340531 matches found
kernel: xfrm: hold dev ref until after transport_finish NF_HOOK
A flaw was found in the Linux kernel's xfrm IP eXtensible FRamework subsystem. This vulnerability involves a race condition where a network device's reference is released too early during packet processing after asynchronous cryptography. This premature release can lead to the system attempting t...
kernel: xfrm: input: hold netns during deferred transport reinjection
A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespa...
kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate()
A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface VTI module. When a VTI tunnel device is moved to a different network environment, an unprivileged user in a separate user space can manipulate tunnel parameters. This manipulation could allow the user to intercept or redirect...
CVE-2026-43494-PinTheft-PoC
SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...
Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's-nocbcbkthread pointer bsc1254408. CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued...
SUSE-SU-2026:4660-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's-nocbcbkthread pointer bsc1254408. - CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queu...
kernel: openvswitch: defer tunnel netdev_put to RCU release
A flaw was found in the Linux kernel's Open vSwitch OVS component. A race condition can occur during the destruction of a network device netdev tunnel, where the ovsnetdevtunneldestroy function may attempt to release a device reference while other parts of the system are still actively using it...
kernel: ipv6: validate extension header length before copying to cmsg
A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure...
kernel: wifi: mac80211: defer link RX stats percpu free to RCU
A flaw was found in the mac80211 Wi-Fi driver of the Linux kernel. When an MLO Multi-Link Operation link is removed, the RX statistics per-CPU buffer is freed immediately, while the link container is deferred to RCU Read-Copy-Update. This timing issue can lead to a use-after-free vulnerability,...
kernel: cifs: validate DFS referral string offsets
A flaw was found in the Linux kernel's CIFS component. A remote attacker could exploit this vulnerability by providing a specially crafted Distributed File System DFS referral. The system fails to properly validate string offsets within these referrals, which can lead to an out-of-bounds read. Th...
kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound
A flaw was found in the drm/vmwgfx component of the Linux kernel. An integer overflow vulnerability exists in the vmwshaderdefine function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around...
kernel: drm/amdgpu/vce: fix integer overflow in image size
A flaw was found in the drm/amdgpu/vce component of the Linux kernel. Malicious VCE Video Codec Engine command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead...
kernel: drm/amd/display: set new_stream to NULL after release
A flaw was found in the Linux kernel's drm/amd/display component. Specifically, within the dmupdatecrtcstate function, a stream pointer is released but not subsequently set to NULL. This can lead to a double release of the same pointer if an error occurs later in the process, creating a...
kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation
A flaw was found in the Linux kernel's DisplayPort DP Multi-Stream Transport MST subsystem. This vulnerability involves multiple buffer overflows within the drmdpsidebandappendpayload function when handling data from connected devices. A physically connected, malicious DP MST device can exploit...
kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension
A flaw was found in the Linux kernel's drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler MES fails to perform a necessary Translation Lookaside Buffer TLB invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access...
kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation
A flaw was found in the Linux kernel's DisplayPort DP Multi-Stream Transport MST subsystem. This vulnerability involves multiple buffer overflows within the drmdpsidebandappendpayload function when handling data from connected devices. A physically connected, malicious DP MST device can exploit...
kernel: wifi: mac80211: defer link RX stats percpu free to RCU
A flaw was found in the mac80211 Wi-Fi driver of the Linux kernel. When an MLO Multi-Link Operation link is removed, the RX statistics per-CPU buffer is freed immediately, while the link container is deferred to RCU Read-Copy-Update. This timing issue can lead to a use-after-free vulnerability,...
kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension
A flaw was found in the Linux kernel's drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler MES fails to perform a necessary Translation Lookaside Buffer TLB invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access...
kernel: drm/amdgpu/vce: fix integer overflow in image size
A flaw was found in the drm/amdgpu/vce component of the Linux kernel. Malicious VCE Video Codec Engine command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead...
kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound
A flaw was found in the drm/vmwgfx component of the Linux kernel. An integer overflow vulnerability exists in the vmwshaderdefine function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around...