CVE 2026 document archive · 33
Official-source documents for RHEL 7/8/9. Full search and filters remain available in the search interface. CVE entries require collected VEX data. Search & filters →
13,154 documents · Identifier year 2026 · 33 / 264
- CVE-2026-98629kernel: net/sched: cls_u32: fix manual hash table handle IDR aliasing
- CVE-2026-98628kernel: bpf: Make post-verification instruction rewrites killable
- CVE-2026-98627kernel: bpf: Preserve packet pointer class displacement in regsafe()
- CVE-2026-98626kernel: bpf: Restrict CO-RE poisoning to relocatable instructions
- CVE-2026-98625kernel: netfilter: flowtable: publish HW_DEAD after worker is done
- CVE-2026-98624kernel: netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
- CVE-2026-98623kernel: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
- CVE-2026-98622kernel: net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
- CVE-2026-98621kernel: net: gue: reject invalid REMCSUM offsets
- CVE-2026-98620kernel: net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
- CVE-2026-98619kernel: net: ethtool: keep rtnl_lock for the ioctl self test
- CVE-2026-98618kernel: eth: fbnic: Handle maximum standalone channels
- CVE-2026-98617kernel: eth: fbnic: use the Rx queue napi pointer to find the napi vector
- CVE-2026-98616kernel: eth: fbnic: reset num_napi when the napi vectors are freed
- CVE-2026-98615kernel: eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
- CVE-2026-98614kernel: sctp: avoid livelock while updating retransmit path
- CVE-2026-98613kernel: bpf: Bound ownership depth through local kptrs and graph roots
- CVE-2026-98612kernel: net: usb: catc: bound the RX packet length in catc_rx_done()
- CVE-2026-98611kernel: bpf: Check params size before reading reserved fields
- CVE-2026-98610kernel: net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
- CVE-2026-98609kernel: drm/virtio: fix object leak when drm_gem_handle_create() fails
- CVE-2026-98608kernel: drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
- CVE-2026-98607kernel: drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
- CVE-2026-98606kernel: drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
- CVE-2026-98605kernel: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
- CVE-2026-98604kernel: ovpn: replace bind when learning local endpoint
- CVE-2026-98602kernel: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
- CVE-2026-98601kernel: Bluetooth: btintel_pcie: validate device-supplied DMA indices
- CVE-2026-98600kernel: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
- CVE-2026-98599kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
- CVE-2026-98598kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info
- CVE-2026-98597kernel: net: usb: sr9700: include receive overhead in the length check
- CVE-2026-98596kernel: ipv6: Fix dst leak for uncached routes
- CVE-2026-98595kernel: udp: remove a disconnected socket from the 4-tuple hash table
- CVE-2026-98594kernel: tg3: clean up PHYLIB resources on probe failure
- CVE-2026-98593kernel: s390/debug: Fix NULL pointer dereference in debug_info_copy()
- CVE-2026-98592kernel: net: spacemit: clear TX descriptor on fragment mapping failure
- CVE-2026-98591kernel: bpf: Fix bounds check for skb-backed dynptrs
- CVE-2026-98590kernel: bpf: Fix bpf_sock context code generation
- CVE-2026-98589kernel: bpf: Reject pkt arguments in mutating subprogs
- CVE-2026-98588kernel: bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
- CVE-2026-98587kernel: firewire: cdev: fix back-transition for iso_resource_auto client resource
- CVE-2026-98586kernel: sctp: hold asoc or transport before mod_timer() in timer handlers
- CVE-2026-98585kernel: eth: fbnic: Avoid rounding zero ring sizes
- CVE-2026-98584kernel: net/sched: fix potential stack infoleak in em_text_dump()
- CVE-2026-98583kernel: nfc: nfcmrvl: validate helper command length before pull
- CVE-2026-98582kernel: nfc: st21nfca: validate received frame size
- CVE-2026-98581kernel: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
- CVE-2026-98580kernel: nfc: llcp: Fix race condition in accept_queue lifecycle
- CVE-2026-98579kernel: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure