446357 matches found
EUVD-2026-93351
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr reassigns mr-ibmr.pd first and only then validates the IBMRREREGACCESS argument: if flags & IBMRREREGPD rxeputoldpd; rxegetpd; mr-ibmr.pd = ibpd; if flags...
CVE-2026-98366 RDMA/rxe: validate access flags before swapping the MR's PD
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr reassigns mr-ibmr.pd first and only then validates the IBMRREREGACCESS argument: if flags & IBMRREREGPD rxeputoldpd; rxegetpd; mr-ibmr.pd = ibpd; if flags...
CVE-2026-98366
A slab-use-after-free vulnerability exists in the Linux kernel 's RDMA/rxe driver. The root cause is that the rxe_rereg_user_mr() function reassigns the memory region's protection domain (mr->ibmr.pd) before validating the IB_MR_REREG_ACCESS argument. If the access check fails, the function re...
CVE-2026-98364 xfrm: hold net_device reference under RCU in bundle creation
In the Linux kernel, the following vulnerability has been resolved: xfrm: hold netdevice reference under RCU in bundle creation xfrmbundlecreate and xfrmcreatedummybundle read dst-dev into a local pointer without taking a device reference, then pass it to xfrmfilldst. A concurrent RTMDELLINK...
CVE-2026-98365 RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...
EUVD-2026-93349
In the Linux kernel, the following vulnerability has been resolved: xfrm: hold netdevice reference under RCU in bundle creation xfrmbundlecreate and xfrmcreatedummybundle read dst-dev into a local pointer without taking a device reference, then pass it to xfrmfilldst. A concurrent RTMDELLINK...
CVE-2026-98364
The Linux kernel is vulnerable to a use-after-free condition during bundle creation in the xfrm subsystem. The functions xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into a local pointer without obtaining a proper device reference before passing it to xfrm_fill_dst(). If a...
CVE-2026-98364 xfrm: hold net_device reference under RCU in bundle creation
In the Linux kernel, the following vulnerability has been resolved: xfrm: hold netdevice reference under RCU in bundle creation xfrmbundlecreate and xfrmcreatedummybundle read dst-dev into a local pointer without taking a device reference, then pass it to xfrmfilldst. A concurrent RTMDELLINK...
CVE-2026-98365
The Linux kernel is vulnerable to an integer overflow in the mr_check_range() function within the RDMA/rxe component. The vulnerability exists because the function uses wraparound-prone arithmetic to validate that the iova and length fall within the registered Memory Region (MR) range. An unauthe...
EUVD-2026-93350
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...
CVE-2026-98365 RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...
CVE-2026-98363 firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS scpidvfsgetinfo already rejected a zero oppcount, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAXDVFSOPPS entries in...
EUVD-2026-93348
In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS scpidvfsgetinfo already rejected a zero oppcount, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAXDVFSOPPS entries in...
CVE-2026-98363
The Linux kernel contains a vulnerability in the arm_scpi firmware component. The function scpi_dvfs_get_info() failed to validate upper bounds on the opp_count received from the SCP firmware, only rejecting zero counts. Because the shared-memory reply only holds MAX_DVFS_OPPS entries in buf.opps...
CVE-2026-98362
The Linux kernel contains a vulnerability in the SCPI clock driver where dvfs_get_idx() fails to perform an upper bound check on the DVFS index. If the SCP firmware is buggy or provides stale values, it can return a large index that exceeds the info->opps range. This results in a KASAN Out-of-...
CVE-2026-98362 clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...
EUVD-2026-93347
In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...
EUVD-2026-93346
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...
CVE-2026-98361 RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...
CVE-2026-98361
The Linux kernel is vulnerable to a memory corruption issue in the RDMA/rxe driver due to the removal of the access permission test in rxe_check_pagefault(). This allows ODP write operations (such as RDMA WRITE , RDMA READ response , SEND payload , and atomics ) to modify read-only page-cache fol...