Complete feed
No mitigation yet
No fix, workaround or mitigation extracted yet
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Advisory [CVE-2026-64504] clamp the device-reported FIFO frame count
clamp the device-reported FIFO frame count. Red Hat rates this a security issue. Weakness: CWE-787.
Advisory [CVE-2026-64389] validate NTLMv2 response before updating session key
validate NTLMv2 response before updating session key. Red Hat rates this a security issue. Weakness: CWE-179.
Advisory [CVE-2026-64390] track the connection owning a byte-range lock
track the connection owning a byte-range lock. Red Hat rates this a security issue.
Advisory [CVE-2026-64501] fix CS held asserted and state leaks
fix CS held asserted and state leaks. Red Hat rates this a security issue. Weakness: CWE-772.
Advisory [CVE-2026-64444] fix OOB read in OnAssocRsp IE loop
fix OOB read in OnAssocRsp() IE loop. Red Hat rates this a security issue. Weakness: CWE-125.
Advisory [CVE-2026-64498] free scan_mask on buffer release
free scan_mask on buffer release. Red Hat rates this a security issue. Weakness: CWE-772.
Advisory [CVE-2026-64462] Fix resource leaks on probe failure
Fix resource leaks on probe failure. Red Hat rates this a security issue. Weakness: CWE-825.
High [CVE-2026-66040] Arbitrary code execution via crafted PNG image
Arbitrary code execution via crafted PNG image. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787.
High [CVE-2026-66039] Arbitrary code execution via crafted CAF file
Arbitrary code execution via crafted CAF file. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787.
High [CVE-2026-66036] Arbitrary code execution via crafted video in vf_hqdn3d filter
Arbitrary code execution via crafted video in vf_hqdn3d filter. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787.
High [CVE-2026-64255] validate sta_mask before ffs in BA session handlers
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta[]. Add WARN_ON_ONCE(!ba_data->sta_mask) guards before each ffs() call, consistent with the existing check in iwl_mld_ampdu_rx_start(). A flaw was found in the Linux kernel's iwlwifi (Intel Wireless WiFi) driver. This vulnerability allows an attacker to cause an out-of-bounds memory access in the WiFi Block Acknowledgement (BA) session handlers. This occurs when the `sta_mask` value is zero, leading to an incorrect station ID calculation and potential system instability or denial of service. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-823. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-64218] fix report_work leak on backbone_gw purge
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix report_work leak on backbone_gw purge batadv_bla_purge_backbone_gw() removes stale backbone gateway entries, but fails to properly handle their associated report_work: - If report_work is running, the purge must wait for it to finish before freeing the backbone_gw, otherwise the worker may access freed memory (e.g. bat_priv). - If report_work is pending, the purge must cancel it and release the reference held for that pending work item. The previous implementation called hlist_for_each_entry_safe() inside a spin_lock_bh() section, but cancel_work_sync() may sleep and therefore cannot be called from within a spinlock-protected region. Restructure the loop to handle one entry per spinlock critical section: acquire the lock, find the next entry to purge, remove it from the hash list, then release the lock before calling cancel_work_sync() and dropping the hash_entry reference. Repeat until no more entries require purging. Red Hat severity: Important. Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux for NVIDIA 26; Red Hat OpenShift Container Platform 4. Affected products named by the advisory: Red Hat package: libkrun; Red Hat package: kernel.
High [CVE-2026-64226] Linux kernel (sched_ext): Use-After-Free vulnerability in scx_root_enable_workfn
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error() dereferences p->comm and p->pid. If the iterator's reference is the last drop, the task is freed synchronously and the deref becomes a UAF. Move put_task_struct() past scx_error(). This Use-After-Free (UAF) vulnerability occurs in the `scx_root_enable_workfn()` function. A local attacker could exploit this to potentially achieve arbitrary code execution or privilege escalation. Red Hat severity: Important — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-825. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
High [CVE-2026-64247] Denial of Service due to out-of-bounds read
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP ID is included in a sparse bank set, explicitly check that the ID can actually be contained in a sparse bank (the TLFS allows for a maximum of 64 banks of 64 vCPUs each). When handling a paravirtual TLB flush for L2, the VP ID is copied verbatim from the enlightened VMCS, without any bounds check, i.e. isn't guaranteed to be under the limit of 4096. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
High [CVE-2026-64217] Linux kernel netfs: Memory corruption leading to denial of service and potential privilege escalation
Linux kernel netfs: Memory corruption leading to denial of service and potential privilege escalation. Red Hat rates this important (CVSS 7). Weakness: CWE-787.
High [CVE-2026-64251] Linux kernel: Use-after-free in pwrseq_debugfs_seq_next can lead to denial of service
Linux kernel: Use-after-free in pwrseq_debugfs_seq_next() can lead to denial of service. Red Hat rates this moderate (CVSS 7). Weakness: CWE-911.
High [CVE-2026-64221] Linux kernel: spi: ti-qspi use-after-free allows privilege escalation or denial of service
Linux kernel: spi: ti-qspi use-after-free allows privilege escalation or denial of service. Red Hat rates this important (CVSS 7). Weakness: CWE-825.
High [CVE-2026-64208] crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks
crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks. Red Hat rates this moderate (CVSS 7). Weakness: CWE-120.
High [CVE-2026-64216] netfs Use-After-Free vulnerability allows local denial of service and memory corruption
netfs Use-After-Free vulnerability allows local denial of service and memory corruption. Red Hat rates this moderate (CVSS 7). Weakness: CWE-825.
Medium [CVE-2026-66337] heap buffer over-read via integer underflow in soup_filter_input_stream_read_until
A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory. A malicious HTTP server can trigger this against any libsoup client using SoupMultipartInputStream by sending a crafted multipart response with a boundary string longer than the internal buffer. This issue is related to but distinct from CVE-2026-1761. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: libsoup3.