203364 matches found
CVE-2026-89701
In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...
CVE-2026-89695
A Denial of Service vulnerability in the Linux kernel's NFSD (Network File System Daemon) component. The nfsd4_decode_posixacl() function reads a client-supplied u32 entry count without capping it, passing it directly to an O(n²) bubble sort (sort_pacl_range()). A remote attacker can send a craft...
EUVD-2026-76578
In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...
CVE-2026-89666
CVE-2026-89666 affects the Linux kernel's nfsd (NFS server daemon). A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK, or MKNOD carrying an atime or mtime whose nseconds field is out of range —it decodes as a valid uint32 but is not a valid timespec64. Nothing in the setattr path clamps ...
CVE-2026-89657 libceph: validate OSD extent maps before cursor advance
In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osdclient.c:osdsparseread validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is...
CVE-2026-89657 libceph: validate OSD extent maps before cursor advance
In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osdclient.c:osdsparseread validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is...
CVE-2026-89648
In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...
CVE-2026-89613 ntfs: reject invalid empty mapping pairs
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...
CVE-2026-89584
In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate use...
CVE-2026-89571
This is an out-of-bounds read in the Linux kernel's CXL (Compute Express Link) features subsystem. The fwctl_cmd_rpc() function copies user-supplied data into a fixed-size buffer, but the downstream cxlctl_set_feature() callback validates the user-controlled op_size only from below, never against...
EUVD-2026-76449
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gsskrb5unwrapv2 sets buf-len to a logical length, which can be much smaller than head0.iovlen the allocated receive-page capacity. It then calls xdrbuftrim with a trim...
CVE-2026-89513 RISC-V: KVM: Fix PMU event info array size overflow
In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...
CVE-2026-89505 RDMA/uverbs: Guard legacy bundles without method_elm
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without methodelm The legacy write path dispatches through a uverbsapiwritemethod, but the uverbsattrbundle passed to provider code does not have an ioctl method element. If malformed provider...
EUVD-2026-76400
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlmmiglockreshandler A node receiving a DLMMIGLOCKRES message trusts several fields of the peer-supplied dlmmigratablelockres without validation. numlocks and locknamelen are bounded only on the sending...
CVE-2026-89494
CVE-2026-89494 is a CRITICAL (CVSS 9.8) vulnerability in the OCFS2 Distributed Lock Manager (DLM) within the Linux kernel. The dlm_mig_lockres_handler trusts peer-supplied num_locks and lockname_len fields without validation, leading to an out-of-bounds read (triggering a BUG_ON panic) and a heap...
CVE-2026-89443
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...
CVE-2026-89438
This CVE affects the Linux kernel 's platform/x86: ISST (Intelligent Speed and Frequency Tuning Technology) driver. The root cause is a missing validation of the maximum CLOS ID and logical CPU ID for the core power feature. These values are used to calculate MMIO offsets , so an out-of-range val...
CVE-2026-81017
CVE-2026-81017 affects the Linux kernel's platform/chrome/sensorhub driver. The root cause is a missing validation of the 8-bit EC-reported sensor number in cros_ec_sensorhub_ring_handler(); the unvalidated value is then used to index sensorhub->batch_state[], an array allocated with only sens...
CVE-2026-81007
CVE-2026-81007 affects the Linux kernel 's ipmi/ipmb subsystem. The function ipmb_write() read message fields before validating the length byte, allowing a zero or short write to read uninitialized stack bytes and causing an integer underflow in the block write length when the length is smaller t...