550728 matches found
CVE-2026-98161
A vulnerability exists in the Linux kernel 's nvdimm: pmem module. The pmem_submit_bio() function incorrectly records a REQ_PREFLUSH error but continues to copy bio data, potentially overwriting the error with a successful REQ_FUA flush. This allows data writes to proceed after a failed preflush,...
CVE-2026-98162 smb/server: fix tree connection leak in smb2_tree_connect()
In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2treeconnect See the procedure below: smb2treeconnect ksmbdtreeconnconnect xastore&sess-treeconns, treeconn-id, treeconn ksmbdcounterincKSMBDCOUNTERTREECONNS ksmbdsharetreeconnincsc...
CVE-2026-98160
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtwsdioif1init padapter-HalData is allocated via vzalloc, but incorrectly freed using kfree in the rtwsdioif1init error path. Using kfree to release this vmalloc-backed buffer...
CVE-2026-98160 staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtwsdioif1init padapter-HalData is allocated via vzalloc, but incorrectly freed using kfree in the rtwsdioif1init error path. Using kfree to release this vmalloc-backed buffer...
CVE-2026-98160
The Linux kernel contains a memory corruption vulnerability in the rtl8723bs driver. Specifically, the rtw_sdio_if1_init() function incorrectly uses kfree() to release padapter->HalData, which was originally allocated via vzalloc(). This mismatch in memory deallocation can lead to memory corru...
EUVD-2026-87060
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtwsdioif1init padapter-HalData is allocated via vzalloc, but incorrectly freed using kfree in the rtwsdioif1init error path. Using kfree to release this vmalloc-backed buffer...
CVE-2026-98160 staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtwsdioif1init padapter-HalData is allocated via vzalloc, but incorrectly freed using kfree in the rtwsdioif1init error path. Using kfree to release this vmalloc-backed buffer...
CVE-2026-100078
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: pass correct argument to function The first argument to iwlmeiwritecyclicbuf should be the cldev but the qhead pointer is passed instead. Fix it...
EUVD-2026-87058
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: pass correct argument to function The first argument to iwlmeiwritecyclicbuf should be the cldev but the qhead pointer is passed instead. Fix it...
CVE-2026-100079
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: unregister debugfs entries on teardown ucsiregister creates per-instance debugfs entries, but ucsiunregister keeps them around until ucsidestroy. Drivers like ucsiglink that unregister/register the same UCSI...
CVE-2026-100079 usb: typec: ucsi: unregister debugfs entries on teardown
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: unregister debugfs entries on teardown ucsiregister creates per-instance debugfs entries, but ucsiunregister keeps them around until ucsidestroy. Drivers like ucsiglink that unregister/register the same UCSI...
CVE-2026-100078 wifi: iwlwifi: mei: pass correct argument to function
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: pass correct argument to function The first argument to iwlmeiwritecyclicbuf should be the cldev but the qhead pointer is passed instead. Fix it...
EUVD-2026-87059
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: unregister debugfs entries on teardown ucsiregister creates per-instance debugfs entries, but ucsiunregister keeps them around until ucsidestroy. Drivers like ucsiglink that unregister/register the same UCSI...
CVE-2026-100078
The Linux kernel contains a vulnerability within the iwlwifi driver related to the mei component. The root cause is an incorrect argument passed to the iwl_mei_write_cyclic_buf() function, where the q_head pointer is provided instead of the required cldev argument. The issue has been resolved in ...
CVE-2026-100079
The Linux kernel contains a vulnerability in the usb: typec: ucsi component where ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() fails to remove them until ucsi_destroy() is called. This issue can cause drivers, such as ucsi_glink , to encounter errors and log message...
CVE-2026-100076
The Linux kernel contains a memory leak vulnerability in the rtl8723bs driver within the staging subsystem. The issue occurs because issue_beacon(), issue_probersp(), and issue_asocrsp() functions may return early after calling alloc_mgtxmitframe() but before ownership is transferred to dump_mgnt...
CVE-2026-100076 staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix xmitframe/xmitbuf leaks on mgnt-frame error paths issuebeacon, issueprobersp and issueasocrsp obtain a management xmitframe together with its xmitbuf from the driver's fixed-size management-TX pools via...
EUVD-2026-87056
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix xmitframe/xmitbuf leaks on mgnt-frame error paths issuebeacon, issueprobersp and issueasocrsp obtain a management xmitframe together with its xmitbuf from the driver's fixed-size management-TX pools via...
CVE-2026-100077 drm/msm: Recover HW before retire hung submit
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in GPU pagefaults since the GPU may be...
CVE-2026-100077
The Linux kernel contains a vulnerability in the drm/msm driver where retiring a hung submit before GPU recovery is complete is unsafe. This action triggers a Buffer Object (BO) free , potentially causing GPU pagefaults because the GPU might still be actively accessing those BOs. The fix involves...