263581 matches found
CVE-2026-72091 accel/amdxdna: reject user command submission without a command BO
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...
CVE-2026-72090
CVE-2026-72090 affects the Linux kernel component accel/amdxdna. The root cause is in the ioctl flow for SYNC_DIRECT_FROM_DEVICE: amdxdna_drm_sync_bo_ioctl() looked up args->handle in the caller’s drm_file and then invoked amdxdna_hwctx_sync_debug_bo() with abo->client. The function uses th...
CVE-2026-72087
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfcsli4driverresourcesetup The memory allocated for mboxq using mempoolalloc is not freed in some of the early exit error paths. Fix that by moving the mempoolfree call to an earlier point after la...
CVE-2026-72066 cpu: hotplug: Bound hotplug states sysfs output
In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states, this can write past the end of the PAGESIZE buffer. Use sysfsemitat ...
CVE-2026-72066
CVE-2026-72066 affects the Linux kernel: cpu: hotplug bound hotplug states sysfs output. The issue arises when states_show() writes CPU hotplug state names into a single sysfs buffer with sprintf(), which can overflow the PAGE_SIZE buffer when many states are registered. The documented fix is to ...
CVE-2026-72066 cpu: hotplug: Bound hotplug states sysfs output
In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states, this can write past the end of the PAGESIZE buffer. Use sysfsemitat ...
EUVD-2026-59024
In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states, this can write past the end of the PAGESIZE buffer. Use sysfsemitat ...
CVE-2026-72046 gve: fix header buffer corruption with header-split and HW-GRO
In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...
EUVD-2026-59004
In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...
CVE-2026-72044 ksmbd: fix stack buffer overflow in multichannel session-key copy
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 "ksmbd: fix multichannel binding and enforce channel limit" moved the binding-path session key out of the session-wide sess-sesskey CIFSKEYSIZE...
EUVD-2026-59002
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 "ksmbd: fix multichannel binding and enforce channel limit" moved the binding-path session key out of the session-wide sess-sesskey CIFSKEYSIZE...
CVE-2026-72044
The CVE-2026-72044 issue is a Linux kernel ksmbd multichannel vulnerability. Root cause: a per-channel key buffer was sized to 16 bytes while two call sites validated/copied session keys against CIFS_KEY_SIZE (40). On binding sessions, an NTLM/ Kerberos session key up to 40 bytes could be written...
CVE-2026-72030
The CVE-2026-72030 issue affects the Linux kernel, specifically the ata libata-core CPR path. Root cause: ata_dev_config_cpr() reads the number of range descriptors from buf[0] and then walks the count at a fixed 32-byte stride in two places without proper bounds, risking overflow of the read buf...
EUVD-2026-58988
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...
CVE-2026-72030 ata: libata-core: Reject an invalid concurrent positioning ranges count
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...
CVE-2026-72030 ata: libata-core: Reject an invalid concurrent positioning ranges count
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...
CVE-2026-72025 s390/monwriter: Reject buffer reuse with different data length
In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwrit...
EUVD-2026-59117
In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...
CVE-2026-72018 dibs: loopback: validate offset and size in move_data()
In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...