50232 matches found
CVE-2026-68359
The CVE-2026-68359 entry concerns the Linux kernel hwmon driver for nzxt-smart2. A race occurs because hid_hw_stop() does not halt device IO, allowing hid_input_report() to race with the code after hid_device_io_start() in the driver probe. If probe fails after IO start, this can lead to a Use-Af...
CVE-2026-68350 wifi: carl9170: fix OOB read from off-by-two in TX status handler
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170txprocessstatus uses i cmd-hdr.len / 2 + 1 which is off by two, allowing 2 extra iterations past valid txstatus entries when the...
EUVD-2026-55417
In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...
CVE-2026-68295
In the Linux kernel, LoongArch BPF ALU32 division/modulo results were sign-extended in the JIT, causing upper 32 bits to be set while verifier/interpreter assume zero-extension. The issue arises when signed ALU32 BPF_DIV/BPF_MOD (off=1) produce a negative quotient/remainder, leaving bits 63:32 se...
CVE-2026-68293 net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords 128 bytes when the device advertises the mcia32dwords capability, but struct mlx5ifcmciaregbits only defines dword0..11,...
CVE-2026-68293
Summary (CVE-2026-68293) : A Linux kernel vulnerability in the net/mlx5 driver allows a buffer overflow when reading the MCIA register on devices advertising the mcia_32dwords capability. The function mlx5_query_mcia() may copy more bytes than the allocated output buffer, due to a mismatch betwee...
EUVD-2026-55394
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords 128 bytes when the device advertises the mcia32dwords capability, but struct mlx5ifcmciaregbits only defines dword0..11,...
CVE-2026-68277
The CVE-2026-68277 entry concerns Linux kernel DRM/DP/MST sideband reply parsers where three 16-bit reads check bounds after reading, risking out-of-bounds access (idx == curlen). A fix was applied: pre-check using a single combined condition (idx + 2 > curlen) before each 2-byte read. Affecte...
CVE-2026-68277 drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...
EUVD-2026-55351
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.2: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit ae658afc7f47f6147371ec42cc6b1a793dfdb5af...
EUVD-2026-55348
In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: range check LFP Data Block paneltype2 While the paneltype from LFP Data Block is range checked, paneltype2 is not. Add a few helpers for range checking, and use them to not only check paneltype2, but also improve...
CVE-2026-68247 drm/i915/bios: range check LFP Data Block panel_type2
In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: range check LFP Data Block paneltype2 While the paneltype from LFP Data Block is range checked, paneltype2 is not. Add a few helpers for range checking, and use them to not only check paneltype2, but also improve...
CVE-2026-68247
The CVE-2026-68247 entry concerns the Linux kernel DRM i915 BIOS code where panel_type2 lacked a range check in the LFP Data Block, though panel_type was checked. The fix introduces range-checking helpers and uses them to validate panel_type2 and to improve clarity and correctness in panel type s...
CVE-2026-68129 gve: fix Rx queue stall on alloc failure
In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When the system is under extreme memory pressure, page allocations can fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low thresho...
CVE-2026-32227
SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue...
h2: Duplicate Host header could facilitate request smuggling
Impacth2 =4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive CWE-444...
CVE-2026-32227
SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue...
EUVD-2026-55251
Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation
Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...