Lucene search
+L

57541 matches found

OSV
OSV
added 2026/08/15 12:28 p.m.23 views

CVE-2026-74569 netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

9.8CVSS5.7AI score
SaveExploits0References11
Debian CVE
Debian CVE
added 2026/08/15 12:28 p.m.10 views

CVE-2026-74569

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

9.8CVSS5.5AI score0.00388EPSS
SaveExploits0
EUVD
EUVD
added 2026/08/15 12:28 p.m.9 views

EUVD-2026-59634

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

5.5AI score0.00388EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/15 12:28 p.m.33 views

CVE-2026-74569 netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

9.8CVSS0.00388EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/15 12:27 p.m.32 views

CVE-2026-74504 ALSA: seq: Fix division by zero in initialize_timer()

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initializetimer A userspace-driven ALSA timer SNDUTIMER lets an unprivileged user set the backing sndtimer's hardware resolution to an arbitrary 64-bit value via SNDRVTIMERIOCTLCREATE...

0.00168EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/15 12:27 p.m.22 views

CVE-2026-74504

Summary (CVE-2026-74504): The Linux kernel ALSA sequencing timer (SND_UTIMER) can be driven by an unprivileged user to set arbitrary 64‑bit hardware resolution for snd_timer via SNDRV_TIMER_IOCTL_CREATE. When bound to a sequencer queue, initialize_timer() computes tmr->ticks = 1_000_000_000 / ...

5.5AI score0.00168EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/15 12:27 p.m.37 views

CVE-2026-74499 ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...

0.00177EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/08/15 12:27 p.m.8 views

EUVD-2026-59692

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...

5.3AI score0.00177EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/15 12:27 p.m.27 views

CVE-2026-74497

CVE-2026-74497 pertains to the Linux kernel, affecting ALSA usb-audio by clamping the frame size in implicit-feedback mode. The root cause is in snd_usb_handle_sync_urb(), which scales sync packet sizes and stores them directly in out_packet->packet_size[i]. If a connected USB device sends an ...

8.4CVSS5.3AI score0.00142EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/08/15 12:27 p.m.10 views

EUVD-2026-59663

In the Linux kernel, the following vulnerability has been resolved: scsi: scsidebug: Fix REPORT ZONES alloclen underflow OOB write respreportzones sizes the reply buffer from the CDB allocation length. The v3 fix rounds alloclen up with ALIGN before deriving the descriptor count: repmaxzones =...

5.7AI score0.00129EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/15 12:27 p.m.30 views

CVE-2026-74470

The CVE-2026-74470 issue affects the Linux kernel in the scsi_debug path for REPORT ZONES replies. The vulnerability arises from an alloc_len handling bug where resp_report_zones() derives arr_len and rep_max_zones from the CDB alloc_len; for large alloc_len (0xFFFFFFC1..0xFFFFFFFF) ALIGN() can p...

7.8CVSS5.7AI score0.00129EPSS
SaveExploits0References7
Debian CVE
Debian CVE
added 2026/08/15 12:27 p.m.10 views

CVE-2026-74469

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...

8.8CVSS5.4AI score0.00469EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/08/15 12:27 p.m.28 views

CVE-2026-74469 sctp: prevent peer transport count overflow

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...

8.8CVSS0.00469EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/08/15 12:27 p.m.7 views

EUVD-2026-59662

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...

5.4AI score0.00469EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/15 12:27 p.m.11 views

CVE-2026-74469 sctp: prevent peer transport count overflow

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...

8.8CVSS5.5AI score
SaveExploits0References11
CVE
CVE
added 2026/08/15 12:27 p.m.34 views

CVE-2026-74469

The CVE-2026-74469 issue affects the Linux kernel SCTP implementation. It occurs in sctp_assoc_add_peer(), where a 16-bit transport_count is incremented for each new unique peer; once the 65,536th transport is added, the counter wraps to zero. SCTP sock_diag uses transport_count to reserve the IN...

8.8CVSS5.3AI score0.00469EPSS
SaveExploits0References8
Debian CVE
Debian CVE
added 2026/08/15 12:26 p.m.7 views

CVE-2026-74447

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

7.8CVSS5.7AI score0.00129EPSS
SaveExploits0
EUVD
EUVD
added 2026/08/15 12:26 p.m.8 views

EUVD-2026-59754

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

5.8AI score0.00129EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/15 12:26 p.m.14 views

CVE-2026-74447 drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

7.8CVSS5.9AI score
SaveExploits0References7
Cvelist
Cvelist
added 2026/08/15 12:26 p.m.33 views

CVE-2026-74447 drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected EOP buffer size is computed as ALIGNeopringbuffersize, PAGESIZE; ALIG...

7.8CVSS0.00129EPSS
SaveExploits0References4
Rows per page
Query Builder