497767 matches found
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 7.0. It stems from repeated lookups of the bpffs creator SID within SELinux’s BPF token permission checks; this may lead to a TOCTOU issue when users modify the token file descriptor passed to the kernel...
CVE-2026-99114: Linux: In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in…
In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FSCONTROLINFORMATION smb2getinfofilesystem reports 48 bytes for FSCONTROLINFORMATION, that is the whole of struct smb2fscontrolinfo, but never assigns FileSystemControlFlags. Those four...
CVE-2026-99175: Linux: In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector…
In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotifydestroymarks keeps a reference to its current mark while it drops conn-lock to destroy the mark. This stabilizes the forward-walk cursor, but does not prevent a n...
UBUNTU-CVE-2026-99111
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix data corruption with concurrent writes and OTRUNC cifsdotruncate flushes dirty pages with filemapwriteandwait and truncates the file on the server, but in the old code both operations ran without holding irwsem o...
CVE-2026-99137: Linux: In the Linux kernel, the following vulnerability has been resolved: cifs: don't update i_size in cifs_do_truncate…
In the Linux kernel, the following vulnerability has been resolved: cifs: don't update isize in cifsdotruncate without a cached handle If findwritablefile returns null, cifsfileflush will return 0 without issuing setfilesize, and the outer 'if !rc' block will set isize to 0 before telling the...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.19. It arises when amdgpuhmmrangealloc fails; as a result, amdgpugemuserptrioctl directly returns -ENOMEM and skips cleanup, leaving behind GEM objects, bo-parent references on VM root, and MMU notifier registrations. This may lead to...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 7.2. It stems from connecting to the PHY before assigning netdev-netdevops, resulting in a null pointer dereference and crash during the probe process when CONFIGNETSHAPER is enabled...
PT-2026-128179
In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in get seg reg override idx Commit 45e1dccc0653 "x86/insn: Simplify for each insn prefix" made for each insn prefix declare its own loop counter named idx. get seg reg override idx keeps...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.19. It stems from a naming conflict wherein the loop counter idx declared in foreachinsnprefix shares the same name as a local variable in getsegregoverrideidx, causing the variable to be shadowed. This prevents termination of loops under ...
PT-2026-128171
In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async PF flags on a kernel PF in NMI context An async PF "page not present" event arrives through the PF vector, and its reason sits in the per-CPU apf reason.flags until kvm handle async pf reads and clear...
CVE-2026-99187
In the Linux kernel, the following vulnerability has been resolved: perf: Fix perfpmumigratecontext leaving events behind perfpmuremove walks the group leaders of a CPU and PMU with perfeventgroupsforcpupmu, removing each one as it goes. perfremovefromcontext takes the leader out of the groups...
CVE-2026-99130
In the Linux kernel, the following vulnerability has been resolved: iouring/cancel: don't spin on local work the task can't run iouringcancelgeneric refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task is that ring's submitter and that the next...
CVE-2026-99211
In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 4.4. It arises because fibrebalance returns zero on its first iteration when concurrently modifying ignorerouteswithlinkdown, yet still detects a valid next hop on the second iteration, resulting in a division by zero...
UBUNTU-CVE-2026-99157
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...
PT-2026-128199
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsi update param value, causing a double-free...
PT-2026-128134
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print graph function event tracing set tracer assigns the flags of the newly selected tracer with: tr-current trace flags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor...
PT-2026-128150
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass reply len to bsg setup queue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSI SENSE BUFFERSIZE reply buffer per job, but struct ufs rpmb reply is 104 bytes: a 40-byte struct ufs bsg reply followed by a...
UBUNTU-CVE-2026-99207
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayedcmdlock targetdodelayedwork takes dev-delayedcmdlock with a plain spinlock. It runs from systempercpuwq, so interrupts stay enabled while the lock is held. Every other...
PT-2026-128198
In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeup preempt for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state a...