Complete feed
No mitigation yet
No fix, workaround or mitigation extracted yet
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Medium [CVE-2026-64233] hold opts->lock across XU walks in uvc_function_bind
hold opts->lock across XU walks in uvc_function_bind. Red Hat rates this moderate.
Medium [CVE-2026-64245] fix a possible UAF in fb_find_mode
fix a possible UAF in fb_find_mode(). Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-825.
Advisory [CVE-2026-64230] fix irq_data.rdev not being assigned
In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irq_data.rdev not being assigned Commit 64a6b577490c ("regulator: tps65219: Remove debugging helper function") removed the tps65219_get_rdev_by_name() helper along with the irq_data.rdev assignment that depended on it. This left irq_data.rdev uninitialized for all IRQs, causing undefined behavior when regulator_notifier_call_chain() is called from the IRQ handler: Internal error: Oops: 0000000096000004 pc: regulator_notifier_call_chain lr: tps65219_regulator_irq_handler Call trace: regulator_notifier_call_chain tps65219_regulator_irq_handler handle_nested_irq regmap_irq_thread irq_thread_fn irq_thread kthread ret_from_fork Instead of restoring a dedicated lookup array, restructure the probe function to combine regulator registration with IRQ registration in the same loop. This way the rdev returned by devm_regulator_register() is naturally available for assigning to irq_data.rdev without any auxiliary data structure. Non-regulator IRQs (SENSOR, TIMEOUT) that don't correspond to any registered regulator are registered with rdev=NULL, and the IRQ handler is protected with a NULL check to avoid crashing. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux for NVIDIA 26; Red Hat OpenShift Container Platform 4.
Advisory [CVE-2026-64238] fix deadlock on shared proxy's parent removal
In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on shared proxy's parent removal Commit 710abda58055 ("gpio: shared: call gpio_chip::of_xlate() if set") used the mutex embedded in struct gpio_shared_entry to protect the offset field which now can be modified after assignment. The critical section however is too wide and introduced a potential deadlock on the removal of the shared GPIO proxy's parent. Make the critical section shorter - only protect the offset when it's being read. While at it: mention the fact that the entry lock is now also used to protect against concurrent access to the offset field in the structure's documentation. A too wide critical section, intended to protect the `offset` field in the `struct gpio_shared_entry`, can lead to a potential deadlock. This occurs during the removal of a shared General Purpose Input/Output (GPIO) proxy's parent. A successful exploit of this vulnerability could result in a denial of service (DoS) due to system unresponsiveness. Red Hat severity: not rated. Weakness: CWE-833. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux for NVIDIA 26; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Advisory [CVE-2026-64209] Fix out-of-bounds array access in dp swing config
In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swing_tbl and pre_emphasis_tbl are 4x4 arrays (valid indices 0-3), but the boundary check uses "> 4" instead of ">= 4", allowing index 4 to cause an out-of-bounds access. A flaw was found in the Linux kernel, specifically within the Qualcomm (QCOM) QMP USBC PHY (Physical Layer) driver. An incorrect boundary check during the configuration of DisplayPort (DP) swing settings allows for an out-of-bounds array access. This vulnerability can lead to memory corruption, potentially impacting system stability or allowing for further exploitation. Red Hat severity: not rated. Weakness: CWE-787. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Advisory [CVE-2026-64215] Check kzalloc return in a8xx_hfi_send_perf_table
In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table Check the return value of kzalloc() to prevent a NULL pointer dereference on allocation failure. Patchwork: This vulnerability occurs because the `a8xx_hfi_send_perf_table` function does not properly check the return value of a memory allocation call (`kzalloc`). An attacker could potentially exploit this missing check to trigger a NULL pointer dereference, leading to a system crash and a denial of service. Red Hat severity: not rated. Weakness: CWE-476. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Advisory [CVE-2026-64250] Report dying CPU to RCU in stop_this_cpu
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to RCU in stop_this_cpu() This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying CPU to RCU in stop_this_cpu()"). smp_send_stop() parks all secondary CPUs in stop_this_cpu(). And the function marks the CPU offline for the scheduler via set_cpu_online(false) but never informs RCU, so RCU keeps expecting a quiescent state from CPUs that are now spinning forever with interrupts disabled. As long as nothing waits for an RCU grace period after smp_send_stop() this is harmless, which is why it went unnoticed. However, since commit 91840be8f710370 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT"), irq_work_sync() calls synchronize_rcu() on architectures without an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt() returns false. Any irq_work_sync() issued in the reboot/shutdown/halt path after smp_send_stop() then blocks on a grace period that can never complete, hanging the reboot: WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on... rcu: INFO: rcu_sched detected stalls on CPUs/tasks: rcu: Offline CPU 1 blocking current GP. rcu: Offline CPU 2 blocking current GP. rcu: Offline CPU 3 blocking current GP.
Advisory [CVE-2026-64241] teardown bugs and resource leaks
In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce clock reference leak: The debounce clock (bank->db_clk) is obtained using of_clk_get() which increments the clock's reference count, but clk_put() is never called. Register a devm action to cleanly release it on unbind. Note that of_clk_get(..., 1) remains necessary over devm_clk_get() because the DT binding does not define clock-names, precluding name-based lookup. 2. Unregistered chained IRQ handler: The chained IRQ handler is not disconnected in remove(). If a stray interrupt fires after the driver is removed, the kernel attempts to execute a stale handler, leading to a panic. 3. IRQ domain leak: The linear IRQ domain and its generic chips are allocated manually during probe but never removed. Remove the IRQ domain during driver teardown to free the associated generic chips and mappings. [Bartosz: don't emit an error message on devres allocation failure] Red Hat severity: not rated. Weakness: CWE-772. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Advisory [CVE-2026-64249] fix use-after-free in child_regions_with_firmware
In the Linux kernel, the following vulnerability has been resolved: fpga: region: fix use-after-free in child_regions_with_firmware() Move of_node_put(child_region) after the error print to avoid accessing freed memory when pr_err() references child_region. [ Yilun: Fix the Fixes tag ] Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Advisory [CVE-2026-64252] Prevent initial console buffer from landing in XKPHYS
In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial console buffer from landing in XKPHYS In 64-bit configurations calling the initial console output handler from a kernel thread other than the initial one will result in a situation where the stack has been placed in the XKPHYS 64-bit memory segment and consequently so has been the buffer allocated there that is used as the argument corresponding to the `%s' output conversion specifier for the firmware's printf() entry point. This 64-bit address will then be truncated by 32-bit firmware, resulting in an attempt to access the wrong memory location, which in turn will cause all kinds of unpredictable behaviour, such as a kernel crash: Console: colour dummy device 160x64 Calibrating delay loop...
Advisory [CVE-2026-64211] Don't queue workqueue handlers to never-online CPUs
Don't queue workqueue handlers to never-online CPUs. Red Hat rates this a security issue. Weakness: CWE-821.
Advisory [CVE-2026-64248] report dying CPU to RCU in stop_this_cpu
report dying CPU to RCU in stop_this_cpu(). Red Hat rates this a security issue.
Advisory [CVE-2026-64242] Fix double free in probe error path
Fix double free in probe error path. Red Hat rates this a security issue. Weakness: CWE-1341.
Advisory [CVE-2026-64236] fix division by zero on missing clock-frequency
fix division by zero on missing clock-frequency. Red Hat rates this a security issue. Weakness: CWE-369.
Advisory [CVE-2026-64246] fix use-after-free in the linkstation_poweroff_init
fix use-after-free in the linkstation_poweroff_init(). Red Hat rates this a security issue.
Advisory [CVE-2026-64234] add check for dma_alloc_coherent
add check for dma_alloc_coherent(). Red Hat rates this a security issue. Weakness: CWE-476.
Advisory [CVE-2026-64240] fix control request setup packet
fix control request setup packet. Red Hat rates this a security issue. Weakness: CWE-843.
Critical [CVE-2026-44210] Privilege escalation and information disclosure via command-line argument injection
Privilege escalation and information disclosure via command-line argument injection. Red Hat rates this important (CVSS 9.9). Weakness: CWE-88.
High [CVE-2026-16804] Sandbox escape via crafted HTML page
Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) This can be achieved by enticing a user to visit a specially crafted HTML page. Successful exploitation could allow the attacker to perform a sandbox escape, potentially gaining elevated privileges or further access to the underlying system. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Weakness: CWE-787.
High [CVE-2026-16805] Use after free in Blink
Use after free in Blink. Red Hat rates this important (CVSS 8.8). Weakness: CWE-825.