599143 matches found
EUVD-2026-80625
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...
CVE-2026-90017
CVE-2026-90017 is an out-of-bounds read in the Linux kernel's staging driver rtl8723bs , specifically in rtw_action_frame_parse(). The function accepts a frame_len parameter but never validates it before indexing into the frame body. Since frame_body already points 24 bytes into the frame, derefe...
CVE-2026-90016
CVE-2026-90016 is a 1-byte out-of-bounds read in the Linux kernel's staging rtl8723bs wireless driver, specifically in rtw_restruct_wmm_ie(). The function scans an attacker-influenced IE buffer (built from association/scan data) for a WMM IE. When the index reaches in_len - 1 without matching, ex...
EUVD-2026-80624
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD && ... ... break; i += iniei + 1 + 2; / to the next IE element / When the "i + ...
CVE-2026-90016 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD && ... ... break; i += iniei + 1 + 2; / to the next IE element / When the "i + ...
CVE-2026-90017 staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...
CVE-2026-90015
CVE-2026-90015 affects the Linux kernel xHCI driver . When a Transfer Descriptor (TD) spans three or more ring segments, the driver's td->bounce_seg field records only the last bounced segment, leaving earlier bounce buffers neither copied back into the URB buffer nor DMA unmapped. The URB sti...
CVE-2026-90015 xhci: fix lost bounce buffers on TDs spanning several ring segments
In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a link TRB with data that is not aligned to the endpoint's wMaxPacketSize, xhcialigntd stages the unalignable tail through the bounce buffer of...
EUVD-2026-80623
In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a link TRB with data that is not aligned to the endpoint's wMaxPacketSize, xhcialigntd stages the unalignable tail through the bounce buffer of...
EUVD-2026-80620
In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...
CVE-2026-90012 spi: Fix DMA mapping ownership on partial map failure
In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...
CVE-2026-90012
CVE-2026-90012 is a Linux kernel SPI bug in DMA mapping ownership on partial map failure. When RX mapping fails after TX mapping succeeds, __spi_map_msg() unmaps TX but leaves tx_sg_mapped set, and cur_{tx,rx}_dma_dev are not yet updated. The subsequent spi_unmap_msg() can then double-free a TX m...
CVE-2026-90009 scsi: bsg: Fix TOCTOU in io_uring passthrough command setup
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...
EUVD-2026-80617
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...
CVE-2026-90009
CVE-2026-90009 is a TOCTOU (time-of-check to time-of-use) race condition in the Linux kernel's scsi: bsg subsystem, specifically in scsi_bsg_uring_cmd() during io_uring passthrough command setup. The function reads bsg_uring_cmd fields from a shared mmap'd SQE; a local attacker with low privilege...
EUVD-2026-80614
In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: handle damonstop failure damonsamplemtierstop assumes its damonstop call will always successfully stops the two DAMON contexts. Hence it deallocates the two DAMON contexts after the damonstop call. However, i...
CVE-2026-90006
CVE-2026-90006 is a use-after-free vulnerability in the Linux kernel's DAMON subsystem, specifically in the mtier sample (samples/damon/mtier). The function damon_sample_mtier_stop() invokes damon_stop() once for two DAMON contexts and then unconditionally deallocates both. If one context has alr...
CVE-2026-90006 samples/damon/mtier: handle damon_stop() failure
In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: handle damonstop failure damonsamplemtierstop assumes its damonstop call will always successfully stops the two DAMON contexts. Hence it deallocates the two DAMON contexts after the damonstop call. However, i...
CVE-2026-90005 samples/damon/wsse: handle damon_start() failure
In the Linux kernel, the following vulnerability has been resolved: samples/damon/wsse: handle damonstart failure Patch series "samples/damon: handle damonstart,stop failures". All DAMON sample modules are not correctly handling failures from damonstart. Among those, mtier also has an additional...
CVE-2026-90004 mm/damon/core: handle region split failure in apply_min_nr_regions()
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: handle region split failure in applyminnrregions damonapplyminnrregions repeatedly split each region until its size becomes small enough to meet the user-defined low limit of the number of regions. The loop assumes...