64499 matches found
CVE-2026-64166 firmware: arm_ffa: Check for NULL FF-A ID table while driver registration
In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Check for NULL FF-A ID table while driver registration The bus match callback assumes that every FF-A driver provides an idtable and dereferences it unconditionally. Enforce that contract at registration time so...
CVE-2026-64140
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in procshowfiles When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSIONLOGOFF, sessionfdcheck clears fp-tcon = NULL on the reconnectable file pointer but leaves t...
CVE-2026-64140 ksmbd: fix null pointer dereference in proc_show_files()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in procshowfiles When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSIONLOGOFF, sessionfdcheck clears fp-tcon = NULL on the reconnectable file pointer but leaves t...
CVE-2026-64118
The CVE-2026-64118 issue is a Linux kernel memory-management bug in qed_cxt_tables_alloc(): if a later PF/VF CID bitmap allocation fails, qed_cid_map_alloc() jumps to cid_map_fail and frees previously allocated CID bitmaps; then qed_cxt_tables_alloc() calls qed_cxt_mngr_free(), which invokes qed_...
CVE-2026-64106
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that...
EUVD-2026-45607
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...
CVE-2026-64034
The CVE concerns the Linux kernel net: mana TOCTOU in hwc_msg_id handling. In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arit...
CVE-2026-64034
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...
CVE-2026-64034 net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...
CVE-2026-64034 net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...
CVE-2026-64030 wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check linkid in ieee80211mlepcs IEEE80211MLESTAEPCSCONTROLLINKID is 0x000f, so linkid extracted from a PRIOACCESS ML element PERSTAPROFILE subelement can be 0..15. sdata-link has IEEE80211MLDMAXNUMLINKS 15...
CVE-2026-64030
The CVE-2026-64030 entries describe a Linux kernel WiFi bug in mac80211 (ieee80211_ml_epcs) where link_id = 15 can read sdata->link[15] beyond the 0..14 range, causing a crash when processing an EPCS Enable Response from a WiFi 7 AP. A NULL-check slip and dereferencing link->sdata leads to ...
CVE-2026-64030 wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check linkid in ieee80211mlepcs IEEE80211MLESTAEPCSCONTROLLINKID is 0x000f, so linkid extracted from a PRIOACCESS ML element PERSTAPROFILE subelement can be 0..15. sdata-link has IEEE80211MLDMAXNUMLINKS 15...
CVE-2026-64030
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check linkid in ieee80211mlepcs IEEE80211MLESTAEPCSCONTROLLINKID is 0x000f, so linkid extracted from a PRIOACCESS ML element PERSTAPROFILE subelement can be 0..15. sdata-link has IEEE80211MLDMAXNUMLINKS 15...
CVE-2026-64023 gpio: aggregator: fix a potential use-after-free
In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggr-lookups-devid before removing the entry from the lookup table. If a concurrent thread calls gpiodfind before we remove the entry, it could iterate over the li...
CVE-2026-64023
Summary of CVE-2026-64023 (Linux kernel GPIO aggregator use-after-free) Affected component: the kernel’s GPIO aggregator code. The vulnerability arises from a race during cleanup: on error, the code frees aggr->lookups->dev_id before removing the corresponding entry from the lookup table. I...
EUVD-2026-45589
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbdreopendurablefd republishes the same ksmbdfile into the session volatile-id table. If smb2open then takes a later error path, cleanup...
CVE-2026-64016
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbdreopendurablefd republishes the same ksmbdfile into the session volatile-id table. If smb2open then takes a later error path, cleanup...
CVE-2026-64016
CVE-2026-64016 : In the Linux kernel, the ksmbd durable reconnect path could mismanage file objects when a later error path occurred after a successful durable reconnect. Specifically, ksmbd_reopen_durable_fd() republished the same ksmbd_file into the session volatile-id table, and if smb2_open()...