615172 matches found
CVE-2026-99222 keys: Protect the read method check against type removal
In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...
EUVD-2026-115263
In the Linux kernel, the following vulnerability has been resolved: keys/trustedkeys: return immediately after TPM unseal failure trustedtpmunseal proceeds to pcrlock when the TPM unseal operation fails. If pcrlock succeeds, its return value overwrites the unseal error, causing key instantiation ...
CVE-2026-99222
The Linux kernel contains a vulnerability in the key management system where keyctl_read_key() performs a method check on key->type->read without holding the key->sem semaphore. This allows a race condition where a surviving RxRPC key can be read while the AF_RXRPC module is being unload...
EUVD-2026-115264
In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...
EUVD-2026-115262
In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...
CVE-2026-99220
The Linux kernel is vulnerable to a NULL pointer dereference in the key_or_keyring_common() function located within crypto/asymmetric_keys/restrict.c. The root cause is that the PKCS#8 parser leaves the asym_key_ids payload slot empty, but the kernel unconditionally dereferences this slot when a ...
CVE-2026-99220 asymmetric_keys: reject trust keys without IDs
In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...
CVE-2026-99218 coredump: hold RCU while releasing parked threads
In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish releases the parked threads by clearing -task in their corethread entry and calling wakeupprocess on each of them. It does that without holding a reference on the...
CVE-2026-99219 ftrace: Initialize modname and offset in print_rec()
In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in printrec printrec leaves 'modname' and 'offset' uninitialized and kallsymslookup only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname'...
EUVD-2026-115261
In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in printrec printrec leaves 'modname' and 'offset' uninitialized and kallsymslookup only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname'...
CVE-2026-99220 asymmetric_keys: reject trust keys without IDs
In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...
CVE-2026-99218
The Linux kernel contains a vulnerability in the coredump subsystem. The coredump_finish() function attempts to release parked threads by clearing ->task in their core_thread entry and calling wake_up_process() without holding a task reference or being inside RCU . This creates a race conditio...
CVE-2026-99219 ftrace: Initialize modname and offset in print_rec()
In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in printrec printrec leaves 'modname' and 'offset' uninitialized and kallsymslookup only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname'...
CVE-2026-99219
The Linux kernel contains a vulnerability in the ftrace component where the print_rec() function leaves the modname and offset variables uninitialized. Because kallsyms_lookup() only populates these variables on success, a failed lookup (e.g., during module loading or unloading) results in modnam...
CVE-2026-99218 coredump: hold RCU while releasing parked threads
In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish releases the parked threads by clearing -task in their corethread entry and calling wakeupprocess on each of them. It does that without holding a reference on the...
EUVD-2026-115260
In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish releases the parked threads by clearing -task in their corethread entry and calling wakeupprocess on each of them. It does that without holding a reference on the...
CVE-2026-99217 fork: release the files of a failed fork after sched_cancel_fork()
In the Linux kernel, the following vulnerability has been resolved: fork: release the files of a failed fork after schedcancelfork Reorder copyprocess cleanup so schedfork taking scxforkrwsem scxprefork is safe and isn't held around exiting files. Right now, a fork that fails while another thread...
EUVD-2026-115259
In the Linux kernel, the following vulnerability has been resolved: fork: release the files of a failed fork after schedcancelfork Reorder copyprocess cleanup so schedfork taking scxforkrwsem scxprefork is safe and isn't held around exiting files. Right now, a fork that fails while another thread...
CVE-2026-99217
The Linux kernel contains a vulnerability where a fork operation can result in a deadlock or block all forks on the system. The root cause is located in copy_process() , where holding the scx_fork_rwsem for read while executing exit_files() leads to a deadlock if another thread closes a bpf link ...