81966 matches found
CVE-2026-72497
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Add a max slot check for SQ The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than t...
CVE-2026-72501
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Initialize dpi variable to zero dpi is initialized only for BNXTREALLOCWCPAGE, but copied for all the cases. So initialize the dpi to 0...
AZL-96009 CVE-2026-72501 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Initialize dpi variable to zero dpi is initialized only for BNXTREALLOCWCPAGE, but copied for all the cases. So initialize the dpi to 0...
CVE-2026-72333
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee "Bluetooth: L2CAP: Fix not tracking outstanding TX ident" changed ident allocation to use an IDA, releasing idents in l2capputident when the...
DEBIAN-CVE-2026-72333
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee "Bluetooth: L2CAP: Fix not tracking outstanding TX ident" changed ident allocation to use an IDA, releasing idents in l2capputident when the...
CVE-2026-74287
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctpverifyasconf and sctpverifyparam only validate ADDIP, DELIP, and SETPRIMARY parameters against a fixed minimum size of sizeofstruct sctpaddipparam + sizeofstruct sctpparamhdr...
UBUNTU-CVE-2026-74334
In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr-pd Sashiko points out that, due to reregmr, the PD is actually variable and all the touches in nldev are racy. Use mr-device instead of mr-pd-device. Getting the PD restrack ID is more...
CVE-2026-72333
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee "Bluetooth: L2CAP: Fix not tracking outstanding TX ident" changed ident allocation to use an IDA, releasing idents in l2capputident when the...
UBUNTU-CVE-2026-72497
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Add a max slot check for SQ The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than t...
UBUNTU-CVE-2026-72501
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Initialize dpi variable to zero dpi is initialized only for BNXTREALLOCWCPAGE, but copied for all the cases. So initialize the dpi to 0...
UBUNTU-CVE-2026-74278
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE with the original event embedded as variable-length data, while kernel...
UBUNTU-CVE-2026-74391
In the Linux kernel, the following vulnerability has been resolved: tracing: Bound synthetic-field strings with seqbuf The synthetic field helpers build a prefixed synthetic variable name and a generated hist command in fixed MAXFILTERSTRVAL buffers. The current code appends those strings with ra...
CVE-2026-74334
In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr-pd Sashiko points out that, due to reregmr, the PD is actually variable and all the touches in nldev are racy. Use mr-device instead of mr-pd-device. Getting the PD restrack ID is more...
UBUNTU-CVE-2026-74339
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read sndseqread copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRVSEQEXTCHAINED internally, and data.ext.ptr...
CVE-2026-72501
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Initialize dpi variable to zero dpi is initialized only for BNXTREALLOCWCPAGE, but copied for all the cases. So initialize the dpi to 0...
UBUNTU-CVE-2026-74378
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in getsrqwqe getsrqwqe reads wqe-dma.numsge from the shared receive queue buffer, which is mapped into userspace. It validates numsge against maxsge, but then re-reads the same field to calculat...
UBUNTU-CVE-2026-74287
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctpverifyasconf and sctpverifyparam only validate ADDIP, DELIP, and SETPRIMARY parameters against a fixed minimum size of sizeofstruct sctpaddipparam + sizeofstruct sctpparamhdr...
UBUNTU-CVE-2026-72333
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response Commit 6c3ea155e5ee "Bluetooth: L2CAP: Fix not tracking outstanding TX ident" changed ident allocation to use an IDA, releasing idents in l2capputident when the...
CVE-2026-74339
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read sndseqread copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRVSEQEXTCHAINED internally, and data.ext.ptr...
CVE-2026-74278
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE with the original event embedded as variable-length data, while kernel...