Lucene search
+L

71335 matches found

EUVD
EUVD
added 2026/08/15 5:53 a.m.7 views

EUVD-2026-58958

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...

5.3AI score0.00598EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/15 5:53 a.m.47 views

CVE-2026-72200

CVE-2026-72200 affects Linux kernel NTFS support: the mapping-pairs parser can overflow when accumulating relative LCN deltas in a signed integer, potentially turning a corrupted runlist into a different set of physical clusters. Root cause: signed overflow when a runlist shape reaches S64_MAX an...

9.8CVSS5.3AI score0.00598EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/15 5:53 a.m.24 views

CVE-2026-72200 ntfs: detect mapping-pairs LCN accumulator overflow

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...

9.8CVSS5.5AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/15 5:53 a.m.32 views

CVE-2026-72198 ntfs: reject non-resident records for resident-only attributes

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILENAME and $VOLUMENAME records because their formats require resident values and callers handle...

7.8CVSS0.00162EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/15 5:53 a.m.44 views

CVE-2026-72195

CVE-2026-72195 concerns Linux kernel ntfs3: UpdateResidentValue may underflow data_size when attr_off/redo_len derive from on-disk LRH and aoff + dlen

7.8CVSS5.4AI score0.00169EPSS
SaveExploits0References7
OSV
OSV
added 2026/08/15 5:53 a.m.16 views

CVE-2026-72195 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...

7.8CVSS5.5AI score
SaveExploits0References10
EUVD
EUVD
added 2026/08/15 5:53 a.m.16 views

EUVD-2026-58953

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...

5.4AI score0.00169EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/08/15 5:53 a.m.22 views

CVE-2026-72195 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound attroff in UpdateResidentValue against dataoff In doaction's UpdateResidentValue case fslog.c:3307, lrh-attroff and lrh-redolen come from the on-disk LRH. When they satisfy aoff + dlen res.dataoff, the assignment...

7.8CVSS0.00169EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/08/15 5:53 a.m.9 views

EUVD-2026-58949

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...

5.3AI score0.00679EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/15 5:53 a.m.46 views

CVE-2026-72191

CVE-2026-72191 (Linux kernel ntfs3): The issue arises in indx_insert_into_buffer where sp and sp_size from hdr_find_split() can cause an underflow when sp_size exceeds remaining buffer, producing an out-of-bounds write and kernel panic. Reports show a crafted NTFS image where interior NTFS_DE siz...

9.8CVSS5.2AI score0.00679EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/08/15 5:53 a.m.23 views

CVE-2026-72158 fpga: dfl: add bounds check in dfh_get_param_size()

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP End of Parameters bit is se...

0.002EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/15 5:53 a.m.9 views

EUVD-2026-58887

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...

5.4AI score0.00704EPSS
SaveExploits0References8
OSV
OSV
added 2026/08/15 5:53 a.m.18 views

CVE-2026-72129 nvmet-rdma: handle inline data with a nonzero offset

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...

9.8CVSS5.5AI score
SaveExploits0References11
CVE
CVE
added 2026/08/15 5:53 a.m.61 views

CVE-2026-72129

The CVE describes a Linux kernel nvmet-rdma issue: when inline_data_size exceeds PAGE_SIZE, an offset in (PAGE_SIZE, inline_data_size] causes PAGE_SIZE - off to underflow, making sg->length effectively 4 GiB and allowing reading past the first inline page. The root cause is that the mapping as...

9.8CVSS5.3AI score0.00704EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/15 5:53 a.m.27 views

CVE-2026-72129 nvmet-rdma: handle inline data with a nonzero offset

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...

9.8CVSS0.00704EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/08/15 5:52 a.m.9 views

EUVD-2026-59063

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

5.5AI score0.00169EPSS
SaveExploits0References8
CVE
CVE
added 2026/08/15 5:52 a.m.46 views

CVE-2026-72105

The CVE-2026-72105 entry concerns the Linux kernel dm-log component, where a bitset_size overflow on 32‑bit architectures could occur during region_count handling. The root cause is a miscalculation of bitset_size (size_t) when computing the bitmap memory based on region_count, which could wrap t...

7.8CVSS5.5AI score0.00169EPSS
SaveExploits0References8
OSV
OSV
added 2026/08/15 5:52 a.m.14 views

CVE-2026-72105 dm-log: fix a bitset_size overflow on 32bit machines

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

7.8CVSS5.6AI score
SaveExploits0References11
Cvelist
Cvelist
added 2026/08/15 5:52 a.m.23 views

CVE-2026-72105 dm-log: fix a bitset_size overflow on 32bit machines

In the Linux kernel, the following vulnerability has been resolved: dm-log: fix a bitsetsize overflow on 32bit machines Commit c20e36b7631d "dm log: fix out-of-bounds write due to regioncount overflow" made sure that regioncount could fit in an unsigned int. But the bitmap memory isn't allocated...

7.8CVSS0.00169EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/08/15 5:52 a.m.7 views

EUVD-2026-59047

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

5.7AI score0.00166EPSS
SaveExploits0References5
Rows per page
Query Builder