CVE 2026 document archive · 26
Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →
13,154 documents · Identifier year 2026 · 26 / 264
- CVE-2026-99010kernel: Bluetooth: RFCOMM: free the skb when the DLC has no owner
- CVE-2026-99009kernel: Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
- CVE-2026-99008kernel: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
- CVE-2026-99007kernel: drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
- CVE-2026-99006kernel: drm/i915/gem: Prevent overstepping exec array boundary
- CVE-2026-99005kernel: drm/i915/gt: Unmask interrupts only when ACTIVE is true
- CVE-2026-99004kernel: drm/imagination: Size page table preallocation by device address
- CVE-2026-99003kernel: drm/panthor: validate userspace queue count against initialized firmware slot count
- CVE-2026-99002kernel: drm/vmwgfx: validate pitch coming from userspace
- CVE-2026-99001kernel: drm/xe/i2c: cancel the client work on remove
- CVE-2026-99000kernel: drm/xe: Fix shrinker accounting double-subtraction on nested external pins
- CVE-2026-98999kernel: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
- CVE-2026-98998kernel: drm/bridge: th1520-dw-hdmi: Fix remove() callback
- CVE-2026-98997kernel: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell
- CVE-2026-98996kernel: fs: don't silently unmount busy mounts
- CVE-2026-98995kernel: namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
- CVE-2026-98994kernel: statmount: read the parent of an unmounted mount under mount_lock
- CVE-2026-98993kernel: namespace: don't inherit MNT_UMOUNT in clone_mnt()
- CVE-2026-98992kernel: namespace: don't copy an unmounted mount tree
- CVE-2026-98991kernel: namespace: queue a mount only once for mount notifications
- CVE-2026-98990kernel: namespace: check a submount for references right before unmounting it
- CVE-2026-98989kernel: namespace: check a recursive bind mount for mount namespace loops
- CVE-2026-98988kernel: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
- CVE-2026-98987kernel: namespace: look at the topmost mount for a mount namespace file
- CVE-2026-98986kernel: namespace: remove the fsnotify marks of a mount namespace in process context
- CVE-2026-98985kernel: namespace: check the mounts before reading their parents in pivot_root()
- CVE-2026-98984kernel: dcache: don't put a mountpoint on a dentry that's being removed
- CVE-2026-98983kernel: unshare: don't drop active namespace references that were never taken
- CVE-2026-98982kernel: namespace: don't let a pseudo dentry become the root of a mount
- CVE-2026-98981kernel: namespace: unhash a dentry before detaching the mounts on it
- CVE-2026-98980kernel: namei: don't reveal overmounted entries in refwalk
- CVE-2026-98979kernel: namespace: refuse an automount below a mount that is in no namespace
- CVE-2026-98978kernel: namespace: never expire a locked mount
- CVE-2026-98977kernel: namespace: handle mount locking for automounts correctly
- CVE-2026-98976kernel: namespace: keep the lock on a mount that a propagated copy is moved beneath
- CVE-2026-98975kernel: xfs: stop exchanging reflink flags when exchanging mappings
- CVE-2026-98974kernel: kernel: xfs: Unauthorized data modification via improper file size exchange handling
- CVE-2026-98973kernel: drm/bridge: Fix unlocked list_del in drm_bridge_add()
- CVE-2026-98972kernel: cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
- CVE-2026-98971kernel: gpio: exar: initialize the ID before registering its cleanup
- CVE-2026-98970kernel: drm/vc4: Free the BO cache size list on teardown
- CVE-2026-98969kernel: net/sched: em_text: reject unterminated algo before autoload
- CVE-2026-98968kernel: amt: send the relay's General Query directly from the receive path
- CVE-2026-98967kernel: cxgb4/ch_ktls: disable softirqs around tid_list erases
- CVE-2026-98966kernel: bonding: fix the program leak when XDP is replaced
- CVE-2026-98965kernel: ice: Restore Ordered MMIO Writes for Tx Doorbells
- CVE-2026-98964kernel: nvmet: use the local P2P device on metadata allocation failure
- CVE-2026-98963kernel: btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
- CVE-2026-98962kernel: btrfs: free iov when btrfs_uring_read_extent() fails
- CVE-2026-98961kernel: btrfs: unlock inode and extent in caller when io_uring read extent fails