1691 matches found
CVE-2026-72486
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...
UBUNTU-CVE-2026-72486
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...
CVE-2026-72045
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvumboxhandlerlmtsttblsetup uses req-basepcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into th...
CVE-2026-74389
Summary: CVE-2026-74389 affects the Linux kernel RDMA driver for HNS (hns_roce). When hns_roce_cmd_mbox() fails, the error path could flood logs due to unlimited ibdev_err/ibdev_warn outputs, potentially leading to a system crash. The fix replaces the non-limited error prints with ratelimited ver...
CVE-2026-72486 mailbox: mtk-adsp: fix UAF during device teardown
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...
CVE-2026-72486
The CVE-2026-72486 entry concerns the Linux kernel mailbox for the mtk-adsp (SOF audio) where a use-after-free (UAF) can occur during device teardown. When the SOF driver fails to initialize (e.g., firmware boot timeout), devres unwinds and frees snd_sof_dev, while the mtk_adsp_mailbox shutdown c...
EUVD-2026-59385
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...
CVE-2026-72045 octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvumboxhandlerlmtsttblsetup uses req-basepcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into th...
EUVD-2026-59003
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvumboxhandlerlmtsttblsetup uses req-basepcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into th...
CVE-2026-72045
CVE-2026-72045 : In the Linux kernel (octeontx2-af: cn10k), a VF could access another function’s LMTLINE via rvu_mbox_handler_lmtst_tbl_setup() using base_pcifunc as a direct index into the LMT map. The issue arises because base_pcifunc is not sanitized and is not bounded to the VF’s PF, allowing...
CVE-2026-72045 octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvumboxhandlerlmtsttblsetup uses req-basepcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into th...
PT-2026-72674
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the snd sof dev object that the mailbox client mtk-adsp-ipc reaches via chan-cl-r...
PT-2026-72234
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the octeontx2-af driver where the rvu mbox handler lmtst tbl setup function uses the req-base pcifunc payload field as a direct index into the LMT map table. Because...
CVE-2026-68330
A flaw was found in the Linux kernel's airoha network driver. This vulnerability arises from an incorrect configuration of Direct Memory Access DMA for the Network Processing Unit NPU mailbox buffer. Specifically, the system incorrectly maps the buffer for data transfer only to the device, even...
UBUNTU-CVE-2026-68330
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...
CVE-2026-68330 net: airoha: Fix DMA direction for NPU mailbox buffer
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...
EUVD-2026-55431
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...
CVE-2026-68330 net: airoha: Fix DMA direction for NPU mailbox buffer
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix DMA direction for NPU mailbox buffer airohanpusendmsg always maps the mailbox buffer with DMATODEVICE, but some callers expect the NPU to write response data back into the same buffer: - airohanpuwlanmsgget...
CVE-2026-68330
CVE-2026-68330 relates to the Linux kernel net/airoha NPU mailbox handling. The issue arises because airoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE, while some callers expect the NPU to write the response back into the same buffer. On non‑cache‑coherent architectures (e.g...
Security Bulletin: IBM Sterling Global Availability Mailbox is affected by a vulnerability in Cassandra Reaper 4.0
Summary IBM Sterling Global Availability Mailbox uses Cassandra Reaper 4.0, which is affected by privilege escalation CVE-2026-27314 and resource consumption CVE-2026-32588 vulnerabilities. Vulnerability Details CVEID:CVE-2026-27314 DESCRIPTION: Privilege escalation in Apache Cassandra 5.0 on an...