76514 matches found
CVE-2026-98278
In the Linux kernel, the following vulnerability has been resolved: net: remove WARNONONCE from the devfillforwardpath loop check ipipfillforwardpath and ip6tnlfillforwardpath look up the route to the tunnel's remote endpoint and set ctx-dev to its device, which is the tunnel itself when that rou...
CVE-2026-98221
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...
DEBIAN-CVE-2026-98171
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...
CVE-2026-98171
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...
CVE-2026-98362
In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...
CVE-2026-98291
The Linux kernel contains a vulnerability in the btintel_pcie component related to the btintel_pcie_submit_rx() function. An off-by-one bounds check error occurs because the function used frbd_index > rxq->count to guard the FRBD array access, incorrectly allowing an index equal to the coun...
CVE-2026-98270
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check ras and obj before dereference nbiov79handlerascontrollerintrnobifring dereferences ras and obj without checking either for NULL. Both amdgpurasgetcontext and amdgpurasfindobj can return NULL, e.g. during the...
CVE-2026-98243
In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avo...
CVE-2026-98221 KEYS: trusted: Fix tpm2_load_cmd() boundary check
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...
CVE-2026-98221
A vulnerability exists in the Linux kernel related to the tpm2_load_cmd() function. The issue is caused by the function performing boundary checks against the ASN.1 size (specifically payload->blob_len) instead of the correct size. The fix involves passing the decoded blob size to tpm2_load_cm...
EUVD-2026-93149
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...
CVE-2026-98221 KEYS: trusted: Fix tpm2_load_cmd() boundary check
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...
CVE-2026-98221
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...
CVE-2026-98171
The Linux kernel contains a vulnerability in the SMB client during the handling of compound encrypted frames within the receive_encrypted_standard() function. The issue stems from several pointer lifecycle and bounds checking flaws: a stale next_buffer pointer can lead to a use-after-free on cert...
EUVD-2026-93099
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...
CVE-2026-98171 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...
CVE-2026-98171 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...
lwip-snmpv3-stack-overflow-cve-2026-8836-critical-embedded-rce
CVE-2026-8836 — lwIP SNMPv3 栈溢出 PoC 针对 CVE-2026-8836 的概念验证漏洞利用，该漏洞是 lwIP 的 SNMPv3 USM 处理器中存在的一个严重栈缓冲区溢出。 漏洞信息 CVE ：CVE-2026-8836 CVSS ：9.8 严重（Critical） 组件 ：src/apps/snmp/snmpmsg.c 中的 snmpparseinboundframe 根本原因 ：snmpasn1decraw 中边界检查被注释掉，并且缓冲区大小参数错误 缓冲区...
CVE-2026-94271
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...