CVE 2026 document archive · 214
Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →
13,154 documents · Identifier year 2026 · 214 / 264
- CVE-2026-31699kernel: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed
- CVE-2026-31698kernel: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed
- CVE-2026-31697kernel: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed
- CVE-2026-31696kernel: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
- CVE-2026-31695kernel: wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
- CVE-2026-31694kernel: fuse: reject oversized dirents in page cache
- CVE-2026-31693kernel: cifs: some missing initializations on replay
- CVE-2026-31692kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns
- CVE-2026-31691kernel: igb: remove napi_synchronize() in igb_down()
- CVE-2026-31690kernel: firmware: thead: Fix buffer overflow and use standard endian macros
- CVE-2026-31689kernel: EDAC/mc: Fix error path ordering in edac_mc_alloc()
- CVE-2026-31687kernel: gpio: omap: do not register driver in probe()
- CVE-2026-31686kernel: mm/kasan: fix double free for kasan pXds
- CVE-2026-31685kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets
- CVE-2026-31684kernel: net: sched: act_csum: validate nested VLAN headers
- CVE-2026-31683kernel: batman-adv: avoid OGM aggregation when skb tailroom is insufficient
- CVE-2026-31682kernel: bridge: br_nd_send: linearize skb before parsing ND options
- CVE-2026-31681kernel: netfilter: xt_multiport: validate range encoding in checkentry
- CVE-2026-31680kernel: net: ipv6: flowlabel: defer exclusive option free until RCU teardown
- CVE-2026-31679kernel: openvswitch: validate MPLS set/set_masked payload length
- CVE-2026-31678kernel: openvswitch: defer tunnel netdev_put to RCU release
- CVE-2026-31677kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget
- CVE-2026-31676kernel: rxrpc: only handle RESPONSE during service challenge
- CVE-2026-31675kernel: net/sched: sch_netem: fix out-of-bounds access in packet corruption
- CVE-2026-31674kernel: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
- CVE-2026-31673kernel: af_unix: read UNIX_DIAG_VFS data under unix_state_lock
- CVE-2026-31672kernel: wifi: rt2x00usb: fix devres lifetime
- CVE-2026-31671kernel: xfrm_user: fix info leak in build_report()
- CVE-2026-31670kernel: net: rfkill: prevent unlimited numbers of rfkill events from being created
- CVE-2026-31669kernel: mptcp: fix slab-use-after-free in __inet_lookup_established
- CVE-2026-31668kernel: seg6: separate dst_cache for input and output paths in seg6 lwtunnel
- CVE-2026-31667kernel: Input: uinput - fix circular locking dependency with ff-core
- CVE-2026-31666kernel: btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()
- CVE-2026-31665kernel: netfilter: nft_ct: fix use-after-free in timeout object destroy
- CVE-2026-31664kernel: xfrm: clear trailing padding in build_polexpire()
- CVE-2026-31663kernel: xfrm: hold dev ref until after transport_finish NF_HOOK
- CVE-2026-31662kernel: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
- CVE-2026-31661kernel: wifi: brcmsmac: Fix dma_free_coherent() size
- CVE-2026-31660kernel: nfc: pn533: allocate rx skb before consuming bytes
- CVE-2026-31659kernel: batman-adv: reject oversized global TT response buffers
- CVE-2026-31658kernel: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
- CVE-2026-31657kernel: batman-adv: hold claim backbone gateways by reference
- CVE-2026-31656kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat
- CVE-2026-31655kernel: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
- CVE-2026-31654kernel: mm/vma: fix memory leak in __mmap_region()
- CVE-2026-31653kernel: mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails
- CVE-2026-31652kernel: mm/damon/stat: deallocate damon_call() failure leaking damon_ctx
- CVE-2026-31651kernel: mmc: vub300: fix NULL-deref on disconnect
- CVE-2026-31650kernel: mmc: vub300: fix use-after-free on disconnect
- CVE-2026-31649kernel: net: stmmac: fix integer underflow in chain mode