enterprise_linux vulnerabilities
CVEs whose affected-version data names the enterprise_linux package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
1113 CVEsRSS
CVE-2026-89603High· 7.8Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-89575Medium· 5.5kernel: dm raid1: reserve space for NUL-terminator in build_constructor_string() (CVE-2026-89575)
A flaw was found in the Linux kernel's device mapper (dm-raid1) component. This vulnerability occurs in the `build_constructor_string()` function, where insufficient space is reserved for a NUL-terminator when formatting a string with `spr…
CVE-2026-89684Medium· 5.3kernel: nfsd: fix cpntf publish race in nfs4_init_cp_state (CVE-2026-89684)
A flaw was found in the Linux kernel's nfsd component. A remote attacker, by sending a specially crafted OFFLOAD_CANCEL request, could exploit a race condition during the initialization of copy state notifications. This could lead to a den…
CVE-2026-89741Medium· 4.7kernel: Revert "media: v4l2-dev: fix error handling in __video_register_device()" (CVE-2026-89741)
A flaw was found in the Linux kernel's media subsystem, specifically within the v4l2-dev component. This vulnerability arises from incorrect error handling in the `__video_register_device()` function. If a device registration fails, the sy…
CVE-2026-89706Medium· 5.5kernel: nfsd: Reset write verifier when async COPY writeback fails (CVE-2026-89706)
A flaw was found in the Linux kernel's nfsd component. When an asynchronous (async) copy writeback operation fails, the server's write verifier is not properly reset. This can lead to a client incorrectly assuming that data has been made d…
CVE-2026-89527Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svc_xprt_put to free listener on create failure svc_rdma_create() calls kfree(cma_xprt) when svc_rdma_create_listen_id() fails
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svc_xprt_put to free listener on create failure svc_rdma_create() calls kfree(cma_xprt) when svc_rdma_create_listen_id() fails. svc_xprt_init() has alread…
CVE-2026-89737Medium· 5.1kernel: usb: typec: thunderbolt: Disable work before freeing tbt on remove (CVE-2026-89737)
A flaw was found in the Linux kernel's USB Type-C Thunderbolt driver. The `tbt_altmode_remove()` function fails to properly disable and drain work items before freeing associated plug and cable references. This oversight can lead to a use-…
CVE-2026-89727Medium· 5.5kernel: KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID (CVE-2026-89727)
A flaw was found in the Kernel-based Virtual Machine (KVM) for ARM64 (arm64) architecture. A malicious guest operating system can provide an interrupt ID (INTID) that is outside the expected range to the GICv2 (Generic Interrupt Controller…
CVE-2026-78807High· 7.1An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c
An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c
CVE-2026-89092Medium· 4.2glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)
A flaw was found in glibc, specifically within the nscd service. A remote attacker, operating a malicious Domain Name System (DNS) server, could send an overly large DNS response. This could trigger a stack overflow in the nscd service, ca…
CVE-2026-87859Medium· 5.3morgan is an HTTP request logger middleware for Node.js
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan …
CVE-2026-89046High· 8.2PoCzstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read (CVE-2026-89046)
A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing…
CVE-2026-80914High· 7.0kernel: Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (CVE-2026-80914)
A flaw was found in the Bluetooth ISO subsystem of the Linux kernel. A use-after-free vulnerability can occur in the `iso_conn_ready()` function if a listener socket is closed concurrently while a child socket is being created. This can le…
CVE-2026-87795High· 8.2PoCcom.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service (CVE-2026-87795)
A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the `ZstdDictCompress` constructor. An attacker can exploit this by providing untrusted values, leading to an out…
CVE-2026-80805Medium· 4.4kernel: xfs: validate attr entry pointer before field access (CVE-2026-80805)
A flaw was found in the Linux kernel's XFS filesystem. The xfs_attr3_leaf_verify_entry() function fails to validate an attribute entry pointer before accessing its fields. A local attacker could exploit this by crafting a malicious attribu…
CVE-2026-80791Medium· 4.3kernel: nvmet-auth: zero the AUTH_RECEIVE response buffer (CVE-2026-80791)
A flaw was found in the Linux kernel's nvmet-auth subsystem. During the pre-authentication handshake, a remote attacker can exploit an issue where the system allocates a response buffer but only partially initializes it. The uninitialized …
CVE-2026-80782Medium· 4.1kernel: HID: magicmouse: do not keep a stale msc->input if no input is claimed (CVE-2026-80782)
A flaw was found in the Magic Mouse Human Interface Device (HID) driver within the Linux kernel. When the `hidinput_connect()` function fails to register an input device, the driver may continue to use a pointer to memory that has already …
CVE-2026-80779Medium· 4.4kernel: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (CVE-2026-80779)
A flaw was found in the `net/ionic` component of the Linux kernel. This out-of-bounds write vulnerability occurs because the dedicated hardware timestamp RX queue's index can be used to access memory beyond the bounds of the normal transmi…
CVE-2026-80775High· 7.0PoCkernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
A flaw was found in the Linux kernel. A race condition exists in the `futex_hash_allocate()` function, specifically during the initial allocation of `mm->futex.phash.ref`. This vulnerability can be triggered in scenarios involving nested `…
CVE-2026-80777Medium· 4.7kernel: futex/pi: Plug private futex exec() race (CVE-2026-80777)
A flaw was found in the Linux kernel. A race condition exists in the futex/pi component during the `exec()` system call. This vulnerability occurs because the memory management (mm) check is incorrect when a task's memory is being swapped …
CVE-2026-80766Medium· 4.2kernel: HID: uclogic: fix use-after-free of inrange_timer on remove (CVE-2026-80766)
A flaw was found in the Linux kernel's Human Interface Device (HID) uclogic driver. During the removal of a uclogic device, a timing issue allows the `inrange_timer` to be re-armed after it has been cancelled. This can lead to the timer at…
CVE-2026-80767Medium· 4.7kernel: HID: sensor: custom: Fix use-after-free in enable_sensor (CVE-2026-80767)
A flaw was found in the Linux kernel's Human Interface Device (HID) sensor custom driver. A use-after-free vulnerability exists where the `enable_sensor` sysfs attribute can be accessed either before its associated memory is properly initi…
CVE-2026-80765Medium· 4.4kernel: HID: hyperv: validate initial device info bounds (CVE-2026-80765)
A flaw was found in the Linux kernel's Hyper-V synthetic Human Interface Device (HID) host. A malicious Hyper-V host or backend can send a specially crafted initial device information message to a guest system. This message, containing an …
CVE-2026-80764Medium· 4.7kernel: Bluetooth: hci_event: fix LE list UAF on reset (CVE-2026-80764)
A flaw was found in the Linux kernel's Bluetooth subsystem. A local user could exploit a use-after-free vulnerability in the `hci_event` component. This occurs when the `hci_cc_reset()` function clears Bluetooth Low Energy (LE) lists witho…
CVE-2026-80762Medium· 4.7kernel: Bluetooth: hci_sync: Fix accept list UAF during suspend (CVE-2026-80762)
A flaw was found in the Bluetooth subsystem of the Linux kernel. During the system suspend process, a timing issue can occur where the `hci_update_event_filter_sync()` function attempts to access memory that has already been released. This…
CVE-2026-80758Medium· 4.7kernel: futex: Avoid private hash use-after-free on final put (CVE-2026-80758)
A flaw was found in the Linux kernel's futex subsystem. A race condition in the `futex_private_hash_put()` function allows a local attacker to trigger a use-after-free vulnerability. This occurs when a reference to a private hash is droppe…
CVE-2026-80760Low· 2.3kernel: Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (CVE-2026-80760)
A flaw was found in the Linux kernel's Bluetooth Management (MGMT) component. The `mgmt_hci_cmd_sync()` function incorrectly handles the `params_len` field, allowing a value greater than 255 to be processed. This mismatch between the decla…
CVE-2026-80792High· 7.0kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the `ip6_finish_output2()` function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. …
CVE-2026-80790Medium· 4.1kernel: nvmet-fc: fix invalid free in LS IOD error path (CVE-2026-80790)
A flaw was found in the Linux kernel's nvmet-fc component. This vulnerability occurs during the initialization of the LS IOD array, where an error in memory deallocation can lead to an invalid memory free operation. A local attacker could …
CVE-2026-80806Medium· 4.7kernel: ext4: don't enable DAX on new encrypted files (CVE-2026-80806)
A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability allows data written to newly created encrypted files to bypass encryption when the filesystem is mounted with the 'dax=always' option. This occurs due to an incorre…