Lucene search
+L

46312 matches found

CVE
CVE
•added 2026/09/24 3:51 p.m.•15 views

CVE-2026-93247

The Linux kernel contains a NULL pointer dereference vulnerability within the Bluetooth management subsystem. The issue arises because the uuid_count member of struct discovery_state is accessed and modified without proper locking, creating a race condition during hci_update_passive_scan_sync. If...

5.6AI score0.00206EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/09/24 3:51 p.m.•8 views

EUVD-2026-86257

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...

5.6AI score0.00206EPSS
SaveExploits0References6
OSV
OSV
•added 2026/09/24 3:51 p.m.•8 views

CVE-2026-93247 Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...

5.6AI score
SaveExploits0References9
Kitploit
Kitploit
•added 2026/09/24 3:38 p.m.•6 views

CVE-2026-50369

CVE-2026-50369 reproducer for a TOCTOU race condition in rdpcorets.dll!CRdpPipeGfxPlugin::Enable on Windows Server 2025 RDS Session Hosts. i reported this as a DoS; the code-path seem to somehow also enable EoP. this reproducer is a PoC for the DoS path alone. Bug Enable reads a COM interface...

8.8CVSS8AI score0.00701EPSS
SaveExploits0
OSV
OSV
•added 2026/09/24 3:34 p.m.•9 views

CVE-2026-93239 arm64: mm: Fix the lockless page-table walk in show_pte()

In the Linux kernel, the following vulnerability has been resolved: arm64: mm: Fix the lockless page-table walk in showpte showpte walks page tables locklessly and can run with interrupts enabled. A concurrent teardown can free a table page while it is being walked. It can also clear a parent ent...

5.8AI score
SaveExploits0References8
OSV
OSV
•added 2026/09/24 3:29 p.m.•6 views

CVE-2026-93230 mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Gigantic bootmem HugeTLB pages are currently initialized from hugetlbinit, but pageallocinitlate runs earlier and walks pageblocks to determine zone contiguity...

5.8AI score
SaveExploits0References6
EUVD
EUVD
•added 2026/09/24 3:29 p.m.•11 views

EUVD-2026-86234

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

5.8AI score0.00125EPSS
SaveExploits0References4
OSV
OSV
•added 2026/09/24 3:29 p.m.•6 views

CVE-2026-93229 nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

7.1CVSS5.8AI score
SaveExploits0References7
CVE
CVE
•added 2026/09/24 3:29 p.m.•15 views

CVE-2026-93229

The Linux kernel is affected by a vulnerability in the nfsd component. Specifically, the hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit() lacks a read memory barrier (smp_rmb) before its second counter check. On weakly-ordered architectures such as ARM and POWER , the CPU may...

7.1CVSS5.8AI score0.00125EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/24 3:29 p.m.•35 views

CVE-2026-93229 nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

7.1CVSS0.00125EPSS
SaveExploits0References4
CVE
CVE
•added 2026/09/24 3:21 p.m.•14 views

CVE-2026-93222

The Linux kernel contains a vulnerability where the send_signal_locked() function rewrites sender IDs for the target namespace. Because group sends reuse the same siginfo structure, one recipient can inadvertently affect the next. The issue is resolved by copying the siginfo before modification. ...

5.8AI score0.00176EPSS
SaveExploits0References8
EUVD
EUVD
•added 2026/09/24 3:21 p.m.•8 views

EUVD-2026-86225

In the Linux kernel, the following vulnerability has been resolved: signal: avoid shared siginfo namespace rewrites sendsignallocked rewrites sender ids for the target namespace. Group sends reuse the same siginfo, so one recipient can affect the next. Copy the siginfo before changing it...

5.8AI score0.00176EPSS
SaveExploits0References8
Cvelist
Cvelist
•added 2026/09/24 3:10 p.m.•37 views

CVE-2026-93221 nfsd: convert nfsd_net boolean flags to unsigned long flags word

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

8.1CVSS0.0033EPSS
SaveExploits0References2
OSV
OSV
•added 2026/09/24 3:10 p.m.•6 views

CVE-2026-93221 nfsd: convert nfsd_net boolean flags to unsigned long flags word

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

8.1CVSS5.7AI score
SaveExploits0References5
CVE
CVE
•added 2026/09/24 3:10 p.m.•20 views

CVE-2026-93221

The Linux kernel is vulnerable to a race condition in the nfsd component due to a lack of serialization when accessing boolean fields in nfsd_net. Specifically, the nfsd4_end_grace() function uses a plain boolean for grace_ended, allowing concurrent paths—such as the laundromat path and the RECLA...

8.1CVSS5.7AI score0.0033EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/24 3:10 p.m.•8 views

EUVD-2026-85950

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

5.7AI score0.0033EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/24 3:10 p.m.•30 views

CVE-2026-93218 mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

0.00155EPSS
SaveExploits0References2
OSV
OSV
•added 2026/09/24 3:10 p.m.•6 views

CVE-2026-93218 mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

5.8AI score
SaveExploits0References5
EUVD
EUVD
•added 2026/09/24 3:10 p.m.•7 views

EUVD-2026-85947

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

5.8AI score0.00155EPSS
SaveExploits0References2
CVE
CVE
•added 2026/09/24 3:10 p.m.•12 views

CVE-2026-93218

The Linux kernel contains a vulnerability in the mm/huge_memory component related to how it handles device-private Page Middle Directories (PMDs). A race condition occurs when an HMM-based GPU driver interacts with madvise(MADV_FREE). Specifically, migrate_vma_pages() can flip a PMD to a device-p...

5.8AI score0.00155EPSS
SaveExploits0References2
Rows per page
Query Builder