492389 matches found
EUVD-2026-71616
In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined pbools.nprim comes from the policy image independently of how many booleans follow it, and condindexbool fills boolvaltostruct at value - 1, so a count larger than the values...
CVE-2026-80913
CVE-2026-80913 affects the SELinux subsystem of the Linux kernel . The root cause is that p_bools.nprim in a loaded SELinux policy image can declare a count larger than the number of boolean values actually present, causing cond_index_bool() to leave NULL entries in bool_val_to_struct[]. Consumer...
CVE-2026-80912 selinux: reject an unclaimed class value in security_get_classes()
In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in securitygetclasses securitygetclasses sizes an array by pclasses.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. selmakeclasses passes every...
CVE-2026-80913 selinux: require every boolean value to be defined
In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined pbools.nprim comes from the policy image independently of how many booleans follow it, and condindexbool fills boolvaltostruct at value - 1, so a count larger than the values...
CVE-2026-80912
This Linux kernel vulnerability affects the SELinux subsystem in security_get_classes(). The function sizes an array by p_classes.nprim and fills entries at index value - 1, so a class value the policy never defines leaves a NULL entry. sel_make_classes() then passes every entry to sel_make_dir()...
CVE-2026-80913 selinux: require every boolean value to be defined
In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined pbools.nprim comes from the policy image independently of how many booleans follow it, and condindexbool fills boolvaltostruct at value - 1, so a count larger than the values...
CVE-2026-80912 selinux: reject an unclaimed class value in security_get_classes()
In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in securitygetclasses securitygetclasses sizes an array by pclasses.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. selmakeclasses passes every...
EUVD-2026-71614
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...
CVE-2026-80911 ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...
CVE-2026-80911 ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...
CVE-2026-80911
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sofwidgetsetupunlocked If either tplgops-daiconfig or widgetkcontrolsetup fail during widget setup we would double decrement the usecount of the widget because the sofwidgetfreeunlocked wou...
CVE-2026-80911
CVE-2026-80911 affects the Linux kernel ASoC SOF (Sound Open Firmware) audio driver. The vulnerability resides in the error path of sof_widget_setup_unlocked() . When either tplg_ops->dai_config or widget_kcontrol_setup fails during widget setup, sof_widget_free_unlocked() is called twice, cau...
CVE-2026-80910 ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four "WSA RX Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol-value.integer.value0 a long instead ...
EUVD-2026-71669
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four "WSA RX Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol-value.integer.value0 a long instead ...
CVE-2026-80910 ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four "WSA RX Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol-value.integer.value0 a long instead ...
CVE-2026-80910
CVE-2026-80910 affects the Linux kernel's lpass-wsa-macro ASoC codec driver. The root cause is that the get and put callbacks for the "EAR SPKR PA Gain" and four "WSA RX Mux" * enumerated controls access the value via ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enum...
CVE-2026-80910
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four "WSA RX Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol-value.integer.value0 a long instead ...
CVE-2026-80909 drm/amdgpu: Reject UVD message with invalid number of h265 refs
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5...
CVE-2026-80909 drm/amdgpu: Reject UVD message with invalid number of h265 refs
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5...
EUVD-2026-71668
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5...