177372 matches found
CVE-2026-72478
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose...
CVE-2026-72476
In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dmareleasechannel, check chan-device-privatecnt after call dmachanput. However, dmachanput call dmadeviceput which could release the last reference of the device if the DMA provider is...
CVE-2026-72475
In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: Properly free struct axidmacdesc Use axidmacfreedesc to free fully the descriptor at fail path when call axidmacallocdesc in axidmacprepperipheraldmavec...
CVE-2026-72474
In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor For architectures like Microblaze or arm64 where this IP is used, DMADIRECTREMAP is set which means that dmaalloccoherent might remap and hence vmalloc some memory...
CVE-2026-72473
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rlkref formerly served two distinct lifetimes through a single refcount: it gated when a Reply could wake its RPC task, and it gated when an rpcrdmareq could return to its free...
CVE-2026-72471
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent potential lcn remains uninitialized The target VCN being sought was not found within runs0, causing runlookup to return false. This causes runlookupentry to return false, which in turn results in a len value of ...
CVE-2026-72469
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDRCHANGE rpcrdmacmeventhandler falls through to the disconnected: label on RDMACMEVENTADDRCHANGE and calls rpcrdmaepput with no matching get when the event arrives before RDMACMEVENTESTABLISHE...
CVE-2026-72468
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize reid before removal registration rpcrdmacreateid registers ep-rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate. However rpcrdmaepcreate currently stores that pointer in...
CVE-2026-72467
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwrwpcreate during connect frwrwpcreate creates the singleton Memory Region used to encode padding for Write chunks whose payload length is not XDR-aligned. Its failure paths return a negative errno and leave...
CVE-2026-72466
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdmaisbcall decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply leak the receive buffer...
CVE-2026-72465
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The outnorqst exit in rpcrdmareplyhandler branches away before the credit clamp, so a reply that matches no pending request reaches outpost carrying the raw credit value...
CVE-2026-72464
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdmawcreceive decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdmareplyhandler. The handler must post a...
CVE-2026-72463
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb-dev refcnt until after transportfinish. However, xfrmrcvcb may modify skb-dev to tunnel dev without taking device reference, such as vtircvcb. T...
EUVD-2026-59361
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peerpath is used The holding a reference to the peersk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows for a race with...
CVE-2026-72462 apparmor: fix race in unix socket mediation when peer_path is used
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peerpath is used The holding a reference to the peersk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows for a race with...
CVE-2026-72462 apparmor: fix race in unix socket mediation when peer_path is used
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race in unix socket mediation when peerpath is used The holding a reference to the peersk is not enough to ensure access to the peer sk path. Accessing the path outside of the state lock allows for a race with...
CVE-2026-72461
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the skctx Currently updateskctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the referenc...
CVE-2026-72462
The CVE-2026-72462 entries describe a race in AppArmor unix socket mediation on Linux kernels where holding a reference to peer_sk is insufficient to guarantee access to the peer path. The race occurs when accessing the peer path outside the state lock, potentially conflicting with unix_release_s...
CVE-2026-72460
In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before nonewprivs test aachangeprofile builds a replacement label with fnlabelbuildinscope before the nonewprivs subset check. The build helper can fail and return NULL or an ERRPTR, but the result was...