Tagged “red-hat”
CVEs tagged red-hat, newest first.
7401 CVEsRSS
CVE-2026-86142Medium· 6.9In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
CVE-2026-86141Low· 2.9xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
CVE-2026-86140High· 8.0In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
CVE-2026-86139Medium· 6.9In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
CVE-2026-86138Medium· 6.9In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
CVE-2026-86137Low· 2.9In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
CVE-2026-80905Medium· 5.5net: tap: fix wrong transport_header when sending VLAN-tagged frame
In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport_header when sending VLAN-tagged frame In tap_get_user_xdp(), when processing a VLAN-tagged frame (e.g. ETH_P_8021Q), skb_set_network_head…
CVE-2026-80805Medium· 4.4xfs: validate attr entry pointer before field access
In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen, valuelen) before checking if the entry point…
CVE-2026-80791Medium· 4.3kernel: nvmet-auth: zero the AUTH_RECEIVE response buffer (CVE-2026-80791)
A flaw was found in the Linux kernel's nvmet-auth subsystem. During the pre-authentication handshake, a remote attacker can exploit an issue where the system allocates a response buffer but only partially initializes it. The uninitialized …
CVE-2026-80782Medium· 4.1kernel: HID: magicmouse: do not keep a stale msc->input if no input is claimed (CVE-2026-80782)
A flaw was found in the Magic Mouse Human Interface Device (HID) driver within the Linux kernel. When the `hidinput_connect()` function fails to register an input device, the driver may continue to use a pointer to memory that has already …
CVE-2026-80779Medium· 4.4kernel: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (CVE-2026-80779)
A flaw was found in the `net/ionic` component of the Linux kernel. This out-of-bounds write vulnerability occurs because the dedicated hardware timestamp RX queue's index can be used to access memory beyond the bounds of the normal transmi…
CVE-2026-80775High· 7.0PoCkernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
A flaw was found in the Linux kernel. A race condition exists in the `futex_hash_allocate()` function, specifically during the initial allocation of `mm->futex.phash.ref`. This vulnerability can be triggered in scenarios involving nested `…
CVE-2026-80777Medium· 4.7kernel: futex/pi: Plug private futex exec() race (CVE-2026-80777)
A flaw was found in the Linux kernel. A race condition exists in the futex/pi component during the `exec()` system call. This vulnerability occurs because the memory management (mm) check is incorrect when a task's memory is being swapped …
CVE-2026-80766Medium· 4.2kernel: HID: uclogic: fix use-after-free of inrange_timer on remove (CVE-2026-80766)
A flaw was found in the Linux kernel's Human Interface Device (HID) uclogic driver. During the removal of a uclogic device, a timing issue allows the `inrange_timer` to be re-armed after it has been cancelled. This can lead to the timer at…
CVE-2026-80767Medium· 4.7kernel: HID: sensor: custom: Fix use-after-free in enable_sensor (CVE-2026-80767)
A flaw was found in the Linux kernel's Human Interface Device (HID) sensor custom driver. A use-after-free vulnerability exists where the `enable_sensor` sysfs attribute can be accessed either before its associated memory is properly initi…
CVE-2026-80765Medium· 4.4HID: hyperv: validate initial device info bounds
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed …
CVE-2026-80764Medium· 4.7kernel: Bluetooth: hci_event: fix LE list UAF on reset (CVE-2026-80764)
A flaw was found in the Linux kernel's Bluetooth subsystem. A local user could exploit a use-after-free vulnerability in the `hci_event` component. This occurs when the `hci_cc_reset()` function clears Bluetooth Low Energy (LE) lists witho…
CVE-2026-80762Medium· 4.7kernel: Bluetooth: hci_sync: Fix accept list UAF during suspend (CVE-2026-80762)
A flaw was found in the Bluetooth subsystem of the Linux kernel. During the system suspend process, a timing issue can occur where the `hci_update_event_filter_sync()` function attempts to access memory that has already been released. This…
CVE-2026-80758Medium· 4.7kernel: futex: Avoid private hash use-after-free on final put (CVE-2026-80758)
A flaw was found in the Linux kernel's futex subsystem. A race condition in the `futex_private_hash_put()` function allows a local attacker to trigger a use-after-free vulnerability. This occurs when a reference to a private hash is droppe…
CVE-2026-80760Low· 2.3kernel: Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (CVE-2026-80760)
A flaw was found in the Linux kernel's Bluetooth Management (MGMT) component. The `mgmt_hci_cmd_sync()` function incorrectly handles the `params_len` field, allowing a value greater than 255 to be processed. This mismatch between the decla…
CVE-2026-80792High· 7.0ipv6: fix use-after-free in ip6_finish_output2()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LW…
CVE-2026-80790Medium· 4.1kernel: nvmet-fc: fix invalid free in LS IOD error path (CVE-2026-80790)
A flaw was found in the Linux kernel's nvmet-fc component. This vulnerability occurs during the initialization of the LS IOD array, where an error in memory deallocation can lead to an invalid memory free operation. A local attacker could …
CVE-2026-80806Medium· 4.7kernel: ext4: don't enable DAX on new encrypted files (CVE-2026-80806)
A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability allows data written to newly created encrypted files to bypass encryption when the filesystem is mounted with the 'dax=always' option. This occurs due to an incorre…
CVE-2026-80813Medium· 5.7kernel: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() (CVE-2026-80813)
A flaw was found in the Linux kernel's nvmet subsystem. A remote attacker can trigger a NULL pointer dereference in the nvmet_execute_identify_nslist() function by issuing a specific Identify command (CNS 07h). This vulnerability can lead …
CVE-2026-80824High· 7.0kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
A flaw was found in the Linux kernel's USB subsystem (usbfs). An unprivileged local attacker with read/write access to a /dev/bus/usb node could exploit a use-after-free vulnerability. This occurs because the usb_device structure is premat…
CVE-2026-80816Medium· 4.6kernel: ALSA: FCP: Use a private URB for the notification endpoint (CVE-2026-80816)
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) FireWire Control Protocol (FCP) driver. Incorrect handling of the Universal Serial Bus Request Block (URB) for the notification endpoint could lead to a system…
CVE-2026-80819Medium· 6.5kernel: Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (CVE-2026-80819)
A flaw was found in the Bluetooth RFCOMM (Radio Frequency Communication) subsystem of the Linux kernel. A remote attacker can send a specially crafted Bluetooth Disconnect (DISC) message to a device with a deferred RFCOMM channel. This can…
CVE-2026-80818Medium· 4.4kernel: iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown (CVE-2026-80818)
A flaw was found in the Linux kernel's iommu/tegra241-cmdqv driver. This vulnerability, a use-after-free, occurs when the system attempts to deinitialize a virtual interface during device teardown, accessing memory that has already been re…
CVE-2026-80829Medium· 4.6kernel: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (CVE-2026-80829)
A flaw was found in the Linux kernel's ALSA USB audio driver. A local attacker with a specially crafted USB device could exploit this vulnerability. By providing a malformed `wMaxPacketSize` value, the device can trigger an out-of-bounds w…
CVE-2026-80830Medium· 5.1kernel: usb: core: Add lock to usb_wakeup_notification() (CVE-2026-80830)
A flaw was found in the Linux kernel's USB subsystem. A race condition in the `usb_wakeup_notification()` function could allow a local attacker or a malicious USB device to trigger a use-after-free vulnerability. This could lead to system …