540546 matches found
CVE-2026-80607
In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Remove WARNONONCE from parsebtfarg Sashiko found that user can cause this WARNONONCE easily with adding a kprobe event based on a raw address with BTF parameter. Since this is not an unexpected condition, remove t...
CVE-2026-80605
In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'rawdata'. If the loop execute...
CVE-2026-80606
In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifierlock for write on inject test path When CONFIGDRMXEUSERPTRINVALINJECT=y, xeptsvmuserptrprecommit runs vmacheckuserptr with the svm notifierlock taken for read. The test injection causes vmacheckuserpt...
CVE-2026-80604
In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hidgetreport for numbered reports When a caller passes a size of 0 to hidreportrawevent for a numbered report, the function originally called hidgetreport before performing any size validation. Inside...
CVE-2026-80603
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackirc: fix parsedcc off-by-one OOB read parsedcc treats dataend as an inclusive end pointer, but its only caller passes datalimit = ibptr + datalen, which points one past the last valid byte. The newline searc...
CVE-2026-80602
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERFSAMPLEBRANCHUSER is requested. On AM...
CVE-2026-80600
In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...
CVE-2026-80601
In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...
CVE-2026-80599
In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible ethhdr proto field When batadvgetvid accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to...
CVE-2026-80598
In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompresslznt decompresslznt does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read...
CVE-2026-80597
In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization The mtdinfo contains a struct device, which must be linked to its parent. Without this, the initialization of the MTD fails with a NULL pointer dereference...
CVE-2026-80596
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on control interface When the driver was converted to use the driver core to instantiate device attributes via .devgroups in the usbdriver structure, the attributes started appearing ...
CVE-2026-80595
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add...
CVE-2026-80594
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in imspcugetcdcuniondesc by iterating through the extra descriptor data. However, it does not verify that the...
CVE-2026-80592
In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: fail early if address range parameters are invalid The comment on top of struct damonregion clearly says that For any use case, @ar should be non-zero positive size. which is now verified in...
CVE-2026-80593
In the Linux kernel, the following vulnerability has been resolved: hwmon: asusatk0110 Check package count before accessing element atkecpresent walks the management group package returned by the GGRP ACPI method and, for each sub-package, reads its first element: id = &obj-package.elements0; if...
CVE-2026-80591
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix listxattr handling of corrupted xattr entries Validate the xattr entry before reading its fields in f2fslistxattr. Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a...
CVE-2026-80590
In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO; nothing relates gsotype to fragoff...
