enterprise_linux_appstream_v_9 vulnerabilities
CVEs whose affected-version data names the enterprise_linux_appstream_v_9 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
183 CVEsRSS
CVE-2026-72262High· 7.8In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get The ipc_control_data buffer is allocated as kzalloc(max_size), where max_size covers the entire struct …
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get The ipc_control_data buffer is allocated as kzalloc(max_size), where max_size covers the entire struct …
CVE-2026-72320High· 7.0⚖ disputedkernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
A flaw was found in the Linux kernel's `netfilter` component, specifically within the `nft_lookup` functionality. This issue arises from incorrect handling of 'catchall' elements during 'inverted lookups' in the `nft_lookup_eval()` functio…
CVE-2026-72317Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc_clnt across the TLS connect_worker The TLS connect path has a use-after-free: nothing pins the upper rpc_clnt across the delayed connect_worker
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpc_clnt across the TLS connect_worker The TLS connect path has a use-after-free: nothing pins the upper rpc_clnt across the delayed connect_worker. …
CVE-2026-74509High· 8.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix advertising data UAFs hci_find_adv_instance() returns an adv_info pointer that is valid only while hdev->lock is held
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix advertising data UAFs hci_find_adv_instance() returns an adv_info pointer that is valid only while hdev->lock is held. The advertising comman…
CVE-2026-74516High· 8.2In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is activ…
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is activ…
CVE-2026-72072Medium· 4.1⚖ disputedkernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)
A flaw was found in the Linux kernel's MACsec (Media Access Control Security) component. A race condition during the deletion of an offloaded MACsec RX Security Channel (SC) allows the RX datapath to access and operate on memory that has a…
CVE-2026-72052High· 7.8kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
A flaw was found in the Linux kernel's `ip6_gre` and `ip6erspan` tunnel drivers. The `changelink` functions in these drivers do not adequately verify administrative capabilities (`CAP_NET_ADMIN`) across different network namespaces. This a…
CVE-2026-72255High· 7.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst The br_netfilter fake rtable is embedded in struct net_bridge and is attached to bridged packets wi…
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst The br_netfilter fake rtable is embedded in struct net_bridge and is attached to bridged packets wi…
CVE-2026-72045High· 8.8In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to re…
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to re…
CVE-2026-70464High· 7.5rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without trigger…
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without trigger…
CVE-2026-70460High· 8.1rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with…
CVE-2026-70458High· 8.2rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is …
rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is …
CVE-2026-70456High· 8.2rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list
rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv…
CVE-2026-70454High· 8.0rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise i…
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise i…
CVE-2026-70453High· 7.5rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadra…
CVE-2026-70452High· 7.4rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup f…
CVE-2026-53793High· 7.4rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root conta…
rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root conta…
CVE-2026-53790High· 8.1rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment …
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment …
CVE-2026-53785High· 7.1rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path…
CVE-2026-53783High· 8.1rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink…
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink…
CVE-2026-68448High· 7.0kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)
A flaw was found in the Linux kernel's overlayfs component. When copying files across different overlay filesystems, the system incorrectly checked read permissions using the destination filesystem's credentials instead of the source's. Th…
CVE-2026-68432High· 7.0kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
A flaw was found in the Linux kernel's VXLAN (Virtual Extensible LAN) implementation. A local attacker, with `CAP_NET_ADMIN` (network administration capability) in one network namespace, could exploit an incorrect privilege check in the `r…
CVE-2026-73066High· 7.1Tesseract is an open source OCR engine
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolv…
CVE-2026-68245High· 7.0kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
A flaw was found in the `drm/amdgpu` component of the Linux kernel. A use-after-unlock vulnerability exists where a virtual machine (VM) pointer is dereferenced after its protective lock has been released. This allows the pointer to be mod…
CVE-2026-68200High· 7.8kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) timer component. A lack of serialization in the userspace-driven timer (utimer) TRIGGER ioctl allows two threads to concurrently call snd_timer_interrupt(). Th…
CVE-2026-68143High· 7.8kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
A flaw was found in the Linux kernel's SLIP (Serial Line Internet Protocol) network component. A race condition exists during an MTU (Maximum Transmission Unit) change when the system reallocates receive buffers. This can allow a remote at…
CVE-2026-68140High· 7.0kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
A flaw was found in the Linux kernel. This use-after-free vulnerability exists in the `net/iucv` component. When a peer severs a connection, message notifications that still reference the freed connection path remain in a queue. A subseque…
CVE-2026-68123High· 7.0⚖ disputedkernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
A flaw was found in the Open vSwitch component of the Linux kernel. This vulnerability arises from an underflow condition when handling Generic Segmentation Offload (GSO) packets in userspace. A length calculation error can lead to a buffe…
CVE-2026-68121High· 7.3PoCkernel: pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121)
A flaw was found in the Linux kernel's PPPoE (Point-to-Point Protocol over Ethernet) implementation. This vulnerability occurs because a pointer to network packet data is not updated after memory is reallocated, leading to the use of an ou…
CVE-2026-68166High· 7.3In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can regis…