VYPR

rpm package

almalinux/kernel

pkg:rpm/almalinux/kernel

Vulnerabilities (1,333)

  • CVE-2026-43284HigMay 8, 2026
    affected < 4.18.0-553.124.1.el8_10fixed 4.18.0-553.124.1.el8_10

    In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths th

  • CVE-2026-43279HigMay 6, 2026
    affected < 4.18.0-553.136.1.el8_10fixed 4.18.0-553.136.1.el8_10

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received packets fit with the b

  • CVE-2026-43276HigMay 6, 2026
    affected < 5.14.0-687.22.1.el9_8fixed 5.14.0-687.22.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroy_workqueue on service rescan PCI path While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path. When mana_serv_reset() calls mana_g

  • CVE-2026-43260HigMay 6, 2026
    affected < 6.12.0-211.26.1.el10_2fixed 6.12.0-211.26.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the VNIC in FW only when

  • CVE-2026-43206HigMay 6, 2026
    affected < 4.18.0-553.156.1.el8_10fixed 4.18.0-553.156.1.el8_10

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivile

  • CVE-2026-43205HigMay 6, 2026
    affected < 6.12.0-211.18.1.el10_2fixed 6.12.0-211.18.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: validate num_ifs to prevent out-of-bounds write The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes() but never validates it against DPSW_MAX_IF (64). This value controls iter

  • CVE-2026-43198CriMay 6, 2026
    affected < 6.12.0-211.28.1.el10_2fixed 6.12.0-211.28.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible fro

  • CVE-2026-43190HigMay 6, 2026
    affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_tcpmss: check remaining length before reading optlen Quoting reporter: In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads op[i+1] directly without validating the remaining

  • CVE-2026-43186CriMay 6, 2026
    affected < 6.12.0-211.44.1.el10_2fixed 6.12.0-211.44.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide how much data to write for each node. It trusts this field as-is fr

  • CVE-2026-43163MedMay 6, 2026
    affected < 5.14.0-687.10.1.el9_8fixed 5.14.0-687.10.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fix GPF in write_page caused by resize race A General Protection Fault occurs in write_page() during array resize: RIP: 0010:write_page+0x22b/0x3c0 [md_mod] This is a use-after-free race between bit

  • CVE-2026-43158HigMay 6, 2026
    affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: xfs: fix freemap adjustments when adding xattrs to leaf blocks xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test VMs: ASSERT(ichdr-

  • CVE-2026-43128HigMay 6, 2026
    affected < 5.14.0-687.10.1.el9_8fixed 5.14.0-687.10.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately unpinned but the um

  • CVE-2026-43125CriMay 6, 2026
    affected < 4.18.0-553.132.1.el8_10fixed 4.18.0-553.132.1.el8_10

    In the Linux kernel, the following vulnerability has been resolved: dlm: validate length in dlm_search_rsb_tree The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-bounds write in dlm

  • CVE-2026-43116HigMay 6, 2026
    affected < 6.12.0-211.18.1.el10_2fixed 6.12.0-211.18.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ensure safe access to master conntrack Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->mas

  • CVE-2026-43112HigMay 6, 2026
    affected < 6.12.0-211.30.1.el10_2fixed 6.12.0-211.30.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *

  • CVE-2026-43110HigMay 6, 2026
    affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as a

  • CVE-2026-43074HigMay 6, 2026
    affected < 6.12.0-211.31.1.el10_2fixed 6.12.0-211.31.1.el10_2

    In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurrent thread. Defer t

  • CVE-2026-43056HigMay 1, 2026
    affected < 5.14.0-687.15.1.el9_8fixed 5.14.0-687.15.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in add_adev() error path If auxiliary_device_add() fails, add_adev() jumps to add_fail and calls auxiliary_device_uninit(adev). The auxiliary device has its release callback set t

  • CVE-2026-43051HigMay 1, 2026
    affected < 5.14.0-687.12.1.el9_8fixed 5.14.0-687.12.1.el9_8

    In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq The wacom_intuos_bt_irq() function processes Bluetooth HID reports without sufficient bounds checking. A maliciously crafted short report can trigger an

  • CVE-2026-43038CriMay 1, 2026
    affected < 4.18.0-553.132.1.el8_10fixed 4.18.0-553.132.1.el8_10

    In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() Sashiko AI-review observed: In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inet_skb_p

Page 5 of 67