CVE 2026 document archive · 192
Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →
13,154 documents · Identifier year 2026 · 192 / 264
- CVE-2026-43512tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
- CVE-2026-43503kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers
- CVE-2026-43502kernel: net/rds: handle zerocopy send cleanup before the message is queued
- CVE-2026-43501kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
- CVE-2026-43500kernel: "Dirty Frag" RxRPC variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel
- CVE-2026-43499kernel: rtmutex: Use waiter::task instead of current in remove_waiter()
- CVE-2026-43498kernel: accel/ivpu: Disallow re-exporting imported GEM objects
- CVE-2026-43497kernel: fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
- CVE-2026-43496kernel: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked
- CVE-2026-43495kernel: net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
- CVE-2026-43494kernel: net/rds: reset op_nents when zerocopy page pin fails
- CVE-2026-43493kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests
- CVE-2026-43492kernel: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
- CVE-2026-43491kernel: net: qrtr: ns: Limit the maximum server registration per node
- CVE-2026-43490kernel: ksmbd: validate inherited ACE SID length
- CVE-2026-43489kernel: liveupdate: luo_file: remember retrieve() status
- CVE-2026-43488kernel: usb: xhci: Prevent interrupt storm on host controller error (HCE)
- CVE-2026-43487kernel: ata: libata-core: Disable LPM on ST1000DM010-2EP102
- CVE-2026-43486kernel: arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults
- CVE-2026-43485kernel: nouveau/gsp: drop WARN_ON in ACPI probes
- CVE-2026-43484kernel: mmc: core: Avoid bitfield RMW for claim/retune flags
- CVE-2026-43483kernel: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
- CVE-2026-43482kernel: sched_ext: Disable preemption between scx_claim_exit() and kicking helper work
- CVE-2026-43481kernel: net-shapers: don't free reply skb after genlmsg_reply()
- CVE-2026-43480kernel: ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
- CVE-2026-43479kernel: net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
- CVE-2026-43478kernel: ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put
- CVE-2026-43477kernel: drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL
- CVE-2026-43476kernel: iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
- CVE-2026-43475kernel: scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
- CVE-2026-43474kernel: fs: init flags_valid before calling vfs_fileattr_get
- CVE-2026-43473kernel: scsi: mpi3mr: Add NULL checks when resetting request and reply queues
- CVE-2026-43472kernel: unshare: fix unshare_fs() handling
- CVE-2026-43471kernel: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()
- CVE-2026-43470kernel: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
- CVE-2026-43469kernel: xprtrdma: Decrement re_receiving on the early exit paths
- CVE-2026-43468kernel: net/mlx5: Fix deadlock between devlink lock and esw->wq
- CVE-2026-43467kernel: net/mlx5: Fix crash when moving to switchdev mode
- CVE-2026-43466kernel: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
- CVE-2026-43465kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ
- CVE-2026-43464kernel: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
- CVE-2026-43463kernel: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()
- CVE-2026-43462kernel: net: spacemit: Fix error handling in emac_tx_mem_map()
- CVE-2026-43461kernel: spi: amlogic: spifc-a4: Fix DMA mapping error handling
- CVE-2026-43460kernel: spi: rockchip-sfc: Fix double-free in remove() callback
- CVE-2026-43459kernel: ASoC: soc-core: flush delayed work before removing DAIs and widgets
- CVE-2026-43458kernel: serial: caif: hold tty->link reference in ldisc_open and ser_release
- CVE-2026-43457kernel: mctp: i2c: fix skb memory leak in receive path
- CVE-2026-43456kernel: bonding: fix type confusion in bond_setup_by_slave()
- CVE-2026-43455kernel: mctp: route: hold key->lock in mctp_flow_prepare_output()