142118 matches found
CVE-2026-72489 staging: nvec: fix use-after-free in nvec_rx_completed()
In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...
CVE-2026-72489 staging: nvec: fix use-after-free in nvec_rx_completed()
In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...
CVE-2026-72488
In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdwaddelementgroupcount found by syzkaller The original implementation caused an out-of-bounds memory access in the sdwaddelementgroupcount for-loop when i == num. for i = 0; i ratesi && lane == group-lanesi...
CVE-2026-72489
In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...
CVE-2026-72489
The CVE-2026-72489 issue affects the Linux kernel staging/nvec code. In nvec_rx_completed(), an incomplete RX transfer could trigger nvec_msg_free() to clear a pool slot, after which the code reads nvec->rx->data[0]. Because the slot may be reallocated concurrently, this leads to a use-afte...
CVE-2026-72487
In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr before accessing We meet a crash when running stress-ng on x8664 machine: BUG: unable to handle page fault for address: ffa0000007f40000 RIP: 0010:pcigetromsize+0x52/0x220 Call Trace:...
CVE-2026-72486 mailbox: mtk-adsp: fix UAF during device teardown
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...
CVE-2026-72486 mailbox: mtk-adsp: fix UAF during device teardown
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...
CVE-2026-72485
CVE-2026-72485 describes a Linux kernel vulnerability in the coresight platform where nr_outconns/nr_inconns were incremented before allocations, causing a premature counter bump and potential panics during cleanup when allocations failed. The issue affects the coresight_add_out_conn() and coresi...
CVE-2026-72486
The CVE-2026-72486 entry concerns the Linux kernel mailbox for the mtk-adsp (SOF audio) where a use-after-free (UAF) can occur during device teardown. When the SOF driver fails to initialize (e.g., firmware boot timeout), devres unwinds and frees snd_sof_dev, while the mtk_adsp_mailbox shutdown c...
EUVD-2026-59385
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...
CVE-2026-72485 coresight: platform: defer connection counter increment until alloc succeeds
In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...
CVE-2026-72485
In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresightaddoutconn increments nroutconns before calling devmkreallocarray and again before devmkmalloc. If either allocation fails, the counter is...
CVE-2026-72484 staging: most: video: avoid double free on video register failure
In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure compregistervideodev allocates a videodevice with videodevicealloc and releases it if videoregisterdevice fails. This can double free the videodevice when...
CVE-2026-72484
In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure compregistervideodev allocates a videodevice with videodevicealloc and releases it if videoregisterdevice fails. This can double free the videodevice when...
CVE-2026-72484 staging: most: video: avoid double free on video register failure
In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure compregistervideodev allocates a videodevice with videodevicealloc and releases it if videoregisterdevice fails. This can double free the videodevice when...
EUVD-2026-59383
In the Linux kernel, the following vulnerability has been resolved: staging: most: video: avoid double free on video register failure compregistervideodev allocates a videodevice with videodevicealloc and releases it if videoregisterdevice fails. This can double free the videodevice when...
CVE-2026-72484
The CVE-2026-72484 entry documents a Linux kernel staging component (staging: most: video)double-free during video device registration. The root cause: comp_register_videodev() may release mdev->vdev via vdev->release() if video_register_device() fails, risking a second free when __video_re...
CVE-2026-72482
Summary of CVE-2026-72482 : In the Linux kernel’s gpib subsystem, a descriptor_busy reference counter used to pin gpib_descriptor across IO ioctl operations could be decremented twice in the command_ioctl() error path, causing the counter to underflow to -1 and enabling use-after-free on an activ...
EUVD-2026-59381
In the Linux kernel, the following vulnerability has been resolved: gpib: fix double decrement of descriptorbusy in commandioctl commit d1857f8296dc "gpib: fix use-after-free in IO ioctl handlers" introduced a descriptorbusy reference counter to pin struct gpibdescriptor across IO ioctl operation...