356247 matches found
No title provided
A flaw was found in the Linux kernel. A race condition exists where a seccomp filter, intended to restrict system calls, can be bypassed by an unprivileged process. This occurs when a thread is stopped for tracing ptrace and another thread attempts to apply a seccomp filter with the...
kernel: kernel: privilege escalation via missing shared fragment flag in skb_zerocopy
A flaw was found in the Linux kernel. A local unprivileged user could exploit this flaw to achieve privilege escalation by modifying read-only files cached in memory. The issue occurs because the networking subsystem fails to preserve shared memory indicators when transferring network data buffer...
kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload
A flaw was found in the Linux kernel's iSCSI target component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted login payload to an iSCSI portal configured for Challenge-Handshake Authentication Protocol CHAP. This can lead to an out-of-bounds read,...
kernel: xfrm: hold net_device reference under RCU in bundle creation
A flaw was found in the Linux kernel's IPsec XFRM networking subsystem. A race condition occurs when creating policy bundles while a network device is concurrently removed, leading to a use-after-free condition where the kernel accesses already-freed device memory. A local attacker can exploit th...
kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
A flaw was found in the Linux kernel's NVMe over Fabrics NVMe-oF target authentication component. A remote attacker connecting to the NVMe target service can exploit this vulnerability by sending a crafted authentication request, causing a Denial of Service DoS through a system crash or potential...
kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache
A flaw was found in the Linux kernel, specifically within the x86/CPU/AMD Zen2's op cache. This vulnerability arises from improper isolation of shared resources, which can lead to instruction corruption. The consequence of this flaw is that it may cause unexpected behavior or instability within t...
kernel: tipc: require net admin for TIPCv2 netlink mutators
A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC version 2 component. This vulnerability allows a local unprivileged attacker to bypass administrative permission checks when performing network link operations. Consequently, the attacker can modify critical TIPC...
kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir
A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...
kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability
A flaw was found in the Linux kernel's Point-to-Point Protocol PPP over L2TP Layer 2 Tunneling Protocol implementation. An unprivileged user can exploit a Use-After-Free UAF vulnerability, where the system attempts to use memory after it has been freed. This can lead to memory corruption,...
kernel: virtio-fs: avoid double-free on failed queue setup
A flaw was found in the Linux kernel's virtio-fs file system driver. When queue initialization fails—such as when a device advertises more request queues than supported—the driver fails to clear memory pointers after releasing them, resulting in a double-free condition during error cleanup. An...
kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
A flaw was found in the Linux kernel's fsl-lpspi driver. This vulnerability occurs when the transmit TX Direct Memory Access DMA channel fails to prepare, but the receive RX DMA channel continues to operate. This can lead to memory corruption or a use-after-free condition, potentially allowing an...
kernel: tipc: require net admin for TIPCv2 netlink mutators
A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC version 2 component. This vulnerability allows a local unprivileged attacker to bypass administrative permission checks when performing network link operations. Consequently, the attacker can modify critical TIPC...
kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
A flaw was found in the Linux kernel's iSCSI target core. This use-after-free vulnerability occurs in the corescsi3emulateproregisterandmove function. When processing iSCSI TransportIDs, a memory buffer is prematurely unmapped while still being referenced, particularly when the parameter list spa...
kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir
A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...
kernel: kernel: privilege escalation via missing shared fragment flag in skb_zerocopy
A flaw was found in the Linux kernel. A local unprivileged user could exploit this flaw to achieve privilege escalation by modifying read-only files cached in memory. The issue occurs because the networking subsystem fails to preserve shared memory indicators when transferring network data buffer...
kernel: ipvs: clear the svc scheduler ptr early on edit
A flaw was found in the Linux kernel's IP Virtual Server IPVS component. During the ipvseditservice operation, the svc-scheduler pointer is cleared too late when unbinding an old scheduler. This improper handling allows packets to access previously freed scheduler data, leading to a use-after-fre...
kernel: packet: use consistent hard_header_len in non-ring send paths
An out-of-bounds write problem was observed in packetsendmsgspkt in net/packet/afpacket.c in the Linux Kernel. In this flaw, AFPACKET hardheaderlen race may allow local privilege escalation...
kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload
A flaw was found in the Linux kernel's iSCSI target component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted login payload to an iSCSI portal configured for Challenge-Handshake Authentication Protocol CHAP. This can lead to an out-of-bounds read,...
kernel: Bluetooth: mgmt: fix UAF in pair command cancellation
A flaw was found in the Linux kernel's Bluetooth management mgmt component. A race condition exists during the cancellation of a pairing command and the handling of pairing completion or authentication failure callbacks. This race condition can lead to a use-after-free vulnerability, which may...
kernel: mptcp: options: reset DSS fields in case of unexpected size
A flaw was found in the Linux kernel's Multipath TCP mptcp implementation. A remote attacker could send specially crafted Data Sink Selection DSS options with an unexpected size. This could lead to data inconsistency or the access of uninitialized data, potentially resulting in information...