almalinux/kernel-zfcpdump-modules-extra

Vulnerabilities (1,298)

• CVE-2025-39698HigSep 5, 2025
  affected < 5.14.0-570.49.1.el9_6fixed 5.14.0-570.49.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with REQ_F_ASYNC_DATA at t

• CVE-2025-39697HigSep 5, 2025
  affected < 4.18.0-553.85.1.el8_10fixed 4.18.0-553.85.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succ

• CVE-2025-39694HigSep 5, 2025
  affected < 5.14.0-570.46.1.el9_6fixed 5.14.0-570.46.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtu

• CVE-2025-39682CriSep 5, 2025
  affected < 5.14.0-570.49.1.el9_6fixed 5.14.0-570.49.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type

• CVE-2025-38737CriSep 5, 2025
  affected < 6.12.0-124.20.1.el10_1fixed 6.12.0-124.20.1.el10_1

  In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise buffer to NULL before calling netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it is given. Setti

• CVE-2025-38731HigSep 5, 2025
  affected < 5.14.0-611.26.1.el9_7fixed 5.14.0-611.26.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. =====================

• CVE-2025-38730HigSep 4, 2025
  affected < 5.14.0-611.30.1.el9_7fixed 5.14.0-611.30.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and invalidates them on r

• CVE-2025-38724CriSep 4, 2025
  affected < 4.18.0-553.87.1.el8_10fixed 4.18.0-553.87.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM c

• CVE-2025-38718HigSep 4, 2025
  affected < 5.14.0-570.49.1.el9_6fixed 5.14.0-570.49.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uniniti

• CVE-2025-38703HigSep 4, 2025
  affected < 5.14.0-611.24.1.el9_7fixed 5.14.0-611.24.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated

• CVE-2025-38653HigAug 22, 2025
  affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

  In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after commit 654b33ada4

• CVE-2025-38614HigAug 19, 2025
  affected < 5.14.0-570.52.1.el9_6fixed 5.14.0-570.52.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some re

• CVE-2025-38571HigAug 19, 2025
  affected < 5.14.0-570.55.1.el9_6fixed 5.14.0-570.55.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kvec. Instead, this

• CVE-2025-38568HigAug 19, 2025
  affected < 5.14.0-611.27.1.el9_7fixed 5.14.0-611.27.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MAX_QUEUE (16). This

• CVE-2025-38566CriAug 19, 2025
  affected < 5.14.0-570.55.1.el9_6fixed 5.14.0-570.55.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kvec.. kTLS implemen

• CVE-2025-38556HigAug 19, 2025
  affected < 4.18.0-553.76.1.el8_10fixed 4.18.0-553.76.1.el8_10

  In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity.

• CVE-2025-38550HigAug 16, 2025
  affected < 5.14.0-570.44.1.el9_6fixed 5.14.0-570.44.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() return.

• CVE-2025-38527CriAug 16, 2025
  affected < 5.14.0-570.49.1.el9_6fixed 5.14.0-570.49.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_oplock_break() leading to a use-after-free of the cinode structure when unmounting: cifs_oplock_break() _cifsFileIn

• CVE-2025-38500HigAug 12, 2025
  affected < 5.14.0-570.39.1.el9_6fixed 5.14.0-570.39.1.el9_6

  In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such in

• CVE-2025-38499HigAug 11, 2025
  affected < 5.14.0-611.16.1.el9_7fixed 5.14.0-611.16.1.el9_7

  In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be