409850 matches found
CVE-2026-99080
In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...
CVE-2026-99080 fs: Free any excess xarray nodes in clear_inode()
In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...
EUVD-2026-108746
In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...
CVE-2026-99080
The Linux kernel contains a long-standing, difficult-to-trigger memory leak involving xarray nodes within the fs subsystem. Recent findings by syzbot and other researchers demonstrated that this leak can be forced using the madvise system call. The vulnerability was addressed by calling xa_destro...
CVE-2026-99080 fs: Free any excess xarray nodes in clear_inode()
In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...
CVE-2026-99075 rust_binder: reschedule node refcount update on thread exit
In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...
CVE-2026-99075 rust_binder: reschedule node refcount update on thread exit
In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...
CVE-2026-99075
The Linux kernel contains a vulnerability in the rust_binder component regarding a reschedule node refcount update during thread exit. When a thread exits via BINDER_THREAD_EXIT, pending work items are cancelled. If a thread exits while holding a pending node refcount increment as deferred work, ...
EUVD-2026-108741
In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...
CVE-2026-99068
The Linux kernel contains a memory leakage vulnerability within the ALSA subsystem, specifically affecting the ctxfi component. The root cause is located in the dao_clear_input() function, which was simplified but omitted necessary kfree() calls. While the function correctly removes mapper entrie...
CVE-2026-99068 ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...
EUVD-2026-108734
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...
CVE-2026-99068 ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...
CVE-2026-99068
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...
CVE-2026-99057 xen/netfront: don't leak the skb when xennet_fill_frags() fails
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error and xennetpoll jumps to its error path. That path moves what's left on...
CVE-2026-99057
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error and xennetpoll jumps to its error path. That path moves what's left on...
EUVD-2026-108852
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error and xennetpoll jumps to its error path. That path moves what's left on...
CVE-2026-99057 xen/netfront: don't leak the skb when xennet_fill_frags() fails
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error and xennetpoll jumps to its error path. That path moves what's left on...
CVE-2026-99057
The Linux kernel contains a memory leak vulnerability in the xen/netfront component. When a response chain contains more slots than the skb's frags can accommodate, xennet_fill_frags() returns an error and xennet_poll() moves to an error path. Because the skb being filled is already dequeued from...
CVE-2026-99051
In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverityinfo fsveritygetinfo calls rhashtablelookupfast, which just uses rcureadlock and doesn't directly synchronize with fsverityremoveinfo. For the same inode this isn't a problem: its...