263032 matches found
CVE-2026-72046 gve: fix header buffer corruption with header-split and HW-GRO
In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...
EUVD-2026-59004
In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...
CVE-2026-72044 ksmbd: fix stack buffer overflow in multichannel session-key copy
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 "ksmbd: fix multichannel binding and enforce channel limit" moved the binding-path session key out of the session-wide sess-sesskey CIFSKEYSIZE...
EUVD-2026-59002
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 "ksmbd: fix multichannel binding and enforce channel limit" moved the binding-path session key out of the session-wide sess-sesskey CIFSKEYSIZE...
CVE-2026-72044
The CVE-2026-72044 issue is a Linux kernel ksmbd multichannel vulnerability. Root cause: a per-channel key buffer was sized to 16 bytes while two call sites validated/copied session keys against CIFS_KEY_SIZE (40). On binding sessions, an NTLM/ Kerberos session key up to 40 bytes could be written...
CVE-2026-72030
The CVE-2026-72030 issue affects the Linux kernel, specifically the ata libata-core CPR path. Root cause: ata_dev_config_cpr() reads the number of range descriptors from buf[0] and then walks the count at a fixed 32-byte stride in two places without proper bounds, risking overflow of the read buf...
EUVD-2026-58988
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...
CVE-2026-72030 ata: libata-core: Reject an invalid concurrent positioning ranges count
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...
CVE-2026-72030 ata: libata-core: Reject an invalid concurrent positioning ranges count
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...
CVE-2026-72025 s390/monwriter: Reject buffer reuse with different data length
In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwrit...
CVE-2026-72018 dibs: loopback: validate offset and size in move_data()
In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...
EUVD-2026-59117
In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...
CVE-2026-68479
CVE-2026-68479 affects the Linux kernel Bluetooth stack, specifically the btrtl driver. The vulnerability stems from rtlbt_parse_firmware() copying patch_length - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can cause an underflow, turni...
CVE-2026-68479 Bluetooth: btrtl: validate firmware patch bounds
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...
CVE-2026-68479 Bluetooth: btrtl: validate firmware patch bounds
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...
CVE-2026-68478 memstick: ms_block: reject a card that reports too many blocks
In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...
CVE-2026-68476 ipvs: reload ip header after head reallocation
In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ipvsgetoutrt calls skbensurewritable which may reallocate skb-head...
CVE-2026-68474 powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess computes the local store offset as address - vma-vmstart, but bounds-checks it against vma-vmend instead of the local store size. On 64-bit, offset ...
EUVD-2026-59093
In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...