53840 matches found
CVE-2026-74484 binfmt_misc: don't let an 'F' entry pin its own instance
In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...
CVE-2026-74484 binfmt_misc: don't let an 'F' entry pin its own instance
In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't let an 'F' entry pin its own instance An entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. Any entry nobody removes by hand only gets closed once...
EUVD-2026-59676
In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: don't leak the user namespace when the mount fails bmgettree takes a reference to the user namespace and hands it to gettreekeyed as the sget key. sgetfc moves that reference into sb-sfsinfo and clears fc-sfsinfo, so...
EUVD-2026-59673
In the Linux kernel, the following vulnerability has been resolved: net: bridge: stop fast-leave after deleting a port group brmulticastleavegroup iterates mp-ports with pp = &p-next in its fast-leave path. After brmulticastdelpg removes p, continuing the loop advances pp through the deleted entr...
CVE-2026-74477
In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone path: BUG: kernel NULL pointer dereference, address:...
CVE-2026-74476 veth: convert frag_list skbs before running XDP
In the Linux kernel, the following vulnerability has been resolved: veth: convert fraglist skbs before running XDP A fraglist skb can reach veth with datalen set but nrfrags zero. vethconvertskbtoxdpbuff only converts skbs that are shared, locked, have frags, or do not have enough headroom. It...
CVE-2026-74469
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...
CVE-2026-74469 sctp: prevent peer transport count overflow
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...
CVE-2026-74469
The CVE-2026-74469 issue affects the Linux kernel SCTP implementation. It occurs in sctp_assoc_add_peer(), where a 16-bit transport_count is incremented for each new unique peer; once the 65,536th transport is added, the counter wraps to zero. SCTP sock_diag uses transport_count to reserve the IN...
CVE-2026-74464
CVE-2026-74464 affects the Linux kernel net/openvswitch path where skb leaks can occur on flow key update failure during connection tracking. The issue stems from ovs_ct_execute() freeing the skb on failure while ovs_flow_key_update() does not; if update fails and returns early, the skb may be le...
CVE-2026-74464
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovsctexecute always steals or frees the skb on failure while ovsflowkeyupdate does not. So, if it fails and we return right away, the skb ends up leaked. Fix tha...
CVE-2026-74464 net: openvswitch: fix skb leak on flow key update failure during ct
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovsctexecute always steals or frees the skb on failure while ovsflowkeyupdate does not. So, if it fails and we return right away, the skb ends up leaked. Fix tha...
EUVD-2026-59655
In the Linux kernel, the following vulnerability has been resolved: i2c: imx: mark I2C adapter when hardware is powered down On some i.MX platforms, certain I2C client drivers keep a periodic workqueue which continues to trigger I2C transfers. During system suspend/resume, there exists a time...
CVE-2026-74445 drm/vmwgfx: reject DX_BIND_QUERY without a DX context
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DXBINDQUERY without a DX context vmwcmddxbindquery unconditionally dereferences swcontext-dxctxnode-ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbuf with...
CVE-2026-74444
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...
CVE-2026-74442 drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: avoid destroyworkqueueNULL on vkms init failure Two paths through vmwvkmsinit can leave vmw-crcworkq NULL while still leaving the rest of the driver in a state that calls vmwvkmscleanup at module unload: 1...
EUVD-2026-59604
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...
CVE-2026-73635
Apache Struts (versions 2.0.0–2.3.37, 2.5.0–2.5.33, 6.0.0–6.10.0, 7.0.0–7.2.1) is vulnerable to unbounded localized-text cache growth: when no fixed locale is set, the request-supplied locale causes caches to expand without limit, exhausting the Java heap and causing denial of service. CVSS 7.5 (...