Lucene search
+L

76142 matches found

EUVD
EUVD
added 2026/07/25 8:51 a.m.11 views

EUVD-2026-48796

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

5.7AI score0.00219EPSS
SaveExploits0References8
Debian CVE
Debian CVE
added 2026/07/25 8:51 a.m.8 views

CVE-2026-64452

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

7.1CVSS5.7AI score0.00219EPSS
SaveExploits0
EUVD
EUVD
added 2026/07/25 8:51 a.m.8 views

EUVD-2026-48791

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7isysinit and ipu7psysinit, pdata is allocated and then passed to ipu7businitializedevice, which stores it in adev-pdata. The ipu7busrelease...

5.8AI score0.00133EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/25 8:51 a.m.17 views

CVE-2026-64447

CVE-2026-64447 maps to a Linux kernel issue in staging: ipu7 where pdata allocated in ipu7_isys_init() and ipu7_psys_init() can be freed twice via kfree pData in error paths. The two faulty paths are: (1) ipu7_mmu_init() fail leads to put_device() dropping refcount and freeing pdata via ipu7_bus_...

7.8CVSS5.8AI score0.00133EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/25 8:51 a.m.6 views

CVE-2026-64447 staging: media: ipu7: fix double-free and use-after-free in error paths

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7isysinit and ipu7psysinit, pdata is allocated and then passed to ipu7businitializedevice, which stores it in adev-pdata. The ipu7busrelease...

7.8CVSS5.8AI score
SaveExploits0References6
OSV
OSV
added 2026/07/25 8:50 a.m.9 views

CVE-2026-64414 netfilter: handle unreadable frags

In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments such as from devmem TCP, where skbfragsreadableskb returns false is processed by the u32 module, skbcopybits will safely return a negative...

7.5CVSS5.8AI score
SaveExploits0References7
OSV
OSV
added 2026/07/25 8:50 a.m.8 views

CVE-2026-64400 ksmbd: prevent path traversal bypass by restricting caseless retry

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbdvfspathlookup enforces LOOKUPBENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using...

8.6CVSS5.9AI score
SaveExploits0References5
EUVD
EUVD
added 2026/07/25 8:50 a.m.7 views

EUVD-2026-48944

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbdvfspathlookup enforces LOOKUPBENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using...

5.9AI score0.00357EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/25 8:50 a.m.25 views

CVE-2026-64400

Summary (CVE-2026-64400) : In the Linux kernel’s ksmbd component, a path traversal bypass could occur due to a caseless retry bug. Specifically, __ksmbd_vfs_kern_path() could skip -EXDEV (a path traversal error) and falsely proceed to a caseless retry, permitting write-capable users to create zer...

8.6CVSS5.9AI score0.00357EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/25 8:50 a.m.7 views

CVE-2026-64386 smb: client: fix query_info() replay double-free

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

9.8CVSS5.9AI score
SaveExploits0References8
EUVD
EUVD
added 2026/07/25 8:50 a.m.8 views

EUVD-2026-48928

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2notifyinit fails before the next send, cleanup retains the previous buffer type and...

5.9AI score0.00457EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/25 8:50 a.m.9 views

EUVD-2026-48926

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails before the next send, cleanup retains the previous buffer type and frees...

5.9AI score0.00354EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/25 8:50 a.m.25 views

CVE-2026-64382

CVE-2026-64382 describes a Linux kernel SMB client-use-after-free issue in SMB2_open() replay handling. The vulnerability arises because a response-bearing SMB2_open attempt could return a replayable error and free its response buffer; if SMB2_open_init() fails before the next send, cleanup may f...

8.8CVSS5.9AI score0.00354EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/25 8:50 a.m.12 views

EUVD-2026-48914

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

5.7AI score0.00177EPSS
SaveExploits0References8
CVE
CVE
added 2026/07/25 8:50 a.m.15 views

CVE-2026-64370

The CVE-2026-64370 issue concerns the Linux kernel’s posix-cpu-timers. In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If posix_cpu_timer_set() fails, the function returns without calling posix_cpu_timer_del(), causing a pid r...

5.7AI score0.00177EPSS
SaveExploits0References8
OSV
OSV
added 2026/07/25 8:50 a.m.8 views

CVE-2026-64370 posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

5.7AI score
SaveExploits0References11
Debian CVE
Debian CVE
added 2026/07/25 8:50 a.m.9 views

CVE-2026-64370

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

5.7AI score0.00177EPSS
SaveExploits0
EUVD
EUVD
added 2026/07/25 8:50 a.m.7 views

EUVD-2026-48909

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrangetimer at driver unbind letsketchdriver does not provide a .remove callback, but letsketchprobe arms a per-device timer: timersetup&data-inrangetimer, letsketchinrangetimeout, 0; The timer is...

5.8AI score0.00173EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/25 8:50 a.m.16 views

CVE-2026-64350

CVE-2026-64350 describes a memory leak in the Linux kernel USB cdnsp driver. The function cdnsp_alloc_stream_info() allocates stream_info->stream_ctx_array via cdnsp_alloc_stream_ctx() . If a later stream ring allocation or stream mapping update fails, the error path currently frees the alloca...

5.7AI score0.00173EPSS
SaveExploits0References7
Debian CVE
Debian CVE
added 2026/07/25 8:49 a.m.12 views

CVE-2026-64333

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix write buffer corruption The digiwriteinbcommand is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the u...

7.8CVSS5.9AI score0.00164EPSS
SaveExploits0
Rows per page
Query Builder