026
  affected < 4.18.0-553.159.1.rt7.500.el8_10fixed 4.18.0-553.159.1.rt7.500.el8_10

  In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accum

• CVE-2026-64255HigJul 24, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mas

• CVE-2026-64219HigJul 24, 2026
  affected < 4.18.0-553.156.1.rt7.497.el8_10fixed 4.18.0-553.156.1.rt7.497.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[

• CVE-2026-64191HigJul 20, 2026
  affected < 5.14.0-687.42.1.el9_8fixed 5.14.0-687.42.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avoid overrunning the

• CVE-2026-64189HigJul 20, 2026
  affected < 5.14.0-687.42.1.el9_8fixed 5.14.0-687.42.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the a

• CVE-2026-64176HigJul 19, 2026
  affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but rather their PLCP va

• CVE-2026-64175HigJul 19, 2026
  affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. However, iw

• CVE-2026-64174MedJul 19, 2026
  affected < 5.14.0-687.49.1.el9_8fixed 5.14.0-687.49.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its

• CVE-2026-64136CriJul 19, 2026
  affected < 6.12.0-211.50.1.el10_2fixed 6.12.0-211.50.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around

• CVE-2026-64117HigJul 19, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() r

• CVE-2026-64113CriJul 19, 2026
  affected < 6.12.0-211.53.1.el10_2fixed 6.12.0-211.53.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to t

• CVE-2026-64111HigJul 19, 2026
  affected < 6.12.0-211.55.1.el10_2fixed 6.12.0-211.55.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: lsm: hold cred_guard_mutex for lsm_set_self_attr() Just as proc_pid_attr_write() already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptr

• CVE-2026-64102CriJul 19, 2026
  affected < 5.14.0-687.53.1.el9_8fixed 5.14.0-687.53.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller

• CVE-2026-64098HigJul 19, 2026
  affected < 6.12.0-211.60.1.el10_2fixed 6.12.0-211.60.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore its re