almalinux/kernel-rt

Vulnerabilities (1,515)

• CVE-2026-63923HigJul 19, 2026
  affected < 5.14.0-687.48.1.el9_8fixed 5.14.0-687.48.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY r

• CVE-2026-63921HigJul 19, 2026
  affected < 6.12.0-211.55.1.el10_2fixed 6.12.0-211.55.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) for the collision l

• CVE-2026-63919HigJul 19, 2026
  affected < 6.12.0-211.55.1.el10_2fixed 6.12.0-211.55.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until t

• CVE-2026-63917HigJul 19, 2026
  affected < 6.12.0-211.55.1.el10_2fixed 6.12.0-211.55.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6

• CVE-2026-63913HigJul 19, 2026
  affected < 4.18.0-553.158.1.rt7.499.el8_10fixed 4.18.0-553.158.1.rt7.499.el8_10

  In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an

• CVE-2026-63889HigJul 19, 2026
  affected < 5.14.0-687.47.1.el9_8fixed 5.14.0-687.47.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the ge

• CVE-2026-63888CriJul 19, 2026
  affected < 6.12.0-211.49.1.el10_2fixed 6.12.0-211.49.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target

• CVE-2026-63887CriJul 19, 2026
  affected < 6.12.0-211.47.1.el10_2fixed 6.12.0-211.47.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer alloc

• CVE-2026-63886CriJul 19, 2026
  affected < 6.12.0-211.49.1.el10_2fixed 6.12.0-211.49.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passes chap_r directly t

• CVE-2026-63884HigJul 19, 2026
  affected < 4.18.0-553.156.1.rt7.497.el8_10fixed 4.18.0-553.156.1.rt7.497.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix potential UAF in TTM object purge TLDR: The bo->ttm object might be changed by calling ttm_bo_validate(), move casting it to an i915_tt object later to actually get the right pointer.

• CVE-2026-63879HigJul 19, 2026
  affected < 4.18.0-553.156.1.rt7.497.el8_10fixed 4.18.0-553.156.1.rt7.497.el8_10

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_hmm_range_get_pages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized retur

• CVE-2026-63875HigJul 19, 2026
  affected < 4.18.0-553.169.1.rt7.510.el8_10fixed 4.18.0-553.169.1.rt7.510.el8_10

  In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true but the aarch64 tlb_flush()

• CVE-2026-63869HigJul 19, 2026
  affected < 6.12.0-211.56.1.el10_2fixed 6.12.0-211.56.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value directl

• CVE-2026-63831HigJul 19, 2026
  affected < 4.18.0-553.167.1.rt7.508.el8_10fixed 4.18.0-553.167.1.rt7.508.el8_10

  In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb_cow_data() before in-place crypto llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform in-place cryptographic transfor

• CVE-2026-63829HigJul 19, 2026
  affected < 4.18.0-553.171.1.rt7.512.el8_10fixed 4.18.0-553.171.1.rt7.512.el8_10

  In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created i

• CVE-2026-63824HigJul 19, 2026
  affected < 6.12.0-211.51.1.el10_2fixed 6.12.0-211.51.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl_pkey_params_get_2() The length for the internal output buffer is calculated incorrectly, which can result overflow when a too small buffer is provided. Fix the bug by allocating in

• CVE-2026-63823HigJul 19, 2026
  affected < 4.18.0-553.166.1.rt7.507.el8_10fixed 4.18.0-553.166.1.rt7.507.el8_10

  In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for helper

• CVE-2026-63808CriJul 19, 2026
  affected < 6.12.0-211.51.1.el10_2fixed 6.12.0-211.51.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfat_find_dir_entry() In exfat_find_dir_entry(), the buffer_head obtained from exfat_get_dentry() is released with brelse(bh) before the fall-through TYPE_EXTEND branch r

• CVE-2026-63802HigJul 19, 2026
  affected < 4.18.0-553.163.1.rt7.504.el8_10fixed 4.18.0-553.163.1.rt7.504.el8_10

  In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another b

• CVE-2026-63801HigJul 19, 2026
  affected < 4.18.0-553.162.1.rt7.503.el8_10fixed 4.18.0-553.162.1.rt7.503.el8_10

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a reference on the netns, unlike the encrypt pa