154085 matches found
CVE-2026-89574
CVE-2026-89574 is a vulnerability in the Linux kernel's device mapper (dm) array component. The root cause is insufficient validation of array block headers during read operations: array_block_check() only verifies blocknr and csum, while element_at() performs unguarded pointer arithmetic driven ...
CVE-2026-89574
In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...
CVE-2026-89574 dm array: validate array block headers on read
In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...
EUVD-2026-76486
In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...
CVE-2026-89574 dm array: validate array block headers on read
In the Linux kernel, the following vulnerability has been resolved: dm array: validate array block headers on read arrayblockcheck validates blocknr and csum and nothing else, while nodecheck, next to it, has bounded the structural fields since both were written. dmarraycursornext takes its loop...
EUVD-2026-76485
In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...
CVE-2026-89573 dm array: reject an array block whose value size is not the caller's
In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...
CVE-2026-89573
A local out-of-bounds read in the Linux kernel's device mapper (dm) array component allows memory corruption via crafted metadata . The root cause is that array_block_check() only validates a block's header against itself, so a 4-byte value_size block with max_entries 1018 passes as internally co...
CVE-2026-89571
This is an out-of-bounds read in the Linux kernel's CXL (Compute Express Link) features subsystem. The fwctl_cmd_rpc() function copies user-supplied data into a fixed-size buffer, but the downstream cxlctl_set_feature() callback validates the user-controlled op_size only from below, never against...
CVE-2026-89571 cxl/features: bound fwctl command payload to the input buffer
In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctlcmdrpc copies cmd-inlen bytes into inbuf = kvzalloccmd-inlen and passes inbuf and inlen to -fwrpc. The CXL callback cxlctlfwrpc ignores inlen and never checks the...
CVE-2026-89571 cxl/features: bound fwctl command payload to the input buffer
In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctlcmdrpc copies cmd-inlen bytes into inbuf = kvzalloccmd-inlen and passes inbuf and inlen to -fwrpc. The CXL callback cxlctlfwrpc ignores inlen and never checks the...
EUVD-2026-76483
In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctlcmdrpc copies cmd-inlen bytes into inbuf = kvzalloccmd-inlen and passes inbuf and inlen to -fwrpc. The CXL callback cxlctlfwrpc ignores inlen and never checks the...
CVE-2026-89559
CVE-2026-89559 affects the Linux kernel's libnvdimm/labels subsystem. The nslot field (a u32 read from DIMM label storage or via ND_CMD_SET_CONFIG_DATA) is multiplied by label_size in __nd_label_validate(). Because sizeof_namespace_label() returns unsigned, the product is evaluated in 32-bit and ...
CVE-2026-89559
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...
CVE-2026-89559 libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...
EUVD-2026-76470
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...
CVE-2026-89559 libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...
CVE-2026-89556
CVE-2026-89556 affects the Linux kernel module loader's ELF validity caching. In elf_validity_cache_sechdrs, section sizes and offsets are validated only when the section type is neither SHT_NULL nor SHT_NOBITS. However, elf_validity_cache_secstrings and elf_validity_cache_index_str subsequently ...
EUVD-2026-76467
In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr acce...
CVE-2026-89556
In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr acce...