3890 matches found
CVE-2026-64175
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes e.g., NMIINTERRUPTUNKNOWN on Intel BE201/Wi-Fi 7, iwlmldnicerror sets mld-fwstatus.inhwrestart to true. However, iwlmldtxfromtxq does not check thi...
CVE-2026-64175 wifi: iwlwifi: mld: stop TX during firmware restart
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes e.g., NMIINTERRUPTUNKNOWN on Intel BE201/Wi-Fi 7, iwlmldnicerror sets mld-fwstatus.inhwrestart to true. However, iwlmldtxfromtxq does not check thi...
CVE-2026-64167 kho: skip KHO for crash kernel
In the Linux kernel, the following vulnerability has been resolved: kho: skip KHO for crash kernel khofillkimage unconditionally populates the kimage with KHO metadata for every kexec image type. When the image is a crash kernel, this can be problematic as the crash kernel can run in a small...
CVE-2026-64140
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in procshowfiles When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSIONLOGOFF, sessionfdcheck clears fp-tcon = NULL on the reconnectable file pointer but leaves t...
CVE-2026-64111 lsm: hold cred_guard_mutex for lsm_set_self_attr()
In the Linux kernel, the following vulnerability has been resolved: lsm: hold credguardmutex for lsmsetselfattr Just as procpidattrwrite already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allo...
CVE-2026-64111
In the Linux kernel, the following vulnerability has been resolved: lsm: hold credguardmutex for lsmsetselfattr Just as procpidattrwrite already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allo...
CVE-2026-64111
The CVE-2026-64111 issue affects the Linux kernel where lsm_set_self_attr() did not hold cred_guard_mutex in the same way as proc_pid_attr_write() before calling the LSM hook. The fix ensures the mutex is held, reducing risk related to SELinux and AppArmor decisions based on whether a process is ...
CVE-2026-64101
In the Linux kernel, the following vulnerability has been resolved: fwctl: pds: Validate RPC input size before parsing The fwctl core allocates the device-specific RPC input buffer with fwctlrpc.inlen and passes that buffer to the driver callback. pdsfcfwrpc casts the buffer to struct fwctlrpcpds...
CVE-2026-64101
In the Linux kernel, the following vulnerability has been resolved: fwctl: pds: Validate RPC input size before parsing The fwctl core allocates the device-specific RPC input buffer with fwctlrpc.inlen and passes that buffer to the driver callback. pdsfcfwrpc casts the buffer to struct fwctlrpcpds...
CVE-2026-63981 net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow
In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: Fix blockcast recursion bypass leading to stack overflow tcfmirredact checks schedmirrednest against MIRREDNESTLIMIT 4 to prevent deep recursion. However, when the action uses blockcast tcfmblockid != 0, the...
CVE-2026-63978 net/handshake: Drain pending requests at net namespace exit
In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...
CVE-2026-63978
In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...
CVE-2026-63973 net: mana: Add NULL guards in teardown path to prevent panic on attach failure
In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc-txqp and apc-rxqs. Multiple teardown paths such as manaremove,...
CVE-2026-63890
The CVE-2026-63890 entry describes a Linux kernel vulnerability in the SCSI FCoE CVL walker where an unauthenticated L2 peer can hang fcoe_ctlr_recv_work on fcoe, qedf, or bnx2fc initiators by sending a CVL frame with a non‑critical descriptor (fip_dtype >= 128) and fip_dlen == 0. The issue ar...
CVE-2026-53392
In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count fflayoutalloclseg decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzallocobjs, and the current code only rejects...
CVE-2026-63827
Root cause: Linux kernel AppArmor uses a use-after-free in the rawdata dedup loop (aa_replace_profiles) due to unsafe refcount handling when traversing ns->rawdata_list. The dedup path calls aa_get_profile_loaddata() which has plain kref_get() semantics, allowing a zero counter to be dereferen...
CVE-2026-53395 nfsd: fix dead ACL conflict guard in nfsd4_create
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4create nfsd4create steals create-crdpacl/crpacl into the local nfsdattrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard...
CVE-2026-53395 nfsd: fix dead ACL conflict guard in nfsd4_create
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4create nfsd4create steals create-crdpacl/crpacl into the local nfsdattrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard...
CVE-2026-53395
Summary (concrete details from provided documents): CVE-2026-53395 affects the Linux kernel NFS server (nfsd). In nfsd4_create, the code steals create->cr_dpacl/cr_pacl into a local nfsd_attrs via a designated initializer and then nils the source pointers. The subsequent conflict guard tests t...
