159156 matches found
CVE-2026-89651
In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...
CVE-2026-89651 ceph: bound MDSCapAuth path and fs_name decode in handle_session()
In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...
EUVD-2026-76563
In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fsname decode in handlesession handlesession decodes the MDSCapAuth records carried by a CEPHSESSIONOPEN message msgversion = 6. For each record the match.path and match.fsname byte strings are rea...
CVE-2026-89624 HID: universal-pidff: stop the device when force-feedback init fails
In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universalpidffprobe starts the device with hidhwstart and then, if force-feedback initialisation fails, returns the error through a label that only does "return...
CVE-2026-89624 HID: universal-pidff: stop the device when force-feedback init fails
In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universalpidffprobe starts the device with hidhwstart and then, if force-feedback initialisation fails, returns the error through a label that only does "return...
CVE-2026-89624
CVE-2026-89624 is a use-after-free in the Linux kernel's universal-pidff HID driver. When universal_pidff_probe() calls hid_hw_start() and force-feedback initialization subsequently fails, the error path returns without calling hid_hw_stop(), leaving the device started. Because the hidraw charact...
EUVD-2026-76536
In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universalpidffprobe starts the device with hidhwstart and then, if force-feedback initialisation fails, returns the error through a label that only does "return...
CVE-2026-89624
In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universalpidffprobe starts the device with hidhwstart and then, if force-feedback initialisation fails, returns the error through a label that only does "return...
CVE-2026-89565
In the Linux kernel , the ipip and mplsip tunnel drivers leak a socket buffer (skb) in collect_md mode when ip_tun_rx_dst() fails to allocate a metadata_dst struct via atomic allocation. The function ipip_tunnel_rcv() returns 0 without freeing the skb, and the callers (tunnel4_rcv() / tunnelmpls4...
CVE-2026-89565 ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...
EUVD-2026-76476
In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...
CVE-2026-89565 ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...
CVE-2026-89565
In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...
CVE-2026-89559
CVE-2026-89559 affects the Linux kernel's libnvdimm/labels subsystem. The nslot field (a u32 read from DIMM label storage or via ND_CMD_SET_CONFIG_DATA) is multiplied by label_size in __nd_label_validate(). Because sizeof_namespace_label() returns unsigned, the product is evaluated in 32-bit and ...
CVE-2026-89559 libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...
EUVD-2026-76470
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...
CVE-2026-89559 libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...
CVE-2026-89559
In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...
CVE-2026-89555
CVE-2026-89555 is a use-after-free in the Linux kernel's MPLS subsystem. In mpls_select_multipath(), a cached header pointer (hdr) is not reloaded after pskb_may_pull() reallocates the skb head via pskb_expand_head(), leaving hdr pointing to freed memory. A remote attacker can trigger the bug by ...
EUVD-2026-76466
In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskbmaypull mplsselectmultipath calls mplsmultipathhash to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label...