Tagged “red-hat”
CVEs tagged red-hat, newest first.
2912 CVEsRSS
CVE-2026-89729High· 7.0kernel: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (CVE-2026-89729)
A flaw was found in the Linux kernel's Human Interface Device (HID) sensor-hub driver. A local attacker could exploit this vulnerability by providing a specially crafted HID descriptor. This malicious descriptor could cause the `sensor_hub…
CVE-2026-89726Medium· 5.5kernel: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (CVE-2026-89726)
A flaw was found in the Linux kernel's `ucs2_strnlen()` function. This vulnerability occurs because the function checks the current character before verifying if the maximum allowed length has been reached. If the input string is not prope…
CVE-2026-89725Medium· 5.5⚖ disputedkernel: media: cec: stm32: prevent out-of-bounds write on RX overflow (CVE-2026-89725)
A flaw was found in the Linux kernel's `media: cec: stm32` driver. A remote attacker can exploit an out-of-bounds write vulnerability by sending an overlong Consumer Electronics Control (CEC) message without an end-of-message signal. This …
CVE-2026-89724Medium· 5.5⚖ disputedkernel: media: vicodec: fix out-of-bounds write in FWHT encoder (CVE-2026-89724)
A flaw was found in the Linux kernel's `media: vicodec` component. An out-of-bounds write vulnerability exists in the FWHT encoder due to incorrect buffer sizing during video output format handling. This issue allows an attacker to cause c…
CVE-2026-89723Medium· 5.5⚖ disputedkernel: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation (CVE-2026-89723)
A flaw was found in the nilfs2 file system component of the Linux kernel. When a file is truncated, an intermediate node block is not properly deleted and remains in the B-tree node cache. This can lead to the log writer incorrectly proces…
CVE-2026-89720Medium· 5.5⚖ disputedkernel: ubifs: fix out-of-bounds read in signature length check (CVE-2026-89720)
A flaw was found in the Linux kernel's Unsorted Block Image File System (UBIFS). An incorrect bounds check in the ubifs_sb_verify_signature() function allows a crafted signed UBIFS image to declare a signature length larger than its actual…
CVE-2026-89712High· 7.0⚖ disputedkernel: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (CVE-2026-89712)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD) component. A race condition exists where, during the processing of unmounted source-server mounts, a thread may temporarily release a lock. During this window, anothe…
CVE-2026-89710High· 7.0kernel: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (CVE-2026-89710)
A flaw was found in the Linux kernel's NFSv4.1 implementation. When a server returns a new layout state identifier while an existing one is still active, the pnfs_layout_process() function fails to properly release memory associated with l…
CVE-2026-89707High· 7.0kernel: nfsd: release path refs on follow_down() error (CVE-2026-89707)
A flaw was found in the Linux kernel's nfsd component. An authenticated Network File System (NFS) client can exploit this vulnerability by triggering a failed cross-mount operation through `nfsd_lookup_dentry` or the NFSv4 READDIR encode p…
CVE-2026-89706High· 7.0kernel: nfsd: Reset write verifier when async COPY writeback fails (CVE-2026-89706)
A flaw was found in the Linux kernel's nfsd component. When an asynchronous (async) copy writeback operation fails, the server's write verifier is not properly reset. This can lead to a client incorrectly assuming that data has been made d…
CVE-2026-89704High· 7.0kernel: nfsd: sample writeback error cursor before async COPY loop (CVE-2026-89704)
A flaw was found in the Linux kernel's nfsd component. The _nfsd_copy_file_range() function incorrectly samples the writeback error cursor after the copy loop. This allows a concurrent write operation to advance the error cursor prematurel…
CVE-2026-89699Medium· 5.5⚖ disputedkernel: nfsd: validate symlink target length in NFSv4 CREATE (CVE-2026-89699)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd) when handling NFSv4 CREATE operations. A remote attacker can exploit this by sending a crafted request with an oversized symbolic link (symlink) target length. This u…
CVE-2026-89697High· 7.0⚖ disputedkernel: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (CVE-2026-89697)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When setting file attributes using `nfsd_proc_setattr()`, a specific code path (`BOTH_TIME_SET` branch) prematurely verifies file handles. This bypasses a critical w…
CVE-2026-89696Medium· 5.5⚖ disputedkernel: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (CVE-2026-89696)
A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd). A remote client can exploit this by sending a specially crafted NFS COMPOUND request. This request, when processed, can lead to a NULL pointer dereference in t…
CVE-2026-89694High· 7.0kernel: nfsd: check client ownership when cancelling a copy-notify stateid (CVE-2026-89694)
A flaw was found in the Linux kernel's NFSv4.2 server (nfsd). An authenticated NFSv4.2 client could exploit a vulnerability in the `manage_cpntf_state()` function by guessing a state identifier. This improper ownership check allows the cli…
CVE-2026-89765Medium· 5.5kernel: timers/itimer: Zero-init old itimerval before copy to userspace (CVE-2026-89765)
A flaw was found in the Linux kernel's `timers/itimer` component. On native sparc64 systems, the `struct __kernel_old_timeval` contains uninitialized padding bytes. When `put_itimerval()` copies this structure to userspace, these padding b…
CVE-2026-89756Medium· 5.5kernel: mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() (CVE-2026-89756)
A flaw was found in the Linux kernel. When performing memory migration on KVM (Kernel-based Virtual Machine) hosts, the `migrate_pages_batch()` function fails to report RCU (Read-Copy Update) tasks quiescent states during large batch unmap…
CVE-2026-89753Medium· 5.5kernel: mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() (CVE-2026-89753)
A flaw was found in the Linux kernel's memory management subsystem. The `shrink_lruvec()` function, responsible for memory reclaim, fails to properly report Read-Copy-Update (RCU) task quiescent states on systems with preemption enabled. T…
CVE-2026-89752Medium· 5.5kernel: mm: memcg: stop reclaim when a limit update is superseded (CVE-2026-89752)
A flaw was found in the Linux kernel's memory cgroup (memcg) component. When multiple file operations concurrently update `memory.high` or `memory.max` files in `kernfs`, a writer can continue reclaiming memory towards an outdated target. …
CVE-2026-89751Medium· 5.5kernel: x86/tdx: Fix off-by-one in port I/O handling (CVE-2026-89751)
A flaw was found in the Linux kernel's x86/tdx component. An off-by-one error in the `handle_in()` and `handle_out()` functions, specifically in the `GENMASK` calculation for port I/O operations, causes the mask to be one bit too wide. Thi…
CVE-2026-89750Medium· 5.5⚖ disputedkernel: tracing/user_events: Clear copied tracing state before fork duplication (CVE-2026-89750)
A flaw was found in the Linux kernel's tracing/user_events component. This vulnerability arises when a child process, created via `fork`, exits and frees memory that the parent process still references. This creates a Use-After-Free (UAF) …
CVE-2026-89749Medium· 5.5kernel: tracing: Fix crash passing ERR_PTR to kthread_stop() (CVE-2026-89749)
A flaw was found in the Linux kernel. Specifically, within the tracing subsystem, the `event_test_stuff()` function can pass an invalid error pointer to `kthread_stop()` if `kthread_run()` fails to create a kernel thread. This improper han…
CVE-2026-81010High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: honor task_work cancellation io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originati…
In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: honor task_work cancellation io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originati…
CVE-2026-80964Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe
In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's O…
CVE-2026-89566Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP
In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. Th…
CVE-2026-89506Medium· 4.7In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR The original commit missed that three drivers (mthca, irdma, siw) have UHW data associated with reg_mr that ca…
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR The original commit missed that three drivers (mthca, irdma, siw) have UHW data associated with reg_mr that ca…
CVE-2026-89715Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfs_uuid_add_file failure When nfs_uuid_add_file() races with nfs_uuid_put() tearing down uuid->net, it returns -ENXIO without publishing …
In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfs_uuid_add_file failure When nfs_uuid_add_file() races with nfs_uuid_put() tearing down uuid->net, it returns -ENXIO without publishing …
CVE-2026-89447Medium· 4.4In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufd_access_notify_unmap() skips internal accesses because they do not have an external unmap callback to invo…
In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufd_access_notify_unmap() skips internal accesses because they do not have an external unmap callback to invo…
CVE-2026-89518Medium· 5.5kernel: sched_ext: Fix this_rq() assumptions in dispatch kfuncs (CVE-2026-89518)
A flaw was found in the Linux kernel's `sched_ext` component. Under core scheduling, incorrect assumptions in dispatch kfuncs regarding `this_rq()` can lead to a deadlock. This occurs when an `rq` lock is acquired on a CPU different from t…
CVE-2026-89517Medium· 5.5kernel: sched_ext: Fix rq->core_pick corruption under core scheduling (CVE-2026-89517)
A flaw was found in the Linux kernel's `sched_ext` component, which handles core scheduling. When multiple selections on the same core interleave due to a dropped lock, they can corrupt the scheduling state. This corruption can lead to a N…