Tagged “red-hat”
CVEs tagged red-hat, newest first.
2912 CVEsRSS
CVE-2026-89679Medium· 5.5kernel: nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs (CVE-2026-89679)
A flaw was found in the Linux kernel's nfsd component. A remote attacker can exploit this by sending a specially crafted SETATTR request that includes specific delegation timestamp attributes and a special NFSv4 state ID. This triggers a n…
CVE-2026-89678High· 7.0kernel: nfsd: fix partial-write detection in nfsd_direct_write (CVE-2026-89678)
A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd) component. The `nfsd_direct_write()` function, responsible for handling direct writes, incorrectly detects partial writes. This issue occurs because the logic f…
CVE-2026-89677High· 7.0⚖ disputedkernel: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() (CVE-2026-89677)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When creating files, the `dentry_create()` function could return an unexpected directory entry (dentry). This could lead to a previously stored dentry being prematur…
CVE-2026-89676Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids…
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids…
CVE-2026-89675High· 7.0⚖ disputedkernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675)
A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free (UAF) vulnerability. This allows an async copy object to be fr…
CVE-2026-89670High· 7.0kernel: nfsd: hold rcu across localio cmpxchg retry (CVE-2026-89670)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd) component. A race condition exists in the `nfsd_open_local_fh()` function where an `nfsd_file` object can be freed and its memory recycled while another process attem…
CVE-2026-89668High· 7.0⚖ disputedkernel: nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() (CVE-2026-89668)
A flaw was found in the `nfsd` component of the Linux kernel. The `nfsd_debugfs_init()` function is called before `nfsd4_init_slabs()`. If the slab allocation fails, the `nfsd_debugfs_exit()` cleanup function is bypassed, leaving orphaned …
CVE-2026-89667High· 8.1⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsd_file from the rhashtabl…
In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsd_file from the rhashtabl…
CVE-2026-89664High· 7.0kernel: nfsd: release OPEN-decoded posix ACLs via op_release (CVE-2026-89664)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When processing malformed NFSv4 OPEN compound operations that include valid Portable Operating System Interface (POSIX) Access Control List (ACL) attributes, the ker…
CVE-2026-89660Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4_client; a stateid reference does not pin it
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4_client; a stateid reference does not pin it. The cli…
CVE-2026-89659Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4_client and does not keep it alive
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4_client and does not keep it alive. The …
CVE-2026-89658High· 7.0⚖ disputedkernel: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (CVE-2026-89658)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). During NFSv4.0 revoked-state cleanup, a race condition can occur where a client's state identifier (stateid) reference does not properly prevent the client from bein…
CVE-2026-89654High· 7.0⚖ disputedkernel: ceph: fix UAF in check_new_map() on session freed during unlock (CVE-2026-89654)
A flaw was found in the Ceph file system component of the Linux kernel. A race condition exists in the `check_new_map()` function during session handling. This allows a local attacker to exploit a use-after-free vulnerability by freeing a …
CVE-2026-89651High· 7.0⚖ disputedkernel: ceph: bound MDSCapAuth path and fs_name decode in handle_session() (CVE-2026-89651)
A flaw was found in the Linux kernel's Ceph client. An out-of-bounds read vulnerability exists in the `handle_session()` function when decoding `MDSCapAuth` records. A malicious or compromised Metadata Server (MDS) can trigger this during …
CVE-2026-89648High· 7.0kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() (CVE-2026-89648)
A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph Metadata Server (MDS) could send a specially crafted reply with an unbounded number of delegated inode intervals. This could cause the client to enter an i…
CVE-2026-89647Medium· 5.5⚖ disputedkernel: ceph: do not repeat ceph_trim_dentries() if no progress possible (CVE-2026-89647)
A flaw was found in the Linux kernel's Ceph file system. The `ceph_trim_dentries()` function, when invoked by `ceph_cap_reclaim_work()`, can enter an infinite loop under specific conditions where no leases need to be reclaimed. This busy l…
CVE-2026-89646Medium· 5.5⚖ disputedkernel: ceph: fix leaked inode reference on writeback abort at umount (CVE-2026-89646)
A flaw was found in the Ceph filesystem component of the Linux kernel. When a writeback operation is aborted during an unmount process, a reference to an inode (a data structure describing a filesystem object) is not properly released. Thi…
CVE-2026-89641High· 7.0⚖ disputedkernel: cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (CVE-2026-89641)
A flaw was found in the Linux kernel's Common Internet File System (CIFS) module. This vulnerability, a use-after-free, occurs in the `cifs_file_set_size()` function. When a file's size is being modified, a critical system resource (tcon o…
CVE-2026-89639Medium· 5.5⚖ disputedkernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (CVE-2026-89639)
A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. When a file is truncated, the `cifs_do_truncate()` function does not properly invalidate the file system cache (fscache). This oversight can lead to …
CVE-2026-89638High· 7.8kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. When a file with the setuid or setgid bit is written to on certain Common Internet File System (CIFS) mounts (specifically those using 'cifsacl', 'modefromsid' optio…
CVE-2026-89632High· 7.0kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() (CVE-2026-89632)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A malicious server could exploit this vulnerability by sending specially crafted data, leading to an out-of-bounds read. This occurs because the `reparse_buf_ptr()` …
CVE-2026-89771Medium· 5.5⚖ disputedkernel: ring-buffer: Fix subbuf resize race with ring buffer readers (CVE-2026-89771)
A flaw was found in the Linux kernel. A race condition exists in the ring buffer resizing mechanism, where `trace_buffer subbuf_size` can be read without proper locking while it is being simultaneously resized. This could allow a local att…
CVE-2026-89769Medium· 5.5kernel: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (CVE-2026-89769)
A flaw was found in the Linux kernel's NXP PIT (Programmable Interrupt Timer) clocksource driver. When the CPU hotplug setup fails after an interrupt request (IRQ) has been successfully registered, the error handling does not properly free…
CVE-2026-89767Medium· 5.5⚖ disputedkernel: ovl: fix double end_creating() on the casefold-mismatch path (CVE-2026-89767)
A flaw was found in the Linux kernel's overlay file system (overlayfs). An unprivileged local user can trigger a specific error condition during the creation of a new directory. This error causes the system to incorrectly release a lock on…
CVE-2026-89764Medium· 5.5⚖ disputedkernel: rust: devres: fix race between concurrent revokers (CVE-2026-89764)
A flaw was found in the Linux kernel's `rust: devres` component. A race condition exists when two processes attempt to revoke a `Devres` resource concurrently. This can lead to a use-after-free vulnerability, where one process might free r…
CVE-2026-89763High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key_type…
CVE-2026-89762Medium· 5.5⚖ disputedkernel: apparmor: fix cred UAF caused by begin_current_label_crit_section() (CVE-2026-89762)
A flaw was found in the Linux kernel's AppArmor security module. The begin_current_label_crit_section() function, used in various Linux Security Module (LSM) hooks, attempts to replace user credentials when a security label becomes stale. …
CVE-2026-89761Medium· 5.5⚖ disputedkernel: apparmor: fix out-of-bounds write when null terminating a label vec (CVE-2026-89761)
A flaw was found in the Linux kernel's AppArmor security module. An out-of-bounds write vulnerability exists when null terminating a label vector due to improper memory allocation. An unprivileged local attacker can exploit this by writing…
CVE-2026-89760High· 7.0⚖ disputedkernel: mm, swap: don't free a hibernation slot that is in the swap cache (CVE-2026-89760)
A flaw was found in the Linux kernel's memory management (mm) and swap subsystem. This vulnerability occurs when the swap_free_hibernation_slot() function incorrectly frees a hibernation slot while a memory page (folio) is still present in…
CVE-2026-89758High· 7.0⚖ disputedkernel: mm/mempolicy: skip non-present PMDs when queueing folios (CVE-2026-89758)
A flaw was found in the Linux kernel's memory management subsystem. When an HMM-based Graphics Processing Unit (GPU) driver migrates a Transparent Huge Page (THP) to device memory, it can leave a device-private Page Middle Directory (PMD) …