rpm package
almalinux/kernel-tools
pkg:rpm/almalinux/kernel-tools
Vulnerabilities (1,333)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-46227 | Hig | 7.8 | < 5.14.0-687.22.1.el9_8 | 5.14.0-687.22.1.el9_8 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before t | |
| CVE-2026-46215 | Hig | 7.8 | < 6.12.0-211.37.1.el10_2 | 6.12.0-211.37.1.el10_2 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could del | |
| CVE-2026-46209 | Hig | 7.8 | < 6.12.0-211.30.1.el10_2 | 6.12.0-211.30.1.el10_2 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned int width = mo | |
| CVE-2026-46189 | Hig | 7.8 | < 5.14.0-687.19.1.el9_8 | 5.14.0-687.19.1.el9_8 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before triggers a double free. | |
| CVE-2026-46181 | Hig | 7.8 | < 4.18.0-553.132.1.el8_10 | 4.18.0-553.132.1.el8_10 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within the RCU critical se | |
| CVE-2026-46176 | Hig | 7.8 | < 5.14.0-687.19.1.el9_8 | 5.14.0-687.19.1.el9_8 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() mlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When ib_create_srq() fails for s1, the error branch destroys s0 but falls through a | |
| CVE-2026-46173 | Hig | 7.8 | < 6.12.0-211.26.1.el10_2 | 6.12.0-211.26.1.el10_2 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dead() calls __schedu | |
| CVE-2026-46166 | Hig | 8.8 | < 6.12.0-211.26.1.el10_2 | 6.12.0-211.26.1.el10_2 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-aft | |
| CVE-2026-46155 | Cri | 9.1 | < 5.14.0-687.22.1.el9_8 | 5.14.0-687.22.1.el9_8 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validati | |
| CVE-2026-46152 | Hig | 8.8 | < 4.18.0-553.134.1.el8_10 | 4.18.0-553.134.1.el8_10 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent callers then share on | |
| CVE-2026-46150 | Hig | 7.1 | < 6.12.0-211.37.1.el10_2 | 6.12.0-211.37.1.el10_2 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached mark | |
| CVE-2026-46145 | Hig | 7.8 | < 4.18.0-553.136.1.el8_10 | 4.18.0-553.136.1.el8_10 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds check it so the mem | |
| CVE-2026-46135 | Cri | 9.8 | < 4.18.0-553.136.1.el8_10 | 4.18.0-553.136.1.el8_10 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing again | |
| CVE-2026-46125 | Hig | 8.8 | < 4.18.0-553.134.1.el8_10 | 4.18.0-553.134.1.el8_10 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since i | |
| CVE-2026-46117 | Hig | 7.8 | < 5.14.0-687.17.1.el9_8 | 5.14.0-687.17.1.el9_8 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WARN_ON() then go on | |
| CVE-2026-46116 | Hig | 7.8 | < 5.14.0-687.22.1.el9_8 | 5.14.0-687.22.1.el9_8 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on | |
| CVE-2026-46113 | Hig | 8.8 | < 6.12.0-211.32.1.el10_2 | 6.12.0-211.32.1.el10_2 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest pag | |
| CVE-2026-46099 | Hig | 8.1 | < 5.14.0-687.29.1.el9_8 | 5.14.0-687.29.1.el9_8 | May 27, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking dst_hold() uncondi | |
| CVE-2026-46090 | Hig | 7.8 | < 4.18.0-553.136.1.el8_10 | 4.18.0-553.136.1.el8_10 | May 27, 2026 | In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa6 | |
| CVE-2026-46086 | Med | 5.5 | < 5.14.0-687.25.1.el9_8 | 5.14.0-687.25.1.el9_8 | May 27, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by `fdb_delete_local()`, which updates `f->dst` to another port or to `NULL` while keeping the entry alive. |
- affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before t
- affected < 6.12.0-211.37.1.el10_2fixed 6.12.0-211.37.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: drm: Set old handle to NULL before prime swap in change_handle There was a potential race condition in change_handle. The ioctl briefly had a single object with two idr entries; a concurrent gem_close could del
- affected < 6.12.0-211.30.1.el10_2fixed 6.12.0-211.30.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned int width = mo
- affected < 5.14.0-687.19.1.el9_8fixed 5.14.0-687.19.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path Sashiko points out that pvrdma_uar_free() is already called within pvrdma_dealloc_ucontext(), so calling it before triggers a double free.
- affected < 4.18.0-553.132.1.el8_10fixed 4.18.0-553.132.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within the RCU critical se
- affected < 5.14.0-687.19.1.el9_8fixed 5.14.0-687.19.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() mlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When ib_create_srq() fails for s1, the error branch destroys s0 but falls through a
- affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dead() calls __schedu
- affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use safe list iteration in radar detect work The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to be freed and removed from the list. Guard against this to avoid a slab-use-aft
- affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validati
- affected < 4.18.0-553.134.1.el8_10fixed 4.18.0-553.134.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent callers then share on
- affected < 6.12.0-211.37.1.el10_2fixed 6.12.0-211.37.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached mark
- affected < 4.18.0-553.136.1.el8_10fixed 4.18.0-553.136.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds check it so the mem
- affected < 4.18.0-553.136.1.el8_10fixed 4.18.0-553.136.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing again
- affected < 4.18.0-553.134.1.el8_10fixed 4.18.0-553.134.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since i
- affected < 5.14.0-687.17.1.el9_8fixed 5.14.0-687.17.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WARN_ON() then go on
- affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on
- affected < 6.12.0-211.32.1.el10_2fixed 6.12.0-211.32.1.el10_2
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest pag
- affected < 5.14.0-687.29.1.el9_8fixed 5.14.0-687.29.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking dst_hold() uncondi
- affected < 4.18.0-553.136.1.el8_10fixed 4.18.0-553.136.1.el8_10
In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa6
- affected < 5.14.0-687.25.1.el9_8fixed 5.14.0-687.25.1.el9_8
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by `fdb_delete_local()`, which updates `f->dst` to another port or to `NULL` while keeping the entry alive.
Page 3 of 67