Tagged “red-hat”
CVEs tagged red-hat, newest first.
2912 CVEsRSS
CVE-2026-89513Medium· 5.5kernel: RISC-V: KVM: Fix PMU event info array size overflow (CVE-2026-89513)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) component for RISC-V architectures. A malicious guest operating system could exploit an integer overflow vulnerability by providing a crafted number of Performance M…
CVE-2026-89507Medium· 5.5⚖ disputedkernel: RDMA/ucma: Lock the handler in ucma_write_cm_event() (CVE-2026-89507)
A flaw was found in the Linux kernel's RDMA/ucma component. A race condition exists in the `ucma_write_cm_event()` function where it re-reads a critical file pointer multiple times without proper locking. This allows another function, `ucm…
CVE-2026-89503Medium· 5.5⚖ disputedkernel: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (CVE-2026-89503)
A flaw was found in the Linux kernel's ring-buffer component. A race condition exists in the `ring_buffer_alloc_read_page()` function when it interacts with `ring_buffer_subbuf_order_set`. This can lead to an incorrect memory allocation wh…
CVE-2026-89501High· 7.0kernel: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (CVE-2026-89501)
A flaw was found in the Linux kernel's ring-buffer component. A race condition occurs when resizing a sub-buffer without properly holding the `cpu_buffer::lock`. This oversight can lead to concurrency issues with memory allocation and deal…
CVE-2026-89500High· 7.0⚖ disputedkernel: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (CVE-2026-89500)
A flaw was found in the Linux kernel's ring-buffer component. When a cached reader page is discarded after a concurrent ring buffer resize, the system may use an incorrect buffer size for memory deallocation. This mismatch can lead to a ke…
CVE-2026-89499Medium· 5.5⚖ disputedkernel: ring-buffer: Stop remote reader update when page swap fails (CVE-2026-89499)
A flaw was found in the Linux kernel's ring-buffer component. When a remote reader update fails during a page swap, the system incorrectly proceeds as if the swap succeeded. This can lead to log flooding, potentially causing a denial of se…
CVE-2026-89492Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-dire…
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-dire…
CVE-2026-89486Medium· 5.5⚖ disputedkernel: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() (CVE-2026-89486)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) subsystem. Due to incorrect synchronization during the deallocation of command receiver objects, a use-after-free vulnerability can occur. This allows …
CVE-2026-89472Medium· 5.5⚖ disputedkernel: power: supply: charger-manager: register regulators before exposing sysfs (CVE-2026-89472)
A flaw was found in the Linux kernel's power supply charger-manager component. A race condition exists where the system frees charger regulators before their corresponding sysfs entries are unregistered. A local attacker can exploit this b…
CVE-2026-89459Medium· 5.5⚖ disputedkernel: s390/percpu: Fix MVIY_PERCPU() with older binutils (CVE-2026-89459)
A flaw was found in the Linux kernel's s390/percpu component. This vulnerability arises when the kernel is compiled with older versions of GNU as (prior to binutils 2.39). A parsing error prevents a crucial instruction from being correctly…
CVE-2026-89452Medium· 5.5⚖ disputedkernel: iommu/msm: Unwind probe state on registration failure (CVE-2026-89452)
A flaw was found in the `iommu/msm` component of the Linux kernel. This vulnerability occurs when `msm_iommu_probe()` fails to properly unwind its probe state during registration, leaving a dangling list entry. A local attacker could poten…
CVE-2026-89450High· 7.0kernel: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field (CVE-2026-89450)
A flaw was found in the Linux kernel's iommu/tegra241-cmdqv module. A Virtual Machine Manager (VMM) can exploit this vulnerability by providing a virtual Stream ID (vSID) that exceeds the intended 20-bit width of the SID_MATCH field. This …
CVE-2026-89445High· 7.0kernel: iommufd: Fix UAF in selftest IOPF reporting (CVE-2026-89445)
A flaw was found in the Linux kernel's iommufd selftest component. This Use-After-Free (UAF) vulnerability occurs when the TRIGGER_IOPF function borrows an attach handle without proper synchronization during a PASID detach operation. A con…
CVE-2026-89441Medium· 5.5⚖ disputedkernel: mmc: via-sdmmc: cancel card-detect work on remove (CVE-2026-89441)
A flaw was found in the Linux kernel, specifically within the `mmc: via-sdmmc` driver responsible for managing SD and MultiMediaCard (MMC) devices. This vulnerability occurs during device removal, where a timing issue allows a process to a…
CVE-2026-89436Medium· 5.5⚖ disputedkernel: platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] (CVE-2026-89436)
A flaw was found in the Linux kernel's `panasonic-laptop` driver. This vulnerability involves an out-of-bounds write when processing ACPI SINF packages, where a small amount of data is written beyond the intended memory buffer. This can le…
CVE-2026-81016Medium· 5.5⚖ disputedkernel: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address (CVE-2026-81016)
A flaw was found in the Linux kernel. Specifically, within the AMD Platform Management Controller (PMC) component, the `amd_stb_s2d_init()` function does not properly validate memory addresses returned by System Management Unit (SMU) comma…
CVE-2026-81015High· 7.0⚖ disputedkernel: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails (CVE-2026-81015)
A flaw was found in the Linux kernel's AMD PMC (Power Management Controller) driver. When the `amd_stb_s2d_init()` function fails during the driver's initialization process, it can lead to unreleased resources, specifically the LPS0 s2idle…
CVE-2026-81006Medium· 5.5⚖ disputedkernel: ipmi: Remove all sysfs files on registration failure (CVE-2026-81006)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) component. During the registration of an IPMI system management interface, an error in the cleanup process can leave a system file (sysfs attribute) re…
CVE-2026-89635Medium· 5.5⚖ disputedkernel: ksmbd: only rebind the reopened file's own oplock on durable reconnect (CVE-2026-89635)
A flaw was found in ksmbd, a component of the Linux kernel. An authenticated attacker could exploit a use-after-free vulnerability by manipulating durable handles and oplocks during session reconnection. When two sessions hold durable hand…
CVE-2026-89633High· 7.0⚖ disputedkernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. The `coalesce_t2()` function processes server-supplied `DataOffset` fields without proper validation against buffer boundaries. A remote attacker could exploit this …
CVE-2026-89631High· 8.1⚖ disputedkernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an intege…
CVE-2026-89630High· 7.0⚖ disputedkernel: smb: client: restore the data_offset bound in is_valid_oplock_break() (CVE-2026-89630)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. An incorrect calculation of the `data_offset` bound in the `is_valid_oplock_break()` function can lead to a read overflow. This vulnerability allows a malicious SMB …
CVE-2026-89624High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universal_pidff_probe() starts the device with hid_hw_start() and then, if force-feedback initiali…
In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universal_pidff_probe() starts the device with hid_hw_start() and then, if force-feedback initiali…
CVE-2026-89622High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfe…
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfe…
CVE-2026-89620High· 7.0kernel: HID: intel-thc-hid: intel-quickspi: validate report size before copy (CVE-2026-89620)
A flaw was found in the Linux kernel's HID Intel QuickSPI driver. A local attacker can exploit a heap buffer overflow by providing a specially crafted report through a `hidraw SET_REPORT/SET_FEATURE ioctl`. This allows the attacker to over…
CVE-2026-89619High· 7.0kernel: HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer (CVE-2026-89619)
A flaw was found in the Linux kernel, specifically within the `intel-quickspi` driver. This vulnerability allows a malicious Human Interface Device (HID) to send an oversized report, which is then copied into a buffer without proper size v…
CVE-2026-89614Medium· 5.5⚖ disputedkernel: ntfs: bound the free-cluster bitmap scan to the volume (CVE-2026-89614)
A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because the free-cluster bitmap scan is not properly bounded to the volume size. A specially crafted NTFS image, where the bitmap covers more cluster…
CVE-2026-89613Medium· 5.5⚖ disputedkernel: ntfs: reject invalid empty mapping pairs (CVE-2026-89613)
A flaw was found in the Linux kernel's NTFS filesystem driver. This vulnerability occurs when the driver processes an attribute with empty mapping pairs that have inconsistent highest Virtual Cluster Number (VCN) and size. A local attacker…
CVE-2026-89612Medium· 5.5⚖ disputedkernel: ntfs: reject invalid MFT LCNs from boot sector (CVE-2026-89612)
A flaw was found in the Linux kernel's NTFS filesystem driver. A local attacker could provide a specially crafted NTFS boot sector containing an invalid Master File Table (MFT) Logical Cluster Number (LCN). Due to an integer overflow durin…
CVE-2026-89611Medium· 5.5⚖ disputedkernel: ntfs: validate non-resident attribute offsets (CVE-2026-89611)
A flaw was found in the Linux kernel. The NTFS file system driver does not properly validate non-resident attribute offsets when converting between sparse and non-sparse attributes. A local attacker could craft a malicious Master File Tabl…