50713 matches found
CVE-2026-98016 net/mlx5e: Fix use-after-free race in sample_restore_put()
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free race in samplerestoreput Concurrent teardown of TC sample rules sharing the same restore context may re-read restore-count after dropping restorelock. At that point another thread may already have...
CVE-2026-98015 net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5eswitchtermtblput In mlx5eswitchtermtblput, the zero-ref cleanup check reads tt-refcount after termtblmutex has been released. Two concurrent callers on the same mlx5termtblhandle rac...
CVE-2026-98015
The Linux kernel contains a use-after-free vulnerability in the net/mlx5: E-Switch component within the mlx5_eswitch_termtbl_put() function. The issue arises because the tt->ref_count cleanup check occurs after the termtbl_mutex has been released, allowing a race condition where one caller fre...
CVE-2026-98004 iommu/riscv: Serialize command queue publishing
In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the...
CVE-2026-98004 iommu/riscv: Serialize command queue publishing
In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the...
CVE-2026-97998
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: cope with concurrent instance destruction Instances are refcounted. However, only memory release happens on the 1 - 0 transition; the unlink from hashes can occur with any refcount. Uncooperative userspac...
CVE-2026-97998
A vulnerability exists in the Linux kernel 's netfilter: nfnetlink_log component where instances are refcounted, but memory release only occurs during a 1 -> 0 transition , while unlinking from hashes can happen at any refcount. Uncooperative userspace can trigger a race condition by forcing a...
CVE-2026-97975 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...
EUVD-2026-86629
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...
CVE-2026-97975
The Linux kernel contains a NULL pointer dereference vulnerability in the Bluetooth hci_sysfs component. A race condition exists between hci_conn_del_sysfs() and concurrent child device unregistration (such as a BNEP network device calling unregister_netdev()). During unregistration, device_del()...
CVE-2026-97975 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...
CVE-2026-97962 net/mlx5e: Move representor vnic reporter to eswitch devlink port
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...
CVE-2026-97962 net/mlx5e: Move representor vnic reporter to eswitch devlink port
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...
EUVD-2026-86816
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...
CVE-2026-97942
The Linux kernel contains a vulnerability in the x86 alternatives patching code where a race condition between text poking and change_page_attr (CPA) can occur. If vmalloc_to_page() fails due to this race, it can result in the collapsing of page tables or the breaking of PMD hugepages . This issu...
CVE-2026-97941
In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n-listlock in slabtryreturnfreelist to avoid race Commit ba7425312607 "mm, slab: add an optimistic slabtryreturnfreelist" incorrectly assumed that nobody has freed an object to the slab as long as slab-freelist is...
EUVD-2026-86795
In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n-listlock in slabtryreturnfreelist to avoid race Commit ba7425312607 "mm, slab: add an optimistic slabtryreturnfreelist" incorrectly assumed that nobody has freed an object to the slab as long as slab-freelist is...
CVE-2026-97941
A race condition exists in the Linux kernel memory management system within mm/slab. The __slab_try_return_freelist() function incorrectly assumed that no objects were freed to a slab if slab->freelist was NULL and cmpxchg succeeded. This oversight leads to a classic ABA problem where a slab c...
CVE-2026-97941 mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race
In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n-listlock in slabtryreturnfreelist to avoid race Commit ba7425312607 "mm, slab: add an optimistic slabtryreturnfreelist" incorrectly assumed that nobody has freed an object to the slab as long as slab-freelist is...
CVE-2026-97938 reboot: fix cad_pid use-after-free race
In the Linux kernel, the following vulnerability has been resolved: reboot: fix cadpid use-after-free race cadpid is a single kernel-wide struct pid pointer. procdocadpid reads it and passes it to pidvnr without protecting the lifetime of the referenced struct pid. A concurrent writer can replace...