820864 matches found
kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
A flaw was found in the Linux kernel's Server-Message-Block Direct SMC-D client. A remote attacker can exploit this vulnerability by sending a specially crafted SMC-Dv2 proposal with a Channel Identifier CHID of 0. This malicious proposal can cause a null pointer dereference in the kernel's SMC...
kernel: drm/i915: Fix potential UAF in TTM object purge
A flaw was found in the Linux kernel's Intel i915 graphics driver drm/i915. This use-after-free UAF vulnerability occurs during the TTM object purge operation. An attacker could potentially exploit this to cause a system crash, leading to a denial of service...
kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
A flaw was found in the Linux kernel's nfconntrackh323 helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the nfconntrackh323 helper active. This memory corruption vulnerability leads to an out-of-bounds read, which...
kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged local user can exploit an out-of-bounds write vulnerability in the kfdeventpageset function. This occurs because the function writes data without properly validating the buffer size, allowing a small buffer to trigger a...
kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4
A flaw was found in the Linux kernel's AMD GPU amdgpu driver. Incorrect management of graphics memory dmafence references within the amdgpugemvaioctl function can lead to a reference count underflow and a use-after-after-free condition. A local attacker could exploit this vulnerability to trigger...
kernel: udf: fix partition descriptor append bookkeeping
A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. A remote attacker could exploit this vulnerability by tricking a user into mounting a specially crafted UDF image containing repeated partition descriptors. This could lead to a heap out-of-bounds write, potentially...
kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable
A flaw was found in the Linux kernel's netfilter synproxy module. When handling TCP timestamp options, a stale pointer can be used after memory reallocation. This can result in memory corruption, where data is written to a freed memory area, or lead to packets being sent with an incorrect checksu...
kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver component. This buffer overflow vulnerability occurs due to incorrect memory buffer handling during CRIU Checkpoint/Restore in User-space operations on SDMA System Direct Memory Access queues. A local attacker can exploit this fl...
kernel: ip6_gre: Use cached t->net in ip6erspan_changelink()
A flaw was found in the Linux kernel's ip6gre module. An unprivileged user could exploit this vulnerability by migrating a network device, causing the ip6erspanchangelink function to incorrectly handle network namespace references. This error leads to a use-after-free condition when the original...
kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
A flaw was found in the Linux kernel's iSCSI Internet Small Computer System Interface target subsystem. This vulnerability involves a buffer overread and a double-free error when processing iSCSI Text commands. A remote attacker could exploit these issues by sending specially crafted network...
kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver component. A local user could exploit a boundary error in the debug address watch v2 functionality by providing a specially crafted watchid. This could lead to a buffer overflow, potentially allowing memory access outside of...
kernel: smb/client: fix out-of-bounds read in symlink_data()
A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability arises from insufficient length validation in the smb2checkmessage function when processing symlink error responses. A remote attacker could exploit this by sending a specially crafted symlink error respons...
kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4
A flaw was found in the Linux kernel's AMD GPU amdgpu driver. Incorrect management of graphics memory dmafence references within the amdgpugemvaioctl function can lead to a reference count underflow and a use-after-after-free condition. A local attacker could exploit this vulnerability to trigger...
kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
A flaw was found in the Linux kernel's drm/amdkfd component. An unprivileged local user can exploit an out-of-bounds write vulnerability in the kfdeventpageset function. This occurs because the function writes data without properly validating the buffer size, allowing a small buffer to trigger a...
kernel: drm/i915: Fix potential UAF in TTM object purge
A flaw was found in the Linux kernel's Intel i915 graphics driver drm/i915. This use-after-free UAF vulnerability occurs during the TTM object purge operation. An attacker could potentially exploit this to cause a system crash, leading to a denial of service...
kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver component. A local user could exploit a boundary error in the debug address watch v2 functionality by providing a specially crafted watchid. This could lead to a buffer overflow, potentially allowing memory access outside of...
kernel: udf: fix partition descriptor append bookkeeping
A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. A remote attacker could exploit this vulnerability by tricking a user into mounting a specially crafted UDF image containing repeated partition descriptors. This could lead to a heap out-of-bounds write, potentially...
kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
A flaw was found in the Linux kernel's AMD KFD Kernel Fusion Driver component. This buffer overflow vulnerability occurs due to incorrect memory buffer handling during CRIU Checkpoint/Restore in User-space operations on SDMA System Direct Memory Access queues. A local attacker can exploit this fl...
kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
A flaw was found in the Linux kernel's iSCSI Internet Small Computer System Interface target subsystem. This vulnerability involves a buffer overread and a double-free error when processing iSCSI Text commands. A remote attacker could exploit these issues by sending specially crafted network...
