119078 matches found
EUVD-2026-58960
In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state getnrfreeclusters allocates a temporary filerastate before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown, and wakes vol-freewaitq. If that...
CVE-2026-72202
Technical details are not publicly available in the provided documents. Monitor for updates from vendors and security trackers for affected products, patches, and remediation status.
CVE-2026-72202 ntfs: avoid heap allocation for free-cluster readahead state
In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster readahead state getnrfreeclusters allocates a temporary filerastate before it publishes the precomputed free cluster count, sets NVolFreeClusterKnown, and wakes vol-freewaitq. If that...
CVE-2026-72199 ntfs: validate resident index root values on lookup
In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEXROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those check...
CVE-2026-72192
The CVE-2026-72192 issue affects the Linux kernel ntfs3 code. Specifically, indx_insert_into_root before hdr_insert_head can overrun a kmalloc(index_block_size) when shrinking root->index_block_size (e.g., to 512) after the root is populated. A crafted NTFS image triggers a memcpy of attacker-...
CVE-2026-72192 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...
EUVD-2026-58950
In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...
CVE-2026-72192 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...
CVE-2026-72154
In the Linux kernel, the following vulnerability has been resolved: openrisc: Fix jumplabel smp syncing The original commit 8c30b0018f9d "openrisc: Add jump label support" copies from arm64 and does not properly consider how icache invalidation on remote cores works in OpenRISC. On OpenRISC remot...
CVE-2026-72135 tpm: Make the TPM character devices non-seekable
In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODEPREAD and FMODEPWRITE enabled. After a command leaves a response pendin...
EUVD-2026-58893
In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODEPREAD and FMODEPWRITE enabled. After a command leaves a response pendin...
CVE-2026-72135 tpm: Make the TPM character devices non-seekable
In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODEPREAD and FMODEPWRITE enabled. After a command leaves a response pendin...
CVE-2026-72135
The CVE-2026-72135 entry documents a Linux kernel TPM character device security fix. The vulnerability arose because TPM character devices left FMODE_PREAD and FMODE_PWRITE enabled, allowing an unchecked offset during a sequential read path (pread/preadv with offset 0x1400) to form data_buffer + ...
CVE-2026-72130 nvmet-auth: reject short AUTH_RECEIVE buffers
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...
CVE-2026-72130 nvmet-auth: reject short AUTH_RECEIVE buffers
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...
CVE-2026-72130
CVE-2026-72130 : In the Linux kernel, the nvmet-auth path is affected. A flaw in nvmet_execute_auth_receive() trusts the host-supplied AUTH_RECEIVE allocation length, allowing a remote NVMe-oF initiator to trigger a 16-byte heap out-of-bounds write by using a one-byte AUTH_RECEIVE allocation leng...
EUVD-2026-58888
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...
CVE-2026-72105 dm-log: fix a bitset_size overflow on 32bit machines
In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...
CVE-2026-72097
In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix a possible NULL pointer dereference Fix a possible NULL pointer dereference dmverityloadpinisbdevtrusted if the device has no table...
CVE-2026-72040
In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in iipmirequest When a caller provides a suppliedrecv message to iipmirequest, the function increments the user's nrmsgs reference count. If an error occurs later, the outerr cleanup path only frees the...