almalinux/kernel-zfcpdump-devel-matched

Vulnerabilities (950)

• CVE-2026-46155CriMay 28, 2026
  affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns success without validati

• CVE-2026-46152HigMay 28, 2026
  affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop stray 'static' from fast-RX rx_result ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but its per-invocation rx_result is declared static. Concurrent callers then share on

• CVE-2026-46150HigMay 28, 2026
  affected < 6.12.0-211.37.1.el10_2fixed 6.12.0-211.37.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached mark

• CVE-2026-46145HigMay 28, 2026
  affected < 5.14.0-687.17.1.el9_8fixed 5.14.0-687.17.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Validate rx_hash_key_len Sashiko points out that rx_hash_key_len comes from a uAPI structure and is blindly passed to memcpy, allowing the userspace to trash kernel memory. Bounds check it so the mem

• CVE-2026-46135CriMay 28, 2026
  affected < 5.14.0-687.17.1.el9_8fixed 5.14.0-687.17.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queue teardown nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing again

• CVE-2026-46125HigMay 28, 2026
  affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since i

• CVE-2026-46117HigMay 28, 2026
  affected < 5.14.0-687.17.1.el9_8fixed 5.14.0-687.17.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() Sashiko points out that the user can specify WQs sharing the same CQ as a part of the uAPI and this will trigger the WARN_ON() then go on

• CVE-2026-46116HigMay 28, 2026
  affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on

• CVE-2026-46113HigMay 28, 2026
  affected < 6.12.0-211.32.1.el10_2fixed 6.12.0-211.32.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus the SPTE index. This assumption breaks for shadow paging if the guest pag

• CVE-2026-46099HigMay 27, 2026
  affected < 5.14.0-687.29.1.el9_8fixed 5.14.0-687.29.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking dst_hold() uncondi

• CVE-2026-46090HigMay 27, 2026
  affected < 5.14.0-687.19.1.el9_8fixed 5.14.0-687.19.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix peer runtime UAF during format-change stop loopback_check_format() may stop the capture side when playback starts with parameters that no longer match a running capture stream. Commit 826af7fa6

• CVE-2026-46086MedMay 27, 2026
  affected < 5.14.0-687.25.1.el9_8fixed 5.14.0-687.25.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by `fdb_delete_local()`, which updates `f->dst` to another port or to `NULL` while keeping the entry alive.

• CVE-2026-46056HigMay 27, 2026
  affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connec

• CVE-2026-46054HigMay 27, 2026
  affected < 6.12.0-211.22.1.el10_2fixed 6.12.0-211.22.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: selinux: fix overlayfs mmap() and mprotect() access checks The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "user" file) and the

• CVE-2026-45998HigMay 27, 2026
  affected < 6.12.0-211.30.1.el10_2fixed 6.12.0-211.30.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential UAF after skb_unshare() failure If skb_unshare() fails to unshare a packet due to allocation failure in rxrpc_input_packet(), the skb pointer in the parent (rxrpc_io_thread()) will be NULL'

• CVE-2026-45984HigMay 27, 2026
  affected < 5.14.0-687.17.1.el9_8fixed 5.14.0-687.17.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data still points to di

• CVE-2026-45898CriMay 27, 2026
  affected < 6.12.0-211.28.1.el10_2fixed 6.12.0-211.28.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removing work_list The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") changed the work submission logic to unconditionally call queue_work() with the expec

• CVE-2026-45852HigMay 27, 2026
  affected < 5.14.0-687.15.1.el9_8fixed 5.14.0-687.15.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix double free in rxe_srq_from_init In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fails, the function cal

• CVE-2026-46300HigMay 23, 2026
  affected < 5.14.0-687.10.1.el9_8fixed 5.14.0-687.10.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally

• CVE-2026-43501CriMay 21, 2026
  affected < 6.12.0-211.22.1.el10_2fixed 6.12.0-211.22.1.el10_2

  In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, then pulls the old h