Tagged “red-hat”
CVEs tagged red-hat, newest first.
7401 CVEsRSS
CVE-2026-89607High· 7.8ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet parse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body without bounding it against …
CVE-2026-89606High· 7.8ecryptfs: reject too-small tag 70 packets
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfs_parse_tag_70_packet() subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filen…
CVE-2026-89605High· 7.8⚖ disputedecryptfs: release message context on send failure
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: release message context on send failure ecryptfs_send_message_locked() moves a message context from the free list to the allocated list before sending the re…
CVE-2026-89604Medium· 5.5efivarfs: Rate limit statfs() handler
In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs() handler Ravi reports that statfs() may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls …
CVE-2026-89603High· 7.8Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-89599High· 8.4⚖ disputedfbdev: omapfb: panel-dsi-cm: initialize lock before registering display
In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm_probe() registers the display before initializing ddata->lock. Once omapdss_register_disp…
CVE-2026-89598Medium· 5.5fbdev: ssd1307fb: defer I2C transfers from damage callbacks
In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update …
CVE-2026-89597High· 7.8⚖ disputedfbdev: uvesafb: unregister connector callback on init failure
In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: unregister connector callback on init failure uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_…
CVE-2026-89596High· 7.1forcedeth: fix off-by-one when saving/restoring non-PCI config space
In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nv_suspend() and nv_resume() walk the non-PCI configuration space with for (i = 0; i <= np->regi…
CVE-2026-89595Medium· 5.5fsnotify: Fix stale object mask after concurrent mark updates
In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new event bit, fanotify and inotify may avoid recalculating the object mask if the cac…
CVE-2026-89594High· 7.8⚖ disputedhsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
In the Linux kernel, the following vulnerability has been resolved: hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device The OMAP SSI driver uses a synthetic HSI controller device allocated via hsi_alloc_controller(…
CVE-2026-89593High· 7.1hugetlb: only adjust reservation during unmapping if mapcount is 0
In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, __unmap_hugepage_range can adjust reservations. In the case of folio mapped in …
CVE-2026-89587High· 7.8ACPI: pfr_update: fix stack buffer overflow in query_capability()
In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: fix stack buffer overflow in query_capability() query_capability() copies four ACPI buffer objects returned by the firmware _DSM into fixed-size u8[1…
CVE-2026-89586High· 8.2⚖ disputedata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the UNMAP bit set into an A…
CVE-2026-89585High· 7.8⚖ disputedauxdisplay: charlcd: cancel backlight work on registration failure
In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before charlcd_register() calls misc_…
CVE-2026-89583High· 8.1Bluetooth: eir: Fix OOB read in eir_get_service_data()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eir_get_service_data() eir_get_service_data() walks the advertising data for a Service Data field with a matching UUID. On a mismatch …
CVE-2026-89582High· 7.0bnx2x: fix double free in bnx2x_init_firmware() error path
In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2x_init_firmware() error path bnx2x_init_firmware() frees bp->init_ops, bp->init_data and bp->init_ops_offsets in its error path without s…
CVE-2026-89579High· 7.8bpf: Harden bloom filter sizing and indexing on 32-bit kernels
In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloom_map_alloc() has two 32-bit-specific problems when the computed bitmap reaches the U32_MAX fallback…
CVE-2026-89576Medium· 5.5dm-era: fix shadowed superblock leak on take-snap failure
In the Linux kernel, the following vulnerability has been resolved: dm-era: fix shadowed superblock leak on take-snap failure metadata_take_snap() bumps the live superblock refcount and then dm_tm_shadow_block() allocates a new block f…
CVE-2026-89575Medium· 5.5kernel: dm raid1: reserve space for NUL-terminator in build_constructor_string() (CVE-2026-89575)
A flaw was found in the Linux kernel's device mapper (dm-raid1) component. This vulnerability occurs in the `build_constructor_string()` function, where insufficient space is reserved for a NUL-terminator when formatting a string with `spr…
CVE-2026-89573High· 7.8⚖ disputeddm array: reject an array block whose value size is not the caller's
In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and m…
CVE-2026-89569High· 8.8Bluetooth: RFCOMM: serialize security confirmation handling
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcomm_security_cfm() looks up a session on session_list and then walks its DLC list without holding rfcomm…
CVE-2026-89565Medium· 5.5ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collect_md mode when metadata_dst allocation fails In collect_md mode ipip_tunnel_rcv() returns 0 without freeing the skb when ip_tun_rx_dst() fa…
CVE-2026-89563High· 7.8ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() ip6_tnl_xmit() may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently …
CVE-2026-89559High· 7.8libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in __nd_label_validate() The on-media namespace index field nslot is a u32 read from the DIMM label storage area. __nd_labe…
CVE-2026-89554High· 8.2⚖ disputedmptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce, backup, join_id, token a…
CVE-2026-89553High· 7.8⚖ disputednouveau/gem: reserve the bo in the info ioctl around the vma lookup
In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem cl…
CVE-2026-89684Medium· 5.3kernel: nfsd: fix cpntf publish race in nfs4_init_cp_state (CVE-2026-89684)
A flaw was found in the Linux kernel's nfsd component. A remote attacker, by sending a specially crafted OFFLOAD_CANCEL request, could exploit a race condition during the initialization of copy state notifications. This could lead to a den…
CVE-2026-89674Critical· 9.8⚖ disputednfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has multiple errors that can result in eit…
CVE-2026-89673Medium· 5.5nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation as 16 + netid_len + addr_len, but th…