Complete feed
Security advisories & CVEs
7853 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-80589] stop the timeout timer when releasing a never added disk
In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last request completes. So if the driver issued any I/O before adding the disk, the request_queue is freed while still linked into a timer wheel bucket. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
High [CVE-2026-80528] avoid fs reclaim while using current->journal_info
In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current->journal_info handle_reply() stores a `ceph_mds_request` pointer in `current->journal_info` while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more.
High [CVE-2026-80552] Ensure index for read/write regions are within range
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing read/write regions which should also be enforced. This vulnerability occurs because the system fails to properly validate index ranges for read/write operations on existing regions. This oversight could allow an attacker to perform out-of-bounds memory access, potentially leading to information disclosure or system instability. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-80561] fix multiple unsafe decodes in decode_locker
In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_locker() decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_copy() at the locker_id_t name field has no preceding bounds check. With p == end after ceph_start_decoding() accepts struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past the validated buffer boundary. 2. *p += sizeof(struct ceph_timespec) after the locker_info_t header is an unchecked pointer advance. A malicious OSD can position p past end, causing all subsequent _safe checks to pass against a bogus boundary. 3. len = ceph_decode_32(p) has no preceding bounds check, and the immediately following *p += len is uncapped. A malicious OSD can send len=0xffffffff, advancing p gigabytes past end and escaping the decode window entirely. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more.
Medium [CVE-2026-80158] ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the IPA bind password in logs and process listings
ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the IPA bind password in logs and process listings. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-214. Affected products named by the advisory: Red Hat Ceph Storage 5; Red Hat Ceph Storage 9; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.
Medium [CVE-2026-80206] Denial of Service vulnerability in tgrep module
NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process. A flaw was found in NLTK, specifically within its tgrep module. This vulnerability, known as Regular Expression Denial of Service (ReDoS), allows a remote attacker to provide specially crafted regular expressions. When processed, these expressions can cause indefinite CPU saturation, leading to a complete denial of service for the Python process utilizing the NLTK library. When processing user-supplied regular expressions inside /regex/ pattern nodes via functions such as tgrep_positions() or tgrep_compile(), NLTK executes re.search without input validation or execution timeouts. If an application exposes these interfaces to unauthenticated or low-privileged attackers, supplying a specially crafted regular expression triggers catastrophic backtracking, resulting in CPU saturation and process-level denial of service.
Medium [CVE-2026-79654] Katello Content View History API Cross-Organization Authorization Bypass
Katello Content View History API Cross-Organization Authorization Bypass. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-639. Affected product named by the advisory: Red Hat Satellite 6.
Medium [CVE-2026-74749] Prevent hard lockup on granted time slice extension
Prevent hard lockup on granted time slice extension. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-366.
Medium [CVE-2026-80529] don't swallow dquot recovery verification errors
don't swallow dquot recovery verification errors. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-252. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
Medium [CVE-2026-80531] avoid UAF on sc->tempip in xrep_tempfile_create
avoid UAF on sc->tempip in xrep_tempfile_create. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-825.
Medium [CVE-2026-80538] propagate errors from xfs_rtginode_load
propagate errors from xfs_rtginode_load. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-253.
Medium [CVE-2026-80535] don't double-lock when deleting a self-referential directory
don't double-lock when deleting a self-referential directory. Red Hat rates this low (CVSS 5.5). Weakness: CWE-764.
Medium [CVE-2026-80533] don't walk off the end of a null sc->sa.agi_bp in AGI repair
don't walk off the end of a null sc->sa.agi_bp in AGI repair. Red Hat rates this low (CVSS 5.5). Weakness: CWE-476.
Medium [CVE-2026-80532] fix another iunlink infinite loop bug in online fsck
fix another iunlink infinite loop bug in online fsck. Red Hat rates this low (CVSS 5.5). Weakness: CWE-835.
Medium [CVE-2026-80534] fix ilock leak on error in xfs_dq_get_next_id
fix ilock leak on error in xfs_dq_get_next_id. Red Hat rates this low (CVSS 4.7). Weakness: CWE-667. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-80524] Add NULL check in optee_ffa_lend_protmem
In the Linux kernel, the following vulnerability has been resolved: optee: ffa: Add NULL check in optee_ffa_lend_protmem Sashiko (locally) reports a possible null dereference under memory pressure due to the lack of validation of the allocated pointer. Fix that by adding the missing check. A flaw was found in the Linux kernel's OP-TEE (Open Portable Trusted Execution Environment) Fast Fault-tolerant Architecture (FFA) component. A local attacker could exploit a missing null check when allocating protected memory. Under specific memory pressure conditions, this could lead to a null pointer dereference, potentially causing a system crash and a denial of service. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-476. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Medium [CVE-2026-80554] Limit the number of channel program segments
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program. The vfio-ccw logic breaks these channel programs into segments whenever it encounters a Transfer-In-Channel (TIC) CCW, and the combined number of segments count towards the global limit. Impose an equivalent limit to the number of segments until such logic can be made non-recursive. The vfio-ccw logic processes channel programs recursively, breaking them into segments when a Transfer-In-Channel (TIC) Channel Command Word (CCW) is encountered. An attacker could exploit the lack of a proper limit on these segments, leading to excessive resource consumption. This could result in a denial of service, making the system unavailable. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-80547] Implement a crw lock
In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Implement a crw lock Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a lock to manage the list of those payloads, to ensure they are read cohesively. This vulnerability arises from the lack of a proper lock to manage the list of Channel Report Word (CRW) payloads, which are asynchronous events from hardware. Without this lock, these payloads may not be read cohesively, potentially leading to data inconsistency or unexpected system behavior. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-413. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-74734] fix NULL pointer dereference in ar_context_release
In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointer dereference in ar_context_release During the error handling path of the driver's probe function, a NULL pointer dereference can occur in ar_context_release(). When pci_probe() fails early (e.g., if pcim_enable_device() or MMIO mapping fails), the devres cleanup mechanism invokes release_ohci(). This function unconditionally calls ar_context_release() to clean up the asynchronous receive contexts. However, if ar_context_init() was not yet called, ctx->ohci remains NULL (as the fw_ohci structure is zero-initialized by devres_alloc()). ar_context_release() immediately dereferences ctx->ohci to get the dev pointer before checking if the context was actually initialized, leading to a crash: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:ar_context_release+0x3f/0x380 drivers/firewire/ohci.c:543 Call Trace: release_ohci+0x3f/0x60 drivers/firewire/ohci.c:3567 release_nodes drivers/base/devres.c:546 [inline] devres_release_all+0x1a8/0x260 drivers/base/devres.c:576 device_unbind_cleanup drivers/base/dd.c:597 [inline] really_probe+0x451/0xae0 drivers/base/dd.c:772 To fix this, move the assignment of the dev pointer after the!ctx->buffer check.
Medium [CVE-2026-74751] Fix ZBB strnlen reading past count boundary
In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen reading past count boundary The ZBB-optimized strnlen loop loads one word ahead before checking the aligned boundary: REG_L t1, SZREG(t0) // load next word addi t0, t0, SZREG // advance orc.b t1, t1 bgeu t0, t4, 4f // boundary check AFTER load where t4 = (s + count) & -SZREG. When s is aligned and count is a multiple of SZREG, t4 equals s + count and the loop loads a full word starting at exactly s + count. If s + count falls on a page boundary with the next page unmapped, this faults. Fix by computing the aligned boundary from the last valid byte (s + count - 1) instead of s + count. This makes the loop stop at the word containing the last valid byte rather than potentially loading the word after it. The count == 0 case is already handled by the beqz early exit. Also add a pre-loop guard (bgeu t0, t4) for the case where all valid bytes fit within the first word. With the adjusted boundary, t4 can equal t0, and entering the loop with stale register state from the first-word processing would produce incorrect results. The final minu clamp ensures the result is still correct when the last loaded word extends past s + count - 1 within the same aligned word. A flaw was found in the Linux kernel's RISC-V (Reduced Instruction Set Computer - V) ZBB-optimized `strnlen` function.