497836 matches found
SUSE CVE-2026-99036
In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md. It may be possible that another concurrent ioctl on the same device...
SUSE CVE-2026-99042
In the Linux kernel, the following vulnerability has been resolved: iouring/net: populate CONNECT filter fields for 24-byte sockaddrin6 ioconnectbpfpopulate fills connect.port and connect.v6addr for AFINET6 only when addrlen = sizeofstruct sockaddrin6, i.e. 28 bytes. The IPv6 connect paths accept...
kernel-CTF
Kernel CTF Challenges A collection of Linux Kernel exploitation challenges for learning kernel security concepts. Requirements Linux system tested on Ubuntu Build essentials gcc, make Linux headers for your kernel version sudo apt-get update sudo apt-get install build-essential linux-headers-$una...
PT-2026-128201
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttm bo type kernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale...
PT-2026-128104
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix data corruption with concurrent writes and O TRUNC cifs do truncate flushes dirty pages with filemap write and wait and truncates the file on the server, but in the old code both operations ran without holding i...
PT-2026-128121
In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctp inq pop currently accepts shorter declared lengths. A zero-length chunk leaves chunk end at the current header. Whe...
PT-2026-128097
In the Linux kernel, the following vulnerability has been resolved: sched ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scx bypass claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates onl...
PT-2026-128161
In the Linux kernel, the following vulnerability has been resolved: mshv vtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshv vtl configure reg page warns and leaves that CPU's reg page NULL, but initial context setup...
PT-2026-128094
In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfs new attr flags resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is...
CVE-2026-99197
In the Linux kernel, the following vulnerability has been resolved: net: mv643xx: move setting of netops to fix crash mv643xxethprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit in question, ...
CVE-2026-99208
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kern...
UBUNTU-CVE-2026-99106
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.18. It stems from rocketremove decrementing numcores, while findcorefordev only searches for indices ranging from 0 to numcores - 1. When unbinding cores in order of binding, the last core is omitted, preventing numcores from reaching zero...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.8. It arises because the xeevictflags function dereferences a NULL resource when evicting a BO without a resource, potentially leading to a null pointer dereference in the kernel...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 7.2. It arises because hifemacdrvprobe connects to the PHY before assigning dev-netdevops; when CONFIGNETSHAPER is enabled, netdevneedopslock reads dev-netdevops. This may lead to null pointer dereferencing and kernel crashes...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel versions prior to 7.2.13. It arises because ntfsnewattrflags reduces the size of non-in-place attribute records before clearing compressed or sparse states; this causes memmove to copy bytes from subsequent attributes, resulting in a malformed mappi...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 7.0. It stems from a failure to invoke wakeuppreempt on queued tasks during changes to the scheduler class, resulting in runnable tasks being left unrescheduled and potentially causing the CPU to become idle...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 7.1. It arises because ntfssetattrsize fails to hold a mapping-invalidatelock when updating isize and adjusting disk attributes. This can lead to page errors and resize conflicts, potentially causing VCN parsing failures and generating...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.19. It stems from mshvvtlfault, which checks only the global mshvhasregpage flag without examining the register page of the selected CPU. This may lead to a null pointer dereference in getpageNULL when a mapping failure occurs in user spac...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.18. It arises when cifsdotruncate updates isize without a cached handle; when findwritablefile returns null, no setfilesize operation is performed, causing isize to be set to 0. Subsequently, if cifsopen fails, the inode size becomes 0 whi...