337139 matches found
kernel: nfsd: don't free session slots that are still in use
A flaw was found in the Linux kernel's Network File System NFS daemon, nfsd. A remote attacker could exploit a use-after-free vulnerability in the nfsd4sequence function. This occurs when the system attempts to reduce the number of active session slots while a client is still using one of the slo...
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key
A flaw was found in the Linux kernel's acttunnelkey module, which manages network traffic tunneling. A race condition, where multiple operations occur in an unpredictable order, can lead to a use-after-free vulnerability. This allows a local attacker to corrupt memory, potentially causing the...
kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
A flaw was found in the Linux kernel's netfilter nfnetlinkqueue component. This vulnerability occurs when an application does not set the FGSO capability flag and a Generic Segmentation Offload GSO packet with an unconfirmed netfilter connection nfconn entry is received. Due to an incorrect order...
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
A flaw was found in the Linux kernel's networking scheduler, specifically within the taprio module. When the system attempts to switch schedules, a use-after-free vulnerability occurs in the advancesched function. This happens because a pointer to an old schedule entry is still used after the...
kernel: media: cx231xx: reject geometry changes while the VBI queue is busy
A flaw was found in the Linux kernel's cx231xx media driver. A local attacker can exploit this vulnerability by manipulating video and Vertical Blanking Interval VBI queue operations. This allows for a heap out-of-bounds write, which could lead to arbitrary code execution or a denial of service...
kernel: ALSA: usx2y: bound the hwdep mmap fault offset
A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...
CVE-2026-99999
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksumstart before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skbchecksumhelp can corrupt the network header and cause a bunch of mischief. This was discovered and report...
CVE-2023-32233-reproduction
CVE-2023-32233 — nftables Use-After-Free: Reproduction & Root-Cause Analysis What this repo is: my hands-on reproduction and study of CVE-2023-32233, a use-after-free in the Linux kernel Netfilter nftables subsystem that allows local privilege escalation, publicly disclosed in May 2023 by Patryk...
kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect
A flaw was found in the Linux kernel's cfg80211 wireless subsystem. This vulnerability involves a race condition during the process of disconnecting a wireless device, where a work item can be improperly queued after it has been cancelled. This could allow a local attacker to trigger a system...
kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
A flaw was found in the KVM Kernel-based Virtual Machine component for ARM64 architecture in the Linux kernel. This vulnerability arises from a race condition within the virtual Generic Interrupt Controller vgic when an interrupt's processor affinity is changed at the same time its Locality-aware...
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
A flaw was found in the Linux kernel's Server Message Block over Remote Direct Memory Access SMC-Rv2 protocol implementation. The smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys functions incorrectly handle oversized LLC messages, reading beyond the intended message boundaries. This can lead to th...
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping
A flaw was found in the Linux kernel's Network File System Daemon NFSD. A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This...
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
A flaw was found in the Linux kernel's networking scheduler, specifically within the taprio module. When the system attempts to switch schedules, a use-after-free vulnerability occurs in the advancesched function. This happens because a pointer to an old schedule entry is still used after the...
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
A flaw was found in the Linux kernel's Wi-Fi mac80211 component. A connected WiFi 7 Access Point AP can trigger an out-of-bounds write by sending a specially crafted EPCS Enable Response action frame. This vulnerability can lead to a kernel crash, resulting in a Denial of Service DoS for the...
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...
kernel: udp: fix potential use-after-free in tunnel segmentation
A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...
kernel: svcrdma: Validate Read chunk positions before reconstruction
A flaw was found in the svcrdma component of the Linux kernel. A remote attacker can exploit this vulnerability by supplying a crafted RPC/RDMA Read chunk position field that is not properly validated against the received inline body length. This can lead to an underflow, exposing adjacent slab...
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping
A flaw was found in the Linux kernel's Network File System Daemon NFSD. A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This...
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key
A flaw was found in the Linux kernel's acttunnelkey module, which manages network traffic tunneling. A race condition, where multiple operations occur in an unpredictable order, can lead to a use-after-free vulnerability. This allows a local attacker to corrupt memory, potentially causing the...
kernel: ALSA: usx2y: bound the hwdep mmap fault offset
A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...