403219 matches found
CVE-2026-98486 net: ena: fix MMIO read buffer leak on probe failure
In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure enadeviceinit initializes the MMIO read mechanism with enacommmioregreadrequestinit, which allocates a coherent DMA buffer for MMIO read responses. The normal removal path...
CVE-2026-98486 net: ena: fix MMIO read buffer leak on probe failure
In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure enadeviceinit initializes the MMIO read mechanism with enacommmioregreadrequestinit, which allocates a coherent DMA buffer for MMIO read responses. The normal removal path...
EUVD-2026-103726
In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure enadeviceinit initializes the MMIO read mechanism with enacommmioregreadrequestinit, which allocates a coherent DMA buffer for MMIO read responses. The normal removal path...
EUVD-2026-103722
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...
CVE-2026-98482 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...
CVE-2026-98482 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...
CVE-2026-98482
The Linux kernel contains a vulnerability in the nfc: llcp component within the nfc_llcp_recv_hdlc() function. The issue occurs because the function reads the sequence byte (skb->data[2]) via nfc_llcp_ns()/nfc_llcp_nr() without a prior length check. Since the receive path only guarantees a two...
CVE-2026-98479 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...
CVE-2026-98462 Bluetooth: hci_conn: fix CIS hold ownership on reuse
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hciconn" made hcibindcis and hciconnectcis return a connection with one hold for the ISO layer. hcibindcis...
EUVD-2026-103702
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hciconn" made hcibindcis and hciconnectcis return a connection with one hold for the ISO layer. hcibindcis...
CVE-2026-98462
The Linux kernel Bluetooth stack contains a flaw in how CIS hold ownership is handled during reuse. Specifically, the functions hci_bind_cis() and hci_connect_cis() may fail to correctly manage ISO layer holds. In hci_bind_cis(), holds are currently taken only after CIS configuration, leading to ...
CVE-2026-98462 Bluetooth: hci_conn: fix CIS hold ownership on reuse
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hciconn" made hcibindcis and hciconnectcis return a connection with one hold for the ISO layer. hcibindcis...
CVE-2026-98458
The Linux kernel Bluetooth ISO layer contains a vulnerability where hci_bind_cis() and hci_connect_cis() return an hci_conn hold that may remain unused. Specifically, the hold is not released when iso_chan_add() returns success for an already attached socket (idempotent case) or returns -EBUSY wh...
CVE-2026-98458 Bluetooth: ISO: release unused CIS holds after channel attach
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hcibindcis and hciconnectcis return one hciconn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by isoconnfree. Ther...
EUVD-2026-103691
In the Linux kernel, the following vulnerability has been resolved: smb: client: use finishnoopen for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen calls finishopen on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release...
CVE-2026-98451 smb: client: use finish_no_open() for non-regular inodes
In the Linux kernel, the following vulnerability has been resolved: smb: client: use finishnoopen for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen calls finishopen on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release...
CVE-2026-98451
A flaw in the Linux kernel SMB client allows a local user to trigger a resource leak by opening an existing symbolic link or other non-regular inode on an SMB mount using file creation flags. The issue occurs because cifs_atomic_open() calls finish_open() on these inodes, attaching a cifsFileInfo...
CVE-2026-98451 smb: client: use finish_no_open() for non-regular inodes
In the Linux kernel, the following vulnerability has been resolved: smb: client: use finishnoopen for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen calls finishopen on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release...
EUVD-2026-103688
In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that...
CVE-2026-98448 xfs: release orphanage dir inode if chown fails
In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that...