358444 matches found
CVE-2026-68173 ublk: wait on ublk_dev_ready() instead of ub->completion
In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY without one - e.g. its START failed with -EBUSY and the error was...
CVE-2026-68172
CVE-2026-68172 affects the arm64 Linux kernel where huge_ptep_get may mis-handle unaligned addresses across contpmd/contpte hugetlb foliοs. The arm64 helper may misclassify the target as CONT_PTES instead of CONT_PMDS, potentially causing excess A/D state handling, dereferencing a garbage ptep, o...
EUVD-2026-55558
In the Linux kernel, the following vulnerability has been resolved: arm64: make hugeptepget handled unaligned addresses hugeptepget can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio examples of callers are pagemaphugetlbrange, pagemappedinvma. The...
CVE-2026-68172
In the Linux kernel, the following vulnerability has been resolved: arm64: make hugeptepget handled unaligned addresses hugeptepget can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio examples of callers are pagemaphugetlbrange, pagemappedinvma. The...
CVE-2026-68172 arm64: make huge_ptep_get handled unaligned addresses
In the Linux kernel, the following vulnerability has been resolved: arm64: make hugeptepget handled unaligned addresses hugeptepget can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio examples of callers are pagemaphugetlbrange, pagemappedinvma. The...
CVE-2026-68171 arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
In the Linux kernel, the following vulnerability has been resolved: arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates When seccomp support was originally added to arm64 in a1ae65b21941 "arm64: add seccomp support", seccomp was erroneously called before the ptrace...
CVE-2026-68170 mptcp: fix stale skb->sk reference on subflow close
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb-sk reference on subflow close The backlog list is updated by mptcpdataready under mptcpdatalock. The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk, before...
CVE-2026-68170
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb-sk reference on subflow close The backlog list is updated by mptcpdataready under mptcpdatalock. The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk, before...
CVE-2026-68169 mptcp: pm: userspace: fix use-after-free in get_local_id
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in getlocalid In mptcppmuserspacegetlocalid, the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the...
CVE-2026-68169
The CVE-2026-68169 entry documents a race in Linux kernel mptcp_pm_userspace_get_local_id() where an address entry is looked up under a spinlock but its id is read after the lock is released, allowing a concurrent delete to free the entry and cause a use-after-free. Concrete details show the issu...
CVE-2026-68169
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in getlocalid In mptcppmuserspacegetlocalid, the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the...
CVE-2026-68169 mptcp: pm: userspace: fix use-after-free in get_local_id
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in getlocalid In mptcppmuserspacegetlocalid, the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the...
CVE-2026-68168 afs: Fix afs_edit_dir_remove() to get, not find, block 0
In the Linux kernel, the following vulnerability has been resolved: afs: Fix afseditdirremove to get, not find, block 0 Fix afseditdirremove to use afsdirgetblock to get block 0 rather than afsdirfindblock as the latter caches the found block in the afsdiriter and may switch out the page it's on ...
CVE-2026-68168
In the Linux kernel, the following vulnerability has been resolved: afs: Fix afseditdirremove to get, not find, block 0 Fix afseditdirremove to use afsdirgetblock to get block 0 rather than afsdirfindblock as the latter caches the found block in the afsdiriter and may switch out the page it's on ...
CVE-2026-68167
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes BUG There is a syzbot report that the check inside getnewlocation triggered: BTRFS info device loop0: found 31 extents, stage: move data extents BTRFS info device loop0: leaf...
CVE-2026-68167
CVE-2026-68167 affects the Linux kernel’s Btrfs filesystem, where data relocation inodes could trigger attempting compression of inline extents. The root cause is that the relocation path preallocates blocks and may dirty them in a way that led to an inlined (compressed) first extent, which the g...
CVE-2026-68167 btrfs: do not try compression for data reloc inodes
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes BUG There is a syzbot report that the check inside getnewlocation triggered: BTRFS info device loop0: found 31 extents, stage: move data extents BTRFS info device loop0: leaf...
EUVD-2026-55553
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes BUG There is a syzbot report that the check inside getnewlocation triggered: BTRFS info device loop0: found 31 extents, stage: move data extents BTRFS info device loop0: leaf...
EUVD-2026-55552
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with...