CVE-2026-43253 iommu/amd: move wait_on_sem() out of spinlock

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move waitonsem out of spinlock With iommu.strict=1, the existing completion wait path can cause soft lockups under stressed environment, as waitonsem busy-waits under the spinlock with interrupts disabled. Move the...

CVE-2026-43253 iommu/amd: move wait_on_sem() out of spinlock

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move waitonsem out of spinlock With iommu.strict=1, the existing completion wait path can cause soft lockups under stressed environment, as waitonsem busy-waits under the spinlock with interrupts disabled. Move the...

CVE-2026-43253

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move waitonsem out of spinlock With iommu.strict=1, the existing completion wait path can cause soft lockups under stressed environment, as waitonsem busy-waits under the spinlock with interrupts disabled. Move the...

CVE-2026-43113

In the Linux kernel, the following vulnerability has been resolved: wifi: wl1251: validate packet IDs before indexing txframes wl1251txpacketcb uses the firmware completion ID directly to index the fixed 16-entry wl-txframes array. The ID is a raw u8 from the completion block, and the callback do...

CVE-2026-43113 wifi: wl1251: validate packet IDs before indexing tx_frames

In the Linux kernel, the following vulnerability has been resolved: wifi: wl1251: validate packet IDs before indexing txframes wl1251txpacketcb uses the firmware completion ID directly to index the fixed 16-entry wl-txframes array. The ID is a raw u8 from the completion block, and the callback do...

CVE-2026-43113

In the Linux kernel, CVE-2026-43113 affects the wl1251 Wi‑Fi driver. The function wl1251_tx_packet_cb() uses the firmware completion ID (a raw u8) to index a fixed 16-entry wl->tx_frames[] array without validating that the ID fits. The callback can dereference out-of-range IDs. The fix rejects...

CVE-2026-43113 wifi: wl1251: validate packet IDs before indexing tx_frames

In the Linux kernel, the following vulnerability has been resolved: wifi: wl1251: validate packet IDs before indexing txframes wl1251txpacketcb uses the firmware completion ID directly to index the fixed 16-entry wl-txframes array. The ID is a raw u8 from the completion block, and the callback do...

PT-2026-37423

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description An out-of-bounds array access exists in the WiFi wl1251 driver. The wl1251 tx packet cb function uses a firmware completion ID, provided as a raw u8 from the completion block, to index t...

PT-2026-38233

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.3.31 through 2026.4.9 Description A privilege escalation issue exists where heartbeat owner downgrade detection fails to identify local background async exec completion events. This allows attackers to provide untrusted...

Linux Distros Unpatched Vulnerability : CVE-2026-43113

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: wl1251: validate packet IDs before indexing txframes wl1251txpacketcb uses the firmware completion ID directly to index the fixed 16-entry wl-txframes...

Linux Kernel Security Vulnerabilities

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the wl1251txpacketcb function not verifying the firmware completion ID range, potentially leading to...

PT-2026-37593

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description When iommu.strict is set to 1, the completion wait path can cause soft lockups in stressed environments. This occurs because the wait on sem function busy-waits while holding a spinlock...

CLSA-2026-1778008248 vim: Fix of 5 CVEs

CVE-2022-2125: fix out-of-bounds read in getlispindent; break out of the inner loop on NUL byte indent.c, upstream patch 8.2.5122 - CVE-2021-3974: fix use-after-free in nfaregmatch when a substitute callback frees the regline during a mark comparison; save col and re-fetch rex.line via reggetline...

EUVD-2026-27351

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs" introduced mgmtpendingvalid, which not only validates the pending command but also unlinks it from...

CVE-2026-43059 Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit 302a1f674c00 "Bluetooth: MGMT: Fix possible UAFs" introduced mgmtpendingvalid, which not only validates the pending command but also unlinks it from...

CVE-2026-43059

CVE-2026-43059 affects the Linux kernel Bluetooth MGMT path. A change introducing mgmt_pending_valid() caused completion handlers to unlink commands from the pending list, which could lead to list corruption and potential memory safety issues. The patch fixes two issues: (1) in mgmt_add_adv_patte...

kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

QLogic qede driver processes TPA TCP/IP Packet Aggregation completion queue entries by iterating through lenlist until hitting a zero terminator. Malformed or corrupted completion entries lacking this sentinel cause the loop to read beyond array bounds. SVACE static analysis identified that...

CLSA-2026-1777944852 vim: Fix of 2 CVEs

CVE-2021-3984: in findstartbrace misc1.c, when a found '' lies inside a comment, restore the full cursor position line and column instead of only the line so subsequent C-indent lookups stay within the line bounds. - CVE-2022-2571: in inscomplgetexp edit.c, when CONTADDING is active, only advance...

CVE-2026-31702

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix use-after-free of sbi in f2fscompresswriteendio In f2fscompresswriteendio, decpagecountsbi, type can bring the F2FSWBCPDATA counter to zero, unblocking f2fswaitonallpages in f2fsputsuper on a concurrent unmount CPU. The...

CVE-2026-31719 crypto: krb5enc - fix async decrypt skipping hash verification

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5enc - fix async decrypt skipping hash verification krb5encdispatchdecrypt sets req-base.complete as the skcipher callback, which is the caller's own completion handler. When the skcipher completes asynchronously, this...