268017 matches found
EUVD-2026-76663
In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...
CVE-2026-89751
CVE-2026-89751 is an off-by-one error in the Linux kernel's x86 TDX (Trusted Domain Extensions) port I/O handling. The functions handle_in() and handle_out() in arch/x86/coco/tdx/tdx.c compute a bitmask using GENMASK(BITS_PER_BYTE * size, 0). Since GENMASK(h, l) includes bit h , this produces a m...
CVE-2026-89751 x86/tdx: Fix off-by-one in port I/O handling
In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...
CVE-2026-89751
In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...
CVE-2026-89751 x86/tdx: Fix off-by-one in port I/O handling
In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...
CVE-2026-89750 tracing/user_events: Clear copied tracing state before fork duplication
In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...
EUVD-2026-76662
In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...
CVE-2026-89750 tracing/user_events: Clear copied tracing state before fork duplication
In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...
CVE-2026-89750
CVE-2026-89750 is a Use-After-Free vulnerability in the Linux kernel's tracing/user_events subsystem. During fork, dup_task_struct() copies the user_event_mm pointer from the parent into the child without acquiring a reference. If user_event_mm_alloc() subsequently fails, the stale pointer is lef...
CVE-2026-89750
In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...
CVE-2026-89749 tracing: Fix crash passing ERR_PTR to kthread_stop()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...
CVE-2026-89748 tracing: Fix retry exhaustion in simple ring buffer reader swap
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...
EUVD-2026-76661
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...
CVE-2026-89749 tracing: Fix crash passing ERR_PTR to kthread_stop()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...
CVE-2026-89749
CVE-2026-89749 affects the Linux kernel tracing subsystem. In event_test_stuff(), the result of kthread_run() is unconditionally passed to kthread_stop(). When kthread_run() fails — for example returning ERR_PTR(-ENOMEM) under memory pressure during the boot-time event self-test — kthread_stop() ...
CVE-2026-89748 tracing: Fix retry exhaustion in simple ring buffer reader swap
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...
CVE-2026-89748
CVE-2026-89748 is a logic error in the Linux kernel's tracing subsystem, specifically in simple_ring_buffer_swap_reader_page(). The function's retry counter is post-decremented only after a failed link replacement, so on the final attempt a successful replacement leaves retry at zero while a fail...
EUVD-2026-76660
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...
CVE-2026-89749
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash passing ERRPTR to kthreadstop eventteststuff calls kthreadrun and unconditionally passes the returned taskstruct pointer to kthreadstop. kthreadrun returns an error pointer such as ERRPTR-ENOMEM when kthread...
CVE-2026-89748
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...