7663 matches found
UBUNTU-CVE-2026-97413
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in processread and processwrite usrlen is read from a network-supplied message field le16tocpu and used to compute datalen = off - usrlen without validating that usrlen off causing an integer...
UBUNTU-CVE-2026-93784
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...
kernel: net: tun: bound receive headroom
A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...
CVE-2026-97413 RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in processread and processwrite usrlen is read from a network-supplied message field le16tocpu and used to compute datalen = off - usrlen without validating that usrlen off causing an integer...
EUVD-2026-86026
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in processread and processwrite usrlen is read from a network-supplied message field le16tocpu and used to compute datalen = off - usrlen without validating that usrlen off causing an integer...
CVE-2026-97413
The Linux kernel is vulnerable to an integer underflow within the RDMA/rtrs-srv component, specifically in the process_read and process_write functions. The issue arises because usr_len is read from a network-supplied message field and used to compute data_len = off - usr_len without verifying th...
CVE-2026-97413 RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in processread and processwrite usrlen is read from a network-supplied message field le16tocpu and used to compute datalen = off - usrlen without validating that usrlen off causing an integer...
EUVD-2026-86171
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...
CVE-2026-93784
A vulnerability exists in the Linux kernel 's cfg80211 component. The function cfg80211_wext_siwgenie() fails to validate the IE buffer stored via SIOCSIWGENIE , leading to an out-of-bounds read in skip_ie() and an integer underflow in memcpy during a subsequent SIOCSIWESSID connection attempt. T...
CVE-2026-93784 wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...
CVE-2026-93784 wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...
EUVD-2026-86170
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...
kernel: net: tun: bound receive headroom
A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...
kernel: net: tun: bound receive headroom
A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...
kernel: net: tun: bound receive headroom
A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...
kernel: net: tun: bound receive headroom
A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...
kernel: net: tun: bound receive headroom
A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...
kernel: net: tun: bound receive headroom
A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...
kernel: net: tun: bound receive headroom
A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...
kernel: net: tun: bound receive headroom
A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...