almalinux/kernel-uki-virt

Vulnerabilities (729)

• CVE-2025-39806HigSep 16, 2025
  affected < 5.14.0-611.20.1.el9_7fixed 5.14.0-611.20.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_re

• CVE-2025-39818Sep 16, 2025
  affected < 6.12.0-124.43.1.el10_1fixed 6.12.0-124.43.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-b

• CVE-2025-40300MedSep 11, 2025
  affected < 5.14.0-570.62.1.el9_6fixed 5.14.0-570.62.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already

• CVE-2025-39766HigSep 11, 2025
  affected < 5.14.0-611.49.1.el9_7fixed 5.14.0-611.49.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add

• CVE-2025-39760HigSep 11, 2025
  affected < 5.14.0-611.30.1.el9_7fixed 5.14.0-611.30.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this

• CVE-2025-39757HigSep 11, 2025
  affected < 5.14.0-570.52.1.el9_6fixed 5.14.0-570.52.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer s

• CVE-2025-39761Sep 11, 2025
  affected < 5.14.0-570.51.1.el9_6fixed 5.14.0-570.51.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not decremented before peer cleanup, during error handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to out-of-bo

• CVE-2025-39730Sep 7, 2025
  affected < 6.12.0-124.13.1.el10_1fixed 6.12.0-124.13.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle.

• CVE-2025-39702HigSep 5, 2025
  affected < 5.14.0-570.60.1.el9_6fixed 5.14.0-570.60.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

• CVE-2025-39694MedSep 5, 2025
  affected < 5.14.0-570.46.1.el9_6fixed 5.14.0-570.46.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtu

• CVE-2025-39682HigSep 5, 2025
  affected < 5.14.0-570.49.1.el9_6fixed 5.14.0-570.49.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type

• CVE-2025-39698Sep 5, 2025
  affected < 5.14.0-570.49.1.el9_6fixed 5.14.0-570.49.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with REQ_F_ASYNC_DATA at t

• CVE-2025-38737Sep 5, 2025
  affected < 6.12.0-124.20.1.el10_1fixed 6.12.0-124.20.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise buffer to NULL before calling netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it is given. Setti

• CVE-2025-38731Sep 5, 2025
  affected < 5.14.0-611.26.1.el9_7fixed 5.14.0-611.26.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. =====================

• CVE-2025-38724HigSep 4, 2025
  affected < 6.12.0-124.16.1.el10_1fixed 6.12.0-124.16.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM c

• CVE-2025-38730Sep 4, 2025
  affected < 5.14.0-611.30.1.el9_7fixed 5.14.0-611.30.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and invalidates them on r

• CVE-2025-38718Sep 4, 2025
  affected < 5.14.0-570.49.1.el9_6fixed 5.14.0-570.49.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uniniti

• CVE-2025-38703Sep 4, 2025
  affected < 5.14.0-611.24.1.el9_7fixed 5.14.0-611.24.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated

• CVE-2025-38614MedAug 19, 2025
  affected < 5.14.0-570.52.1.el9_6fixed 5.14.0-570.52.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some re

• CVE-2025-38571Aug 19, 2025
  affected < 5.14.0-570.55.1.el9_6fixed 5.14.0-570.55.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kvec. Instead, this