247266 matches found
CVE-2026-74528
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...
CVE-2026-74528 Bluetooth: hci_sync: hold conn in hci_past_sync() callback
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...
EUVD-2026-59722
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...
CVE-2026-74529
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...
CVE-2026-74529 Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...
CVE-2026-74529
In the Linux kernel Bluetooth subsystem, the issue is in the hci_sync path: the conn object could be freed while the hci_sync task is running in hci_connect_pa_sync(), creating a theoretical use-after-free. The documented fix is to hold a refcount on the conn to prevent deallocation during the ca...
CVE-2026-74528
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...
CVE-2026-74528 Bluetooth: hci_sync: hold conn in hci_past_sync() callback
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...
CVE-2026-74529 Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectpasync callback There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...
CVE-2026-74528
The CVE refers to the Linux kernel Bluetooth subsystem: hci_sync in the hci_past_sync() callback, which previously could dereference freed pointers to hci_conn_valid() due to kmalloc reuse. The fix holds a reference count on the connection to ensure resources remain valid, preventing use-after-fr...
EUVD-2026-59721
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...
EUVD-2026-59720
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Block VFs from clobbering special CGX PKIND state PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC ...
CVE-2026-74526 scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mrfaultueventemit mpi3mrfaultueventemit runs from the fault watchdog and reset paths where host I/O may already be blocked. GFPKERNEL allocations here, both the local kzallocobj and the...
CVE-2026-74525 net: sxgbe: free TX rings on RX allocation failure
In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...
EUVD-2026-59718
In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...
CVE-2026-74525 net: sxgbe: free TX rings on RX allocation failure
In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...
CVE-2026-74525
In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...
CVE-2026-74526
In CVE-2026-74526, the Linux kernel fault-handling code for mpi3mr (scsi) had a potential deadlock when GFP_KERNEL allocations in mpi3mr_fault_uevent_emit could trigger memory reclaim while host I/O was blocked. The fix covers the entire call with memalloc_noio_save()/restore(), replacing the pre...
CVE-2026-74526
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mrfaultueventemit mpi3mrfaultueventemit runs from the fault watchdog and reset paths where host I/O may already be blocked. GFPKERNEL allocations here, both the local kzallocobj and the...
CVE-2026-74525
CVE-2026-74525 affects the Linux kernel net sxgbe driver. When RX descriptor ring allocation fails, init_dma_desc_rings() frees partial RX rings but leaks TX rings allocated earlier. The fix rearranges error labels to clean up TX rings on RX failure. Affected component: net/sxgbe RX/TX ring initi...