1859 matches found
CVE-2026-74384
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...
CVE-2026-74383
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools nvmesetupdescriptorpools indexes dev-descriptorpools using the numanode forwarded from hctx-numanode by its single caller, nvmeinithctxcommon. On a non-NUMA kernel...
CVE-2026-74361
In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdpidx when it equals n i.e. NUMFDPC + 1...
CVE-2026-72129
In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...
CVE-2026-72130
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...
CVE-2026-72131
In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...
EUVD-2026-59531
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...
CVE-2026-74384
CVE-2026-74384 (Linux kernel) : The nvme-multipath path handling has a bug in how the flexible array member current_path[] is allocated and indexed. The code allocates the nvme_ns_head with space for num_possible_nodes() entries but then uses numa_node_id() to index current_path[], which can be s...
CVE-2026-74384 nvme-multipath: fix flex array size in struct nvme_ns_head
In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...
CVE-2026-74383 nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools nvmesetupdescriptorpools indexes dev-descriptorpools using the numanode forwarded from hctx-numanode by its single caller, nvmeinithctxcommon. On a non-NUMA kernel...
EUVD-2026-59530
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools nvmesetupdescriptorpools indexes dev-descriptorpools using the numanode forwarded from hctx-numanode by its single caller, nvmeinithctxcommon. On a non-NUMA kernel...
CVE-2026-74383
CVE-2026-74383 relates to the Linux kernel NVMe subsystem: nvme_setup_descriptor_pools() can index descriptor_pools[] with hctx->numa_node, which becomes UINT_MAX when hctx->numa_node is NUMA_NO_NODE (-1) in non-NUMA kernels. This out-of-bounds access leads to a fault during nvme_alloc_ns()...
CVE-2026-74361
In the Linux kernel, the NVMe subsystem had a bounds-check bug in FDP fdpcidx. The code sets n = NUMFDPC + 1 but uses a > comparison instead of >=, which incorrectly accepts fdp_idx when it equals NUMFDPC + 1. This is a concrete root-cause detail found across multiple connected sources, ind...
EUVD-2026-59508
In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdpidx when it equals n i.e. NUMFDPC + 1...
CVE-2026-74361 nvme: fix FDP fdpcidx bounds check
In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdpidx when it equals n i.e. NUMFDPC + 1...
EUVD-2026-58889
In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...
CVE-2026-72131 nvme-apple: Prevent shared tags across queues on Apple A11
In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...
CVE-2026-72131
CVE-2026-72131 documents a Linux kernel vulnerability, affecting the nvme-apple driver on Apple A11. The issue is that tags for pending commands must be unique across admin and IO queues; sharing tags can crash the firmware with a message like “duplicate tag error for tag N.” The root cause is th...
CVE-2026-72130
Technical details are not publicly available in the provided documents. Monitor for updates from vendors and security bulletins.
CVE-2026-72130 nvmet-auth: reject short AUTH_RECEIVE buffers
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTHRECEIVE buffers nvmetexecuteauthreceive trusts the AUTHRECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default states, th...