355600 matches found
Linux kernel security vulnerabilities
A security vulnerability exists in the Linux kernel; it arises when reading the write-only HRST and CLIRQ registers triggers a command, causing a dump of regular registers to result in a reset of the development board...
PT-2026-121922
In the Linux kernel, the following vulnerability has been resolved: flow dissector: avoid u16 truncation of hlen in bpf flow dissect bpf flow dissect sanitizes the offsets returned by the BPF program with clamp tu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...
PT-2026-122050
In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inet dump fib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fib dump info fnhe uses fib info num pat...
PT-2026-122057
In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear inode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...
PT-2026-121917
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the HID steam component during the teardown sequence. A narrow timing window allows callbacks to be scheduled during cleanup, resulting in a dangling pointer to the free...
PT-2026-122048
In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fib alias hw flags set siz...
PT-2026-121906
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb get hash net in seg6 make flowlabel Since commit d58e468b1112 "flow dissector: implements flow dissector BPF hook" skb flow dissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee...
PT-2026-122026
In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm runtime get sync leaves the usage counter incremented even when it fails, and xgpio request returns the error without dropping it. gpiolib does not call -free when -reque...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 5.16. It stems from the ice driver’s use of metadatadstfree to release metadatadst when removing a representer; no checks are performed on the dstentry reference count. This may lead to use-after-free conditions if packets remain queued on...
PT-2026-121945
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the AMT Automatic Multicast Tunneling module. An socket buffer skb queued in a queuing discipline qdisc can outlive the tunnel it references via a raw...
PT-2026-121947
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4 bo cache destroy purges the cached BOs but never frees the size list, leaking it on every unbind...
PT-2026-121980
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthor drv.c:panthor ioctl group create, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.cou...
PT-2026-121989
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls iso sock connect checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check whil...
PT-2026-122008
In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br multicast sg del exclude ports removes automatically added STAR EXCL port groups by calling br multicast del pg. For S,G entries, that deletion calls back into br multicast s...
PT-2026-122033
In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strp recv isn't running before tearing down the parser The comment above strp done claims that if strp is stopped, strp recv will no longer be called. That's only true if the caller has a mechanism eg locking...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 4.20. It arises because bpfflowdissect fails to enforce hlen to U16MAX prior to clamping it when processing offsets returned by BPF programs. If hlen exceeds 65535, it is truncated to U16MAX, causing nhoff and thoff to be forced to zero. Thi...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 4.2. It stems from the mmc mtk-sd driver failing to properly cancel request timeouts upon removal; the timeout callback continues to access host-devcomp after mmchost is freed, allowing reuse of the device after release...
PT-2026-122041
In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso v4 skbuff delattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...
PT-2026-121957
In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. step into step into rechecks d seq and follow mount rcu rechecks mount lock. An entry that gets unlinked in between caus...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 7.0. It arises because statmountmntbasic reads a parent mount that has been unmounted while it does not hold a mountlock; in concurrent release scenarios, it may reference a released mount, leading to use-after-free conditions...