267391 matches found
CVE-2026-74445
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DXBINDQUERY without a DX context vmwcmddxbindquery unconditionally dereferences swcontext-dxctxnode-ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with...
UBUNTU-CVE-2026-74445
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DXBINDQUERY without a DX context vmwcmddxbindquery unconditionally dereferences swcontext-dxctxnode-ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with...
CVE-2026-74445 drm/vmwgfx: reject DX_BIND_QUERY without a DX context
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DXBINDQUERY without a DX context vmwcmddxbindquery unconditionally dereferences swcontext-dxctxnode-ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with...
CVE-2026-74445
The CVE (CVE-2026-74445) affects the Linux kernel drm/vmwgfx path. The vulnerability arises when vmw_cmd_dx_bind_query() dereferences sw_context->dx_ctx_node->ctx if a DX_BIND_QUERY is submitted with dx_context_handle set to SVGA3D_INVALID_ID, allowing a NULL pointer dereference and kernel ...
CVE-2026-74445 drm/vmwgfx: reject DX_BIND_QUERY without a DX context
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DXBINDQUERY without a DX context vmwcmddxbindquery unconditionally dereferences swcontext-dxctxnode-ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with...
EUVD-2026-59752
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DXBINDQUERY without a DX context vmwcmddxbindquery unconditionally dereferences swcontext-dxctxnode-ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with...
AZL-96288 CVE-2026-74344 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: bpf: Clear rb node linkage when freeing bpfrbroot bpfrbrootfree detaches the root by copying the current rbrootcached and then replacing the live root with RBROOTCACHED. It then walks the copied root and drops each object contain...
CVE-2026-72179
In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populatecacheleaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final ofnodeputnp correctly drops the...
UBUNTU-CVE-2026-72026
In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsicearlyacpiinit allocates a firmware node before setting up the IMSIC state. If imsicsetupstate fails, the function returns without freeing the allocated...
UBUNTU-CVE-2026-72080
In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix use-after-free during unmount During unmount or failure teardown all mondata structures that contain monitoring event file private data are freed after which kernfs nodes are removed. However, the RDTDELETED flag ...
UBUNTU-CVE-2026-72231
In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid request storms during pending request batadvsendttrequest allocates a ttreqnode when none exists for the destination originator node. This should prevent that a multiple TT requests are send at the same time...
UBUNTU-CVE-2026-72179
In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populatecacheleaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final ofnodeputnp correctly drops the...
CVE-2026-74343 kernfs: fix xattr race condition with multiple superblocks
In the Linux kernel, the following vulnerability has been resolved: kernfs: fix xattr race condition with multiple superblocks Multiple superblocks with different namespaces can share the same kernfsnode when kernfstestsuper finds a matching root but different namespace. This means multiple inode...
CVE-2026-72179 riscv: cacheinfo: Fix node reference leak in populate_cache_leaves
In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populatecacheleaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final ofnodeputnp correctly drops the...
EUVD-2026-58937
In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populatecacheleaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final ofnodeputnp correctly drops the...
CVE-2026-72179
The CVE-2026-72179 entry concerns the Linux kernel (riscv) cacheinfo: populate_cache_leaves. A node reference leak occurs because the final of_node_put(np) can leak the last valid node when the loop finishes with np == NULL. The fix, as documented in multiple sources, changes the final call from ...
CVE-2026-72026
The CVE-2026-72026 vulnerability is in the Linux kernel IRQ subsystem for riscv IMSIC early initialization. The issue: imsic_early_acpi_init() allocates a firmware node before IMSIC state setup; if imsic_setup_state() fails, the allocated fwnode is not freed. The fix adds cleanup on the error pat...
CVE-2026-72024 mac802154: remove interfaces with RCU list deletion
In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries with listdel, so an asynchronous transmit completion can...
