497767 matches found
CVE-2026-99194
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: aeroflex: move setting of netops to fix crash grethofprobe calls grethmdioinit, which connects the PHY, before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...
CVE-2026-99120
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Cope with the SS bit being set in NPF exit codes When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. The AMD manual is unclear about when SS...
CVE-2026-99144
In the Linux kernel, the following vulnerability has been resolved: schedext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred list until rundeferred takes it, and the RCU callback that frees...
CVE-2026-99208
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kern...
CVE-2026-99159
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix the sub-buffer array base in rbmetasubbufidx On a persistent ring buffer, rbmetasubbufidx can return an index one sub-buffer too high. rbsetupidsmetapage then fills subbufids shifted by one and leaves subbufids0...
CVE-2026-99103
In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound workerpool in nodeactivatependingpwq: BUG: KASAN: slab-use-after-free in rawspintrylock+0x6d/0x120 Read of size 4 at addr...
UBUNTU-CVE-2026-99184
In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocketremove decrements rdev-numcores for each core it removes, while findcorefordev searches slots 0 to numcores - 1. Unbinding the cores in the order they were bound...
UBUNTU-CVE-2026-99106
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.18. It stems from rocketremove decrementing numcores, while findcorefordev only searches for indices ranging from 0 to numcores - 1. When unbinding cores in order of binding, the last core is omitted, preventing numcores from reaching zero...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.8. It arises because the xeevictflags function dereferences a NULL resource when evicting a BO without a resource, potentially leading to a null pointer dereference in the kernel...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 7.2. It arises because hifemacdrvprobe connects to the PHY before assigning dev-netdevops; when CONFIGNETSHAPER is enabled, netdevneedopslock reads dev-netdevops. This may lead to null pointer dereferencing and kernel crashes...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel versions prior to 7.2.13. It arises because ntfsnewattrflags reduces the size of non-in-place attribute records before clearing compressed or sparse states; this causes memmove to copy bytes from subsequent attributes, resulting in a malformed mappi...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 7.0. It stems from a failure to invoke wakeuppreempt on queued tasks during changes to the scheduler class, resulting in runnable tasks being left unrescheduled and potentially causing the CPU to become idle...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 7.1. It arises because ntfssetattrsize fails to hold a mapping-invalidatelock when updating isize and adjusting disk attributes. This can lead to page errors and resize conflicts, potentially causing VCN parsing failures and generating...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.19. It stems from mshvvtlfault, which checks only the global mshvhasregpage flag without examining the register page of the selected CPU. This may lead to a null pointer dereference in getpageNULL when a mapping failure occurs in user spac...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.18. It arises when cifsdotruncate updates isize without a cached handle; when findwritablefile returns null, no setfilesize operation is performed, causing isize to be set to 0. Subsequently, if cifsopen fails, the inode size becomes 0 whi...
PT-2026-128204
In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKF NET OFF and SKF LL OFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting...
UBUNTU-CVE-2026-99204
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debugstateprint walks reco.nodedata and formats their fields. The formatter holds dlm-spinlock, but the recovery...
UBUNTU-CVE-2026-99211
In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...
PT-2026-128197
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debug state print walks reco.node data and formats their fields. The formatter holds dlm-spinlock, but the recovery...