Lucene search
+L

151840 matches found

OSV
OSV
added 2026/09/11 7:45 p.m.5 views

CVE-2026-89632 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

6AI score
SaveExploits0References5
Debian CVE
Debian CVE
added 2026/09/11 7:45 p.m.7 views

CVE-2026-89632

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

8.2CVSS0.00318EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/09/11 7:45 p.m.27 views

CVE-2026-89632 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

8.2CVSS0.00318EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/11 7:45 p.m.13 views

CVE-2026-89632

CVE-2026-89632 is an out-of-bounds read in the Linux kernel's SMB client , specifically in the reparse_buf_ptr() function. The root cause is a use-before-check of ReparseDataLength (offset 4, 2 bytes): the value is read before verifying that the received buffer length (count) is at least the full...

8.2CVSS0.00318EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/11 7:45 p.m.7 views

EUVD-2026-76544

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

0.00318EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/11 7:45 p.m.4 views

CVE-2026-89631 smb: client: reject a tree connect response whose byte count is too small

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

6AI score
SaveExploits0References6
EUVD
EUVD
added 2026/09/11 7:45 p.m.6 views

EUVD-2026-76543

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

0.00448EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2026/09/11 7:45 p.m.7 views

CVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

9.1CVSS0.00448EPSS
SaveExploits0
CVE
CVE
added 2026/09/11 7:45 p.m.10 views

CVE-2026-89631

CVE-2026-89631 affects the Linux kernel SMB (CIFS) client . In CIFSTCon(), the strnlen() bound over the byte area uses the server's ByteCount minus two; when ByteCount is 0 or 1, the value underflows to a huge size_t, causing cifs_strndup_from_utf16() to read up to 65,535 bytes past the ~16 KB sl...

9.1CVSS0.00448EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/11 7:45 p.m.5 views

CVE-2026-89629 HID: corsair-void: Check size of status and firmware events before reading them

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...

6AI score
SaveExploits0References6
CVE
CVE
added 2026/09/11 7:45 p.m.10 views

CVE-2026-89628

A slab-out-of-bounds read vulnerability exists in the Linux kernel's hid_picolcd driver. The function picolcd_debug_eeprom_read() trusts a length byte supplied by the device in its REPORT_EE_DATA reply, clamping it only to the caller's read count but never checking resp->raw_size—the actual nu...

0.00209EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/09/11 7:45 p.m.24 views

CVE-2026-89629 HID: corsair-void: Check size of status and firmware events before reading them

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...

0.00198EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/09/11 7:45 p.m.7 views

EUVD-2026-76541

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...

0.00198EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/09/11 7:45 p.m.7 views

EUVD-2026-76540

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

0.00209EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/09/11 7:45 p.m.24 views

CVE-2026-89628 HID: picolcd: clamp eeprom debugfs read to bytes actually received

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

0.00209EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/11 7:45 p.m.10 views

CVE-2026-89629

CVE-2026-89629 affects the Linux kernel in the HID corsair-void driver . The root cause is an out-of-bounds read triggered by malformed status and firmware events whose size was not validated before being read. The fix adds a size check and emits a warning on unexpected values to prevent the read...

0.00198EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/11 7:45 p.m.6 views

CVE-2026-89628 HID: picolcd: clamp eeprom debugfs read to bytes actually received

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

6.1AI score
SaveExploits0References7
EUVD
EUVD
added 2026/09/11 7:45 p.m.7 views

EUVD-2026-76533

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

0.00209EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/09/11 7:45 p.m.24 views

CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

0.00209EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/11 7:45 p.m.7 views

CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

6.1AI score
SaveExploits0References7
Rows per page
Query Builder