356024 matches found
kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
A flaw was found in the Linux kernel's Server-Message-Block Direct SMC-D client. A remote attacker can exploit this vulnerability by sending a specially crafted SMC-Dv2 proposal with a Channel Identifier CHID of 0. This malicious proposal can cause a null pointer dereference in the kernel's SMC...
kernel: xfs: bounds-check buffer log item's dirty bitmap
A flaw was found in the Linux kernel's XFS filesystem. A local attacker, by mounting a specially crafted XFS image, could trigger an out-of-bounds write during log recovery. This vulnerability allows for kernel heap corruption, which could lead to a denial of service or potentially arbitrary code...
CVE-2026-98728
A flaw was found in the Linux kernel's Trusted Platform Module TPM driver. This flaw can lead to information disclosure when the kernel requests random data. Due to an incorrect bounds check when processing session-tagged responses, a truncated response can pass validation and cause the kernel to...
CVE-2026-98726
A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express multipath subsystem. A malicious NVMe device can provide crafted Asymmetric Namespace Access ANA log data that triggers an integer underflow during buffer bounds validation. This failure leads to an out-of-bounds memory read,...
CVE-2026-98730
A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. A local user with access to the Bluetooth Host Controller Interface HCI user channel can inject an oversized transmission packet. Because the driver fails to validate packet length before copying data into a fixed-size memory...
CVE-2026-98727
A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express multipath subsystem. The multipath driver inappropriately marks a storage device as supporting zoned storage before confirming its zone configuration. When a device reports a zone size of zero, subsequent read or write...
CVE-2026-98729
A flaw was found in the Linux kernel. On systems utilizing specific AMD processors, improper virtual address alignment for huge page memory mappings can allow a local user to cause a Denial of Service DoS. When unmapping these misaligned memory ranges during teardown, the kernel encounters an...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.17. It stems from mntchangemountpoint failing to reset the -overmount of an old parent mount, leading to null pointers and use-after-free conditions, which may result in memory corruption...
Linux kernel security vulnerabilities
Security vulnerabilities exist in Linux kernel versions prior to 6.18.53 and 7.2.7 for versions 6.18.53 through 6.18.56, as well as in versions prior to 7.2.7 for versions 7.2.7 through 7.2.10. These vulnerabilities arise from unnecessary copying of PMD pages during page table release; holding...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.17. It arises because attachrecursivemnt fails to check for the top-level mount during traversal of the mount chain; when the top-level mount is a mount namespace file, it incorrectly attaches a copy of that mount, potentially leading to...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.8. It stems from the axienet driver failing to release unfinished DMA buffers when dmaengine is disabled, resulting in a leak of SKB and its DMA mappings. This may exhaust the limited IOMMU address space, and there is also a race condition...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.13. It stems from btrfs failing to release iouring encoded data when returning -EAGAIN, resulting in memory leaks that occur during request cancellation or when the ring exits before being re-submitted...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.6. It arises because when mlxswspflowertmpltcreate parses the flowclsoffload template, it can obtain the port range register via mlxswspflowerparseportsrange, but this register is not released by mlxswspaclruleidestroy. As a result, the po...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.12. It arises because when encountering an unreadable fragment, skbcopyandcsumbits copies only the linear portion and then returns 0, leaving unfilled parts in the caller’s buffer. This may result in residual bytes from memory being...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel versions 6.1.110 through 6.2 and earlier. It arises because ofregulatorbulkgetall fails to populate the supply name when allocating an array, causing regulatorbulkenable to dereference uninitialized memory upon failure to enable supplies...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel versions 6.5.3 through 6.6 and 6.6. This vulnerability arises because userregsetcopyin only copies count bytes; as a result, a PTRACESETREGSET request with a short iovlen causes the remaining portion of the stack buffer to remain uninitialized...
PT-2026-121995
In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIG SHADOW CALL STACK, handle exception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision wit...
PT-2026-121913
Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.19 through 7.2 Description A flaw exists in the ext4 file system where enabling the encrypt feature on a mounted filesystem bypasses checks for large folio incompatibilities. When writing encrypted data under these...
PT-2026-122034
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet fill frags fails When a response chain has more slots than fit in the skb's frags, xennet fill frags returns an error and xennet poll jumps to its error path. That path moves what's le...
PT-2026-121991
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci sync: Fix command skb lifetime during scan setup During PA sync scan setup, hci le set ext scan param sync gets the address used for the PA LINK lookup from hci sent cmd data. The returned pointer borrows storage...