336089 matches found
CVE-2026-98301 net: bridge: mst: move switchdev call outside rcu
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate calls switchdevportattrset for nonzero MSTIs while holding rcureadlock which invokes the blocking...
CVE-2026-98301
The Linux kernel contains a vulnerability in the net: bridge: mst component where the br_mst_set_state() function calls switchdev_port_attr_set() while holding an rcu_read_lock() . This is problematic because the switchdev notifier chain can invoke blocking calls and sleep. The issue is triggered...
CVE-2026-98299 tcp: do not let tcp_rmem be set below 4096
In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcprmem be set below 4096 We can hit a division by zero crash in tcprcvbufgrow and tcprcvspaceadjust: divide error: 0000 1 PREEMPT SMP RIP: 0010:tcprcvbufgrow+0x187/0x450 net/ipv4/tcpinput.c:939 ... grow =...
EUVD-2026-93284
In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcprmem be set below 4096 We can hit a division by zero crash in tcprcvbufgrow and tcprcvspaceadjust: divide error: 0000 1 PREEMPT SMP RIP: 0010:tcprcvbufgrow+0x187/0x450 net/ipv4/tcpinput.c:939 ... grow =...
CVE-2026-98299
The Linux kernel is vulnerable to a division by zero crash in the tcp_rcvbuf_grow() and tcp_rcv_space_adjust() functions within net/ipv4/tcp_input.c. The root cause is that if net.ipv4.tcp_rmem is configured with arbitrarily small values (e.g., 1), sk->sk_rcvbuf is initialized to 1, causing tp...
CVE-2026-98299 tcp: do not let tcp_rmem be set below 4096
In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcprmem be set below 4096 We can hit a division by zero crash in tcprcvbufgrow and tcprcvspaceadjust: divide error: 0000 1 PREEMPT SMP RIP: 0010:tcprcvbufgrow+0x187/0x450 net/ipv4/tcpinput.c:939 ... grow =...
EUVD-2026-93283
In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...
CVE-2026-98298 dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...
CVE-2026-98298
The Linux kernel contains a vulnerability in the dmaengine component, specifically within the mmp_pdma driver. The root cause is an error in the mmp_pdma_prep_slave_sg() function where for_each_sg() incorrectly retrieves the entry length from the list head (sgl) instead of the current entry (sg)....
CVE-2026-98298 dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...
CVE-2026-98296
A vulnerability exists in the Linux kernel 's Bluetooth btintel_pcie driver. The function btintel_pcie_prepare_tx() performs an unchecked memcpy to copy skb->len bytes into a fixed DMA slot of 4096 bytes. While oversized packets are currently rejected in btintel_pcie_send_frame(), any future c...
CVE-2026-98296 Bluetooth: btintel_pcie: validate TX skb length in send_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...
EUVD-2026-93281
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...
CVE-2026-98296 Bluetooth: btintel_pcie: validate TX skb length in send_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...
CVE-2026-98297 Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix queuing txwork after workqueue is drained hcisendacl, hcisendsco and hcisendiso queue hdev-txwork unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hcidevclosesync is draining...
EUVD-2026-93282
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix queuing txwork after workqueue is drained hcisendacl, hcisendsco and hcisendiso queue hdev-txwork unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hcidevclosesync is draining...
CVE-2026-98297
A vulnerability exists in the Linux kernel Bluetooth hci_core component where functions hci_send_acl(), hci_send_sco(), and hci_send_iso() unconditionally queue hdev->tx_work. This creates a race condition during hci_dev_close_sync() while draining the hdev->workqueue (triggered by HCIDEVDO...
CVE-2026-98297 Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix queuing txwork after workqueue is drained hcisendacl, hcisendsco and hcisendiso queue hdev-txwork unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hcidevclosesync is draining...
CVE-2026-98295
The Linux kernel contains a vulnerability in the Bluetooth subsystem related to coredump processing. The function hci_devcd_handle_pkt_init() incorrectly arms dump_timeout and coredump producers without holding an hdev reference . This allows these works to remain live during unregistration, pote...
EUVD-2026-93280
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hcidevcdhandlepktinit arms dumptimeout and coredump producers queue dumprx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an acti...