615158 matches found
CVE-2026-99225
In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while searchprocesskeyringsrcu searches the requestor's keyrings. The function validates the...
CVE-2026-99232
In the Linux kernel, the following vulnerability has been resolved: tracing/syscalls: Use copyfromuser for the faultable syscall buffer syscallcopyuserarray copies the buffer argument of faultable syscalls write, pwrite64, ... with copyfromuser, which skips accessok. Use copyfromuser instead so a...
CVE-2026-99219
In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in printrec printrec leaves 'modname' and 'offset' uninitialized and kallsymslookup only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname'...
CVE-2026-99240
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: error damoscommitquotagoal for zero targetvalue Patch series "mm/damon: move zero damos quota targetvalue handling to the core layer". Having zero DAMOS quota target value can cause division by zero. DAMON API...
CVE-2026-99239
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...
CVE-2026-99227
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...
CVE-2026-99231
In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...
CVE-2026-99222
In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...
CVE-2026-99234
In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An action that names a field on another event needs that field as a variable, so createfieldvarhist registers a second hist trigger on that event to provide it,...
CVE-2026-99242
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix race between fallocate and mmap reads The fallocate implementation only takes invalidatelock for punch hole, collapse range, and insert range operations. For standard allocation modes mode == 0, FALLOCFLKEEPSIZE, the lo...
CVE-2026-99237
In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when resetting last boot data from readers updatelastdataifempty is called from tracingopen with OTRUNC, tracingreadpipe and tracingbuffersread without tracetypeslock. Two readers can both pass the...
CVE-2026-99236
In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicateparse's inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an...
CVE-2026-99241
In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfsfilemappagemkwrite ntfsfilemappagemkwrite calls iomappagemkwrite without holding mapping-invalidatelock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and...
CVE-2026-99220
In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...
CVE-2026-99238
In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when updating modules in persistent instances tracemodulerecord walks ftracetracearrays from the module notifier without tracetypeslock. A concurrent rmdir of an instance removes it from the list and...
CVE-2026-99226
In the Linux kernel, the following vulnerability has been resolved: keys: Avoid the owner account dereference in named keyring lookup Named keyring lookup must keep the storage containing the owner UID alive through the namespace mapping check. findkeyringbyname reads keyring-user-uid under...
CVE-2026-99221
In the Linux kernel, the following vulnerability has been resolved: keys/trustedkeys: return immediately after TPM unseal failure trustedtpmunseal proceeds to pcrlock when the TPM unseal operation fails. If pcrlock succeeds, its return value overwrites the unseal error, causing key instantiation ...
CVE-2026-99218
In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish releases the parked threads by clearing -task in their corethread entry and calling wakeupprocess on each of them. It does that without holding a reference on the...
[SECURITY] [DSA 6602-1] linux security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6602-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 02, 2026 https://www.debian.org/security/faq -...
