11932 matches found
CVE-2026-64395
Summary: CVE-2026-64395 in the Linux kernel ksmbd exposes information disclosure via FSCTL_DUPLICATE_EXTENTS_TO_FILE. The source file is passed directly to vfs_clone_file_range() / vfs_copy_file_range() without checking the SMB access mask, enabling a handle opened with attribute access to copy c...
CVE-2026-64352 bpf: Allow LPM map access from sleepable BPF programs
In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...
EUVD-2026-48896
In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...
CVE-2026-64352
CVE-2026-64352 affects the Linux kernel BPF subsystem , specifically the LPM (Longest Prefix Match) trie implementation in kernel/bpf/lpm_trie.c. The root cause is incorrect RCU lock annotations : trie_lookup_elem() used rcu_read_lock_bh_held() which does not accept the Tasks Trace RCU held by sl...
CVE-2026-64293 iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...
CVE-2026-64290
CVE-2026-64290 affects the Linux kernel via iommufd_fault_fops_read(): on a copy_to_user() failure inside the inner loop, only the inner loop breaks, causing the outer loop to retry indefinitely and spin the reader with fault->mutex held. The public fixes implement breaking the outer while by ...
EUVD-2026-49002
In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...
CVE-2026-64290
In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...
CVE-2026-64290 iommufd: Break the loop on failure in iommufd_fault_fops_read()
In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...
CVE-2026-64290 iommufd: Break the loop on failure in iommufd_fault_fops_read()
In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...
CVE-2026-64286
CVE-2026-64286 affects the Linux kernel’s KVM on arm64. The vulnerability arises in flush_hyp_vcpu(): it copies the host vCPU context into the hyp private vCPU on every run. The guest-context resolver (ctxt_to_vcpu()) expects a NULL __hyp_running_vcpu (only set on the host); since the host’s valu...
CVE-2026-64264 fuse-uring: fix EFAULT clobber in fuse_uring_commit
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...
CVE-2026-64264 fuse-uring: fix EFAULT clobber in fuse_uring_commit
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...
CVE-2026-64259 fuse-uring: make a fuse_req on SQE commit only findable after memcpy
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...
CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...
EUVD-2026-48971
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...
CVE-2026-64259 fuse-uring: make a fuse_req on SQE commit only findable after memcpy
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...
CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...
CVE-2026-64259
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...
SUSE CVE-2026-64210
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ During napi poll, when the affinity changes and there's still XSK work to be done, we trigger an ICOSQ interrupt on the new CPU. However, this triggering on the ICOSQ is done...