356082 matches found
CVE-2026-99227
A flaw was found in the Linux kernel's iouring subsystem. A local attacker can repeatedly issue cancellation requests for asynchronous waitid operations, causing an internal reference counter to overflow and wrap to zero. This flaw leads to a use-after-free memory corruption condition, potentiall...
eBPF-hid_guard
eBPF-hidguard See Why This Was Archived below. A Linux kernel-space security monitor for detecting and blocking HID injection attacks Rubber Ducky, O.MG Cable, ESP32-based keyboard emulators using eBPF HID-BPF structops. What This Does Malicious HID devices emulate keyboards and inject keystrokes...
kernel: ALSA: usx2y: bound the hwdep mmap fault offset
A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...
kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps
A flaw was found in the libceph component of the Linux kernel. A remote attacker could send a specially crafted monitor map monmap that advertises zero monitors. This malformed monmap is incorrectly processed as valid, which can lead to a client crash when attempting to open a session. This...
kernel: ipvs: reload ip header after head reallocation
A flaw was found in the Linux kernel's IP Virtual Server IPVS module. When processing network packets, a buffer reallocation can leave an IP header pointer referencing freed memory. An attacker could exploit this use-after-free condition to cause a Denial of Service DoS by crashing the system or...
kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat()
A flaw was found in the Linux kernel's procfs component. When reading /proc/pid/stat, the dotaskstat function accesses task-realparent without proper Read-Copy-Update RCU protection. This missing protection creates a race condition, which can lead to a Use-After-Free UAF vulnerability. A local...
kernel: nvme-tcp: fix host memory disclosure on R2T for a read command
A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...
kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap
A flaw was found in libceph in the Linux kernel. A remote attacker, acting as a malicious monitor, could send a specially crafted OSDMap Object Storage Device Map with an overly long pgtemp or pgupmap entry. This could lead to a stack out-of-bounds write, resulting in a kernel bug and potentially...
kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
A flaw was found in the Linux kernel's NVMe over TCP target nvmet-tcp implementation. When a data digest mismatch is detected, nvmetrequninit is called unconditionally, but if the command was already in the INITFAILED state, the matching percpureftrygetlive was never performed. The resulting...
kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period
A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol TCP connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could explo...
kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange [email protected] says: The vulnerability is a race condition between etsqdiscdequeue and etsqdiscchange. It leads to UAF on stru...
kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update
A flaw was found in the libceph component of the Linux kernel. During an authorizer update, if the authorizer is rebuilt, a stale pointer to a freed memory region can be retained. A remote attacker could exploit this by triggering a specific network reconnection, leading to a use-after-free...
kernel: ipvs: do not propagate one-packet flag to synced conns
A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When a synced connection is established, it can incorrectly inherit a "one-packet" flag from its destination. This misconfiguration causes the connection's expiry process to mishandle its cleanup, leaving behind stale memory...
CVE-2026-99248
In the Linux kernel, the following vulnerability has been resolved: i2c: xiic: restore non-managed runtime PM to fix clk WARN flood The devres conversion replaced manual pmruntimeenable/disable with devmpmruntimesetactiveenabled and dropped the remove-time runtime PM teardown. The managed release...
CVE-2026-99259
In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix uninitialised clock rate For legacy 32-bit Tegra devices, the warning in the tegrapmcentersuspendmode function is being triggered because the earlypmc-rate variable is never configured and hence, always 0. Thi...
CVE-2026-99250
In the Linux kernel, the following vulnerability has been resolved: printk: Postpone kthread startup There have been various bug reports related to SMP systems hanging on boot. The reports vary but seem to have some overlap with regard to missed IPI's during SMP setup. The reports also show that...
CVE-2026-99244
In the Linux kernel, the following vulnerability has been resolved: pidnamespace: prevent TIFNOTIFYSIGNAL from interrupting the reaper Since commit 7fea700e04bd "zappidnsprocesses: clear TIFNOTIFYSIGNAL along with TIFSIGPENDING" zappidnsprocesses clears TIFNOTIFYSIGNAL before every kernelwait4...
CVE-2026-99246
In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipcnoderesetlinks trace event asks tipcnodedump to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock...
CVE-2026-99256
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rwsemaphore for backgroundworklock. Write locks on rwsemaphores have strict owner semantics, but there was no guarantee that the process that locked...