almalinux/kernel-uki-virt-addons

Vulnerabilities (400)

• CVE-2024-53241Dec 24, 2024
  affected < 6.12.0-124.8.1.el10_1fixed 6.12.0-124.8.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is done in preparati

• CVE-2024-53135Dec 4, 2024
  affected < 5.14.0-611.5.1.el9_7fixed 5.14.0-611.5.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN Hide KVM's pt_mode module param behind CONFIG_BROKEN, i.e. disable support for virtualizing Intel PT via guest/host mode unless BROK

• CVE-2024-53122Dec 2, 2024
  affected < 5.14.0-503.21.1.el9_5fixed 5.14.0-503.21.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the 3whs. A racing rec

• CVE-2024-53119Dec 2, 2024
  affected < 5.14.0-611.5.1.el9_7fixed 5.14.0-611.5.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Fix accept_queue memory leak As the final stages of socket destruction may be delayed, it is possible that virtio_transport_recv_listen() will be called after the accept_queue has been flushed, bu

• CVE-2024-53113Dec 2, 2024
  affected < 5.14.0-503.31.1.el9_5fixed 5.14.0-503.31.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof We triggered a NULL pointer dereference for ac.preferred_zoneref->zone in alloc_pages_bulk_noprof() when the task is migrated between cpusets. When c

• CVE-2024-53104KEVDec 2, 2024
  affected < 5.14.0-503.23.2.el9_5fixed 5.14.0-503.23.2.el9_5

  In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the fra

• CVE-2023-52922Nov 28, 2024
  affected < 5.14.0-503.31.1.el9_5fixed 5.14.0-503.31.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: can: bcm: Fix UAF in bcm_proc_show() BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862 CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153

• CVE-2024-53090Nov 21, 2024
  affected < 5.14.0-611.5.1.el9_7fixed 5.14.0-611.5.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: afs: Fix lock recursion afs_wake_up_async_call() can incur lock recursion. The problem is that it is called from AF_RXRPC whilst holding the ->notify_lock, but it tries to take a ref on the afs_call struct in

• CVE-2024-53088Nov 19, 2024
  affected < 5.14.0-503.22.1.el9_5fixed 5.14.0-503.22.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: i40e: fix race condition by adding filter's intermediate sync state Fix a race condition in the i40e driver that leads to MAC/VLAN filters becoming corrupted and leaking. Address the issue that occurs under hea

• CVE-2024-53052Nov 19, 2024
  affected < 5.14.0-611.5.1.el9_7fixed 5.14.0-611.5.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write When io_uring starts a write, it'll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happening while that write

• CVE-2024-50302MedKEVNov 19, 2024
  affected < 5.14.0-503.31.1.el9_5fixed 5.14.0-503.31.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak k

• CVE-2024-50301HigNov 19, 2024
  affected < 5.14.0-570.51.1.el9_6fixed 5.14.0-570.51.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: security/keys: fix slab-out-of-bounds in key_task_permission KASAN reports an out of bounds read: BUG: KASAN: slab-out-of-bounds in __kuid_val include/linux/uidgid.h:36 BUG: KASAN: slab-out-of-bounds in uid_eq

• CVE-2024-50294Nov 19, 2024
  affected < 5.14.0-611.5.1.el9_7fixed 5.14.0-611.5.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing locking causing hanging calls If a call gets aborted (e.g. because kafs saw a signal) between it being queued for connection and the I/O thread picking up the call, the abort will be prioriti

• CVE-2024-50275Nov 19, 2024
  affected < 5.14.0-503.22.1.el9_5fixed 5.14.0-503.22.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: arm64/sve: Discard stale CPU state when handling SVE traps The logic for handling SVE traps manipulates saved FPSIMD/SVE state incorrectly, and a race with preemption can result in a task having TIF_SVE set and

• CVE-2024-50264Nov 19, 2024
  affected < 5.14.0-503.31.1.el9_5fixed 5.14.0-503.31.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After-Free condition. T

• CVE-2024-50262HigNov 9, 2024
  affected < 5.14.0-503.19.1.el9_5fixed 5.14.0-503.19.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths

• CVE-2024-50251MedNov 9, 2024
  affected < 5.14.0-503.16.1.el9_5fixed 5.14.0-503.16.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON(). skb_checksum() internally

• CVE-2024-50255Nov 9, 2024
  affected < 5.14.0-503.19.1.el9_5fixed 5.14.0-503.19.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes. __hci_cmd_sync_sk() returns NULL if a command returns a status event. However, it

• CVE-2024-50252Nov 9, 2024
  affected < 5.14.0-503.21.1.el9_5fixed 5.14.0-503.21.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address The device stores IPv6 addresses that are used for encapsulation in linear memory that is managed by the driver. Changing the remote addr

• CVE-2024-50226Nov 9, 2024
  affected < 5.14.0-503.15.1.el9_5fixed 5.14.0-503.15.1.el9_5

  In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown In support of investigating an initialization failure report [1], cxl_test was updated to register mock memory-devices after the mock root-port