320 matches found
CVE-2026-64164 btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: fix sleep while in atomic context in btrfssyncfile The trace event btrfssyncfile is called in an atomic context all trace events are and its call to dput, which is needed due to the call to dgetparent, can...
CVE-2026-63910
The CVE-2026-63910 entry describes a Linux kernel vulnerability in dma-buf: a slab-use-after-free (UAF) in the dma_buf_fd() tracepoint. The fault arises because FD_ADD() leaves the allocated file descriptor live in the table; a racing thread can close() the fd before the DMA_BUF_TRACE() tracepoin...
CVE-2026-63910 dma-buf: fix UAF in dma_buf_fd() tracepoint
In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...
CVE-2026-63910
In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...
CVE-2026-63910 dma-buf: fix UAF in dma_buf_fd() tracepoint
In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...
EUVD-2026-45683
In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...
CVE-2026-63800
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...
CVE-2026-63800 pNFS: Fix use-after-free in pnfs_update_layout()
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...
EUVD-2026-45466
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...
CVE-2026-63800 pNFS: Fix use-after-free in pnfs_update_layout()
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...
CVE-2026-63800
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...
CVE-2026-63800
CVE-2026-63800 — Linux kernel (pNFS use-after-free) Affected: kernel code handling pnfs_update_layout() for NFS_LAYOUT_RETURN.Cause: If pnfs_prepare_to_retry_layoutget(lo) succeeds, pnfs_put_layout_hdr(lo) runs before trace_pnfs_update_layout(), while the tracepoint still references the structure...
CVE-2026-63800
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...
PT-2026-61227
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the dma buf fd tracepoint. This occurs because a thread sharing the file descriptor table can call close after FD ADD returns but before DMA BUF TRACE...
PT-2026-61116
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the pNFS component. When the NFS LAYOUT RETURN branch is triggered within the pnfs update layout function, the system calls pnfs prepare to retry...
net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
...
SUSE CVE-2026-52941
In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid NULL deref of conn-lnk in smcmsgevent tracepoint The smcmsgevent tracepoint class, shared by smctxsendmsg and smcrxrecvmsg, unconditionally dereferences smc-conn.lnk: stringname, smc-conn.lnk-ibname conn-lnk is onl...
CVE-2026-52941
A flaw was found in the Linux kernel's net/smc module. An unprivileged local user could trigger a null pointer dereference by performing sendmsg or recvmsg operations on an SMC-D Shared Memory Communications - Direct socket while the smcmsgevent tracepoint is enabled. This can lead to a general...
CVE-2026-52941
In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid NULL deref of conn-lnk in smcmsgevent tracepoint The smcmsgevent tracepoint class, shared by smctxsendmsg and smcrxrecvmsg, unconditionally dereferences smc-conn.lnk: stringname, smc-conn.lnk-ibname conn-lnk is onl...
CVE-2026-52941
In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid NULL deref of conn-lnk in smcmsgevent tracepoint The smcmsgevent tracepoint class, shared by smctxsendmsg and smcrxrecvmsg, unconditionally dereferences smc-conn.lnk: stringname, smc-conn.lnk-ibname conn-lnk is onl...