openshift_container_platform vulnerabilities
CVEs whose affected-version data names the openshift_container_platform package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
478 CVEsRSS
CVE-2026-89554Medium· 5.5⚖ disputedkernel: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (CVE-2026-89554)
A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. When reconstructing a Multipath TCP (MPTCP) join request under SYN cookies, the `local_id` field is not properly initialized. An off-path attacker can influence t…
CVE-2026-89553High· 7.0kernel: nouveau/gem: reserve the bo in the info ioctl around the vma lookup (CVE-2026-89553)
A flaw was found in the Linux kernel's nouveau/gem component. A race condition exists where the graphics execution manager (GEM) close path can close a virtual memory area (VMA) while an information lookup is still trying to access it. Thi…
CVE-2026-89684High· 7.0kernel: nfsd: fix cpntf publish race in nfs4_init_cp_state (CVE-2026-89684)
A flaw was found in the Linux kernel's nfsd component. A remote attacker, by sending a specially crafted OFFLOAD_CANCEL request, could exploit a race condition during the initialization of copy state notifications. This could lead to a den…
CVE-2026-89673Medium· 5.5kernel: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (CVE-2026-89673)
A flaw was found in the Linux kernel's NFS daemon (nfsd). A remote attacker could exploit an error in the XDR (External Data Representation) padding calculation within the `ff_encode_getdeviceinfo` function. This mismatch between reserved …
CVE-2026-89672High· 7.0⚖ disputedkernel: nfsd: gate nfs2 setacl by argp->mask (CVE-2026-89672)
A flaw was found in the Linux kernel's Network File System (NFS) server daemon (`nfsd`). When processing NFSACL version 2 SETACL requests, the system could unintentionally remove a directory's default Access Control List (ACL) or both acce…
CVE-2026-89671High· 7.0⚖ disputedkernel: nfsd: gate nfs3 setacl by argp->mask (CVE-2026-89671)
A flaw was found in the Linux kernel's Network File System version 3 (NFSv3) server daemon (`nfsd`). The `nfsd3_proc_setacl()` function unconditionally processes Access Control List (ACL) update requests, even when the client's request doe…
CVE-2026-89669High· 7.0⚖ disputedkernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669)
A flaw was found in the `nfsd` component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafte…
CVE-2026-89665High· 7.0kernel: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (CVE-2026-89665)
A flaw was found in the Linux kernel's nfsd component. A remote attacker could exploit this vulnerability by sending a specially crafted NFSv2 SETATTR or CREATE request with an out-of-range 'useconds' value. This could lead to incorrect ti…
CVE-2026-89663High· 7.0kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the m…
CVE-2026-89662High· 7.0⚖ disputedkernel: NFSD: Prevent lock owner use-after-free during client teardown (CVE-2026-89662)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). During client teardown, a race condition can occur where a lock owner is freed while still being referenced, leading to a use-after-free vulnerability. This can resu…
CVE-2026-89657High· 7.0kernel: libceph: validate OSD extent maps before cursor advance (CVE-2026-89657)
A flaw was found in libceph in the Linux kernel. A malicious or compromised authenticated Ceph Object Storage Device (OSD) peer could send a specially crafted sparse-read reply that lacks proper validation of extent maps. This could cause …
CVE-2026-89656High· 7.0⚖ disputedkernel: libceph: reject buckets with mismatched CRUSH ids (CVE-2026-89656)
A flaw was found in libceph within the Linux kernel. This vulnerability allows a local attacker to craft a malformed CRUSH map, which is used for data placement. By doing so, one data bucket can be made to reuse another bucket's memory wor…
CVE-2026-89655High· 7.0⚖ disputedkernel: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (CVE-2026-89655)
A flaw was found in the Linux kernel's Ceph file system component. A race condition exists in the `__kick_flushing_caps()` function during the handling of capability messages. This allows a separate process to free a data structure (`cf en…
CVE-2026-89653High· 8.1⚖ disputedkernel: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode (CVE-2026-89653)
A flaw was found in the Linux kernel's Ceph filesystem. This vulnerability occurs when a malicious or malformed MDSMap export_targets entry, controlled by a monitor, contains a rank value that exceeds the maximum allowed (CEPH_MAX_MDS) dur…
CVE-2026-89652High· 7.0⚖ disputedkernel: ceph: bound copied dentry name length in NFS export get_name (CVE-2026-89652)
A flaw was found in the Linux kernel's Ceph file system. A malicious or compromised Ceph Metadata Server (MDS) can send a specially crafted `LOOKUPNAME` reply that causes a buffer overflow when copying dentry names during an NFS export ope…
CVE-2026-89650High· 7.0⚖ disputedkernel: ceph: bound num_export_targets array for mds info v2/v3 (CVE-2026-89650)
A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph monitor, or an on-path attacker, can send a specially crafted Metadata Server (MDS) map. This map, with an oversized num_export_targets field and a per-MDS…
CVE-2026-89649High· 7.0⚖ disputedkernel: ceph: bound xattr value length in __build_xattrs() (CVE-2026-89649)
A flaw was found in the Linux kernel's Ceph file system (CephFS) component. A malicious or compromised metadata server can manipulate the length of an extended attribute (xattr) value, causing the system to read beyond the intended memory …
CVE-2026-89640Medium· 5.5kernel: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (CVE-2026-89640)
A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. When performing a file range remapping operation with a zero length, an integer underflow can occur if the offset exceeds the file size. This can lea…
CVE-2026-89636High· 7.0⚖ disputedkernel: smb: client: clear ce->tgthint in free_tgts() (CVE-2026-89636)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. When the `free_tgts()` function frees data structures, a pointer (`ce->tgthint`) is not properly reset, leaving it pointing to a memory location that has already bee…
CVE-2026-89634High· 7.0⚖ disputedkernel: smb: client: fix ALIGN() overflow in symlink_data() error context loop (CVE-2026-89634)
A flaw was found in the Server Message Block (SMB) client within the Linux kernel. An integer overflow in the ALIGN() function, specifically within the symlink_data() error context loop, can lead to an out-of-bounds read. This issue allows…
CVE-2026-89628Medium· 5.5kernel: HID: picolcd: clamp eeprom debugfs read to bytes actually received (CVE-2026-89628)
A flaw was found in the Human Interface Device (HID) picolcd driver in the Linux kernel. A local attacker with root privileges, by using a specially crafted or spoofed picoLCD device, could exploit an out-of-bounds read vulnerability in th…
CVE-2026-89627Medium· 5.5kernel: HID: roccat: free buffered reports when destroying device (CVE-2026-89627)
A flaw was found in the Linux kernel's HID (Human Interface Device) roccat driver. When a roccat device is destroyed, the driver fails to properly free buffered reports, leading to a memory leak. A local attacker could potentially exploit …
CVE-2026-89626High· 7.0kernel: HID: sensor: custom: Fix field sysfs group cleanup on failure (CVE-2026-89626)
A flaw was found in the Linux kernel's Human Interface Device (HID) sensor custom driver. When creating sysfs groups for custom sensor fields, the `hid_sensor_custom_add_attributes()` function fails to properly clean up previously created …
CVE-2026-89623Medium· 5.5kernel: HID: mcp2221: stop device IO before hid_hw_stop (CVE-2026-89623)
A flaw was found in the Linux kernel's HID (Human Interface Device) mcp2221 driver. This vulnerability occurs when the device's input/output (IO) operations are not properly stopped before hardware teardown during device removal or probe f…
CVE-2026-89621Medium· 5.5kernel: HID: mcp2221: validate report size in mcp2221_raw_event() (CVE-2026-89621)
A flaw was found in the Linux kernel's HID (Human Interface Device) mcp2221 driver. A malicious USB device can exploit this vulnerability by sending a specially crafted, short HID report with an invalid size. This can cause the system to r…
CVE-2026-89746High· 7.0kernel: tracing: Fix use-after-free with same-name named triggers (CVE-2026-89746)
A flaw was found in the Linux kernel's tracing component. A local user can exploit a use-after-free vulnerability by registering multiple histogram triggers with the same name. This action causes the kernel to attempt to access freed memor…
CVE-2026-89735Medium· 5.5kernel: usb: gadget: midi2: remove default configfs groups on teardown (CVE-2026-89735)
A flaw was found in the Linux kernel's USB gadget MIDI2 driver. The driver fails to properly remove default configuration file system (configfs) groups during teardown, leading to a resource leak. A local attacker could exploit this vulner…
CVE-2026-89732Medium· 5.5kernel: usb: gadget: f_fs: Prevent deadlock during ep0 read loop (CVE-2026-89732)
A flaw was found in the Linux kernel's USB FunctionFS (f_fs) module. A local attacker could exploit a deadlock vulnerability in the ffs_ep0_read() function. This occurs when a userspace daemon polls ep0 and the USB gadget is simultaneously…
CVE-2026-89730Medium· 5.5kernel: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (CVE-2026-89730)
A flaw was found in the `altera-cvp` FPGA driver within the Linux kernel. The `altera_cvp_send_block()` function can perform an out-of-bounds read when processing the trailing bytes of an input buffer. This occurs if the buffer ends at a p…
CVE-2026-89729High· 7.0kernel: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (CVE-2026-89729)
A flaw was found in the Linux kernel's Human Interface Device (HID) sensor-hub driver. A local attacker could exploit this vulnerability by providing a specially crafted HID descriptor. This malicious descriptor could cause the `sensor_hub…