Complete feed
No mitigation yet
No fix, workaround or mitigation extracted yet
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-64456] clamp device-reported used.len at copy_data
In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi->data_idx (advanced by previous copy_data() calls) and issues a memcpy() without re-validating either value against the posted buffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32 or 64). A malicious or buggy virtio-rng backend can set used.len beyond sizeof(vi->data), steering the memcpy() past the end of the inline array into adjacent kmalloc-1k slab bytes. hwrng_fillfn() mixes those bytes into the guest RNG, and guest root can also observe them directly via /dev/hwrng. Concrete impact is inside the guest: - Memory-safety / hardening: any virtio-rng backend that over-reports used.len causes the driver to read past vi->data into unrelated slab contents. hwrng_fillfn() is a kernel thread that runs as soon as the device is probed; no guest userspace interaction is required to first-trigger the OOB. - Cross-boundary leak (confidential-compute threat model): a malicious hypervisor cooperating with a malicious or compromised guest root userspace can use /dev/hwrng as a leak channel for guest-kernel heap data.
High [CVE-2026-64342] fix use-after-free on disconnect
In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect Submitted write URBs are not stopped on close() and therefore need to be stopped unconditionally on disconnect() to avoid use-after-free in the completion handler. This vulnerability, a use-after-free, occurs because write operations are not properly halted when a device disconnects. An attacker could potentially exploit this to cause system instability or execute arbitrary code. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat lists Red Hat Hardened Images as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-64377] Fix possible double free
In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an array of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to one element of this array in policy->driver_data. qcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy->driver_data. This is not valid because the memory is devm-managed. For the first domain, this can free the devm-managed allocation while the devres entry is still active, leading to a possible double free when the platform device is later detached. For other domains, the pointer may refer to an element inside the array rather than the allocation base. Remove the kfree(data) call and let devres release qcom_cpufreq.data. This issue was found by a static analysis tool I am developing. This vulnerability, a double free, occurs due to incorrect memory handling when a device is detached. Specifically, the system attempts to release memory that is already managed, leading to a potential double free. This can result in system instability, memory corruption, or a denial of service (DoS), making the system unavailable to legitimate users. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-763. Affected Red Hat products: Red Hat Enterprise Linux 10.
High [CVE-2026-64515] fix MLE defragmentation
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element (MLE) is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original elements. This is incorrect for two reasons: - if the original defragmentation was needed, it will not find the correct data - if the original frame is at a higher address, the parsing will potentially overrun the heap data (though given the layout of the buffers, only into the new defragmentation buffer, and then it has to stop and fail once that's filled with copied data. Fix it by tracking the container along with the pointer and in doing so also unify the two almost identical defragmentation routines. This can lead to a heap data overrun, which is a form of memory corruption that may result in system instability or unexpected behavior. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-823. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-64378] fix race between cgroup_writeback_umount and inode_switch_wbs
In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() When a container exits, the following BUG_ON() is occasionally triggered: ================================================================== VFS: Busy inodes after unmount of sdb (ext4) ------------[ cut here ]------------ kernel BUG at fs/super.c:695! CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1 pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc: generic_shutdown_super+0xf0/0x100 lr: generic_shutdown_super+0xf0/0x100 Call trace: generic_shutdown_super+0xf0/0x100 kill_block_super+0x20/0x48 ext4_kill_sb+0x28/0x60 deactivate_locked_super+0x54/0x130 deactivate_super+0x84/0xa0 cleanup_mnt+0xa4/0x140 __cleanup_mnt+0x18/0x28 task_work_run+0x78/0xe0 do_notify_resume+0x204/0x240 ================================================================== The root cause is a race between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb(). There is a window between inode_prepare_wbs_switch() returning true and the subsequent wb_queue_isw() call. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
High [CVE-2026-64321] fix ndev refcount leak on queue connect
In the Linux kernel, the following vulnerability has been resolved: nvme: target: rdma: fix ndev refcount leak on queue connect nvmet_rdma_queue_connect() calls nvmet_rdma_find_get_device() which acquires a reference on the returned ndev via kref_get(). On the path where the host queue backlog is exceeded and the function returns NVME_SC_CONNECT_CTRL_BUSY, reference of ndev is not released, leaking the kref. Fix this by adding a goto to the existing put_device label before the early return. This oversight can lead to a resource exhaustion vulnerability, potentially allowing a remote attacker to cause a Denial of Service (DoS) by depleting system resources. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-911. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-64355] Reject fragmented frames in devmap
Reject fragmented frames in devmap. Red Hat rates this moderate (CVSS 7). Weakness: CWE-125.
High [CVE-2026-64448] restrict implied bcc[0] exemption to responses without data area
restrict implied bcc[0] exemption to responses without data area. Red Hat rates this moderate (CVSS 7).
High [CVE-2026-64385] Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation
Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation. Red Hat rates this important (CVSS 7). Weakness: CWE-1341.
High [CVE-2026-64396] Use-after-free vulnerability allows arbitrary code execution or denial of service
Use-after-free vulnerability allows arbitrary code execution or denial of service. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825.
High [CVE-2026-64481] Fix firmware load work teardown
Fix firmware load work teardown. Red Hat rates this moderate (CVSS 7). Weakness: CWE-825.
High [CVE-2026-64265] clear intr_entry in fuse_resend and fuse_remove_pending_req
clear intr_entry in fuse_resend and fuse_remove_pending_req. Red Hat rates this important (CVSS 7). Weakness: CWE-825.
High [CVE-2026-64382] fix double-free in SMB2_open replay
fix double-free in SMB2_open() replay. Red Hat rates this important (CVSS 7). Weakness: CWE-1341.
High [CVE-2026-64387] fix query directory replay double-free
fix query directory replay double-free. Red Hat rates this important (CVSS 7). Weakness: CWE-1341.
High [CVE-2026-64372] fix use-after-free and double free in _OSC evaluation
fix use-after-free and double free in _OSC evaluation. Red Hat rates this moderate (CVSS 7). Weakness: CWE-763.
High [CVE-2026-64280] validate DMA mapping length in afu_dma_map_region
validate DMA mapping length in afu_dma_map_region(). Red Hat rates this moderate (CVSS 7). Weakness: CWE-190.
High [CVE-2026-64298] include MAY_WRITE in open permission mask for O_TRUNC
include MAY_WRITE in open permission mask for O_TRUNC. Red Hat rates this moderate (CVSS 7). Weakness: CWE-358.
High [CVE-2026-64402] Fix OOB write in smb_sync_perf_buffer
Fix OOB write in smb_sync_perf_buffer(). Red Hat rates this moderate (CVSS 7). Weakness: CWE-787.
High [CVE-2026-64364] fix out-of-bounds bit access on mt_io_flags
fix out-of-bounds bit access on mt_io_flags. Red Hat rates this important (CVSS 7). Weakness: CWE-476.
High [CVE-2026-64303] terminate the RX channel on TX prepare failure path
terminate the RX channel on TX prepare failure path. Red Hat rates this important (CVSS 7). Weakness: CWE-825.