1658 matches found
CVE-2026-10681 SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot
In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...
CVE-2026-10681
The CVE-2026-10681 issue affects Zephyr's userspace dynamic-objects subsystem. In thread_idx_alloc(), a new thread permission index is taken from _thread_idx_map[] without holding lists_lock. On SMP, concurrent k_object_alloc(K_OBJ_THREAD) calls can observe the same lowest free bit and perform a ...
CVE-2026-10681 SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot
In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...
CVE-2026-64262
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...
CVE-2026-64263
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...
UBUNTU-CVE-2026-64327
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...
UBUNTU-CVE-2026-64284
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...
EUVD-2026-48871
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...
CVE-2026-64327
The CVE-2026-64327 in the Linux kernel affects usb: gadget: f_fs. The vulnerability occurred because epfile->in was initialized only in ffs_func_eps_enable(), which runs after USB host connection. Early userspace IOCTLs could observe epfile->in as 0, causing incorrect DMA directions. The fi...
CVE-2026-64327 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...
EUVD-2026-48996
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...
CVE-2026-64284
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...
CVE-2026-64284 KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...
CVE-2026-64284
CVE-2026-64284 — Linux kernel (KVM/x86): The vulnerability involves moving the handling of fastpath userspace exits into vendor code so KVM can run vendor-specific operations before userspace gains control of the vCPU. The description notes that, for VMX (and soon SVM), KVM must flush the PML buf...
EUVD-2026-48992
In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afudmamapregion afuioctldmamap accepts a 64-bit length from userspace via DFLFPGAPORTDMAMAP ioctl without an upper bound check. The value is passed to afudmapinpages where npages is...
EUVD-2026-48979
In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...
CVE-2026-64263 fuse-uring: fix moving cancelled entry to ent_in_userspace list
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...
CVE-2026-64259
CVE-2026-64259 (Linux kernel, fuse-uring) : A race allowed a use-after-free in fuse-uring by letting a fuse_req on an SQE commit become findable after memcpy, if a malicious userspace sent commit SQEs before the request reached fuse-server. The fix reorders operations: moving fuse_uring_add_to_pq...
CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...
PT-2026-64548
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f fs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffs data got descs generates the eps addrmap which contains the endpoint direction. However, epfile-in was previous...