87883 matches found
CVE-2026-74648 staging: rtl8723bs: validate monitor transmit frame lengths
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...
CVE-2026-74646 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...
EUVD-2026-64583
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...
CVE-2026-74646
CVE-2026-74646 is a race condition in the Linux kernel's misc: fastrpc subsystem. When a fastrpc invoke is interrupted by a signal, fastrpc_internal_invoke() moves all buffers from fl->mmaps onto cctx->invoke_interrupted_mmaps via list_del()/list_add_tail() without holding fl->lock , the...
CVE-2026-74646 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...
CVE-2026-74620
This Linux kernel vulnerability affects the net/sched subsystem, specifically the act_gact and act_police traffic control actions. The fallback control actions (TCA_GACT_PROB.paction and TCA_POLICE_RESULT) bypass the range check in tcf_action_check_ctrlact(), allowing user space to store TC_ACT_C...
EUVD-2026-64557
In the Linux kernel, the following vulnerability has been resolved: net/sched: actgact, actpolice: range check the fallback control action tcfactioncheckctrlact range checks the primary control action: if !opcode ret = action TCACTVALUEMAX ? -EINVAL : 0; TCACTVALUEMAX is TCACTTRAP, so...
CVE-2026-74620 net/sched: act_gact, act_police: range check the fallback control action
In the Linux kernel, the following vulnerability has been resolved: net/sched: actgact, actpolice: range check the fallback control action tcfactioncheckctrlact range checks the primary control action: if !opcode ret = action TCACTVALUEMAX ? -EINVAL : 0; TCACTVALUEMAX is TCACTTRAP, so...
CVE-2026-74620 net/sched: act_gact, act_police: range check the fallback control action
In the Linux kernel, the following vulnerability has been resolved: net/sched: actgact, actpolice: range check the fallback control action tcfactioncheckctrlact range checks the primary control action: if !opcode ret = action TCACTVALUEMAX ? -EINVAL : 0; TCACTVALUEMAX is TCACTTRAP, so...
EUVD-2026-64540
In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix board ID over-read The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlinkinfoversionfixedput treats it as a C string and may read beyond the...
CVE-2026-74602 ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Initialise reader page order in rballocatecpubuffer In rballocatecpubuffer, bpage-order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs bigger than PAGESIZE if when freed: freebufferpage...
CVE-2026-74596
This vulnerability affects the Linux kernel in the fsverity (filesystem verity) subsystem. The issue is in setattr_prepare(), where an unnecessary check for whether fs-verity is enabled in the kernel was present. Filesystems can contain fsverity files even when fs-verity is not enabled, and in th...
CVE-2026-74592
This vulnerability affects the Linux kernel's IMA (Integrity Measurement Architecture) subsystem. The root cause is that the file_truncate and path_truncate LSM hooks were not instantiated, meaning the IMA_DONE_MASK action cache flags were not reset when a file was truncated. As a result, after t...
CVE-2026-74592 ima: Instantiate file_truncate and path_truncate hooks
In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate filetruncate and pathtruncate hooks Instantiate the filetruncate and pathtruncate LSM hooks to reset the action cache flags IMADONEMASK as soon as truncation is requested, so the file, based on policy, is...
EUVD-2026-64529
In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate filetruncate and pathtruncate hooks Instantiate the filetruncate and pathtruncate LSM hooks to reset the action cache flags IMADONEMASK as soon as truncation is requested, so the file, based on policy, is...
CVE-2026-74589 bpf, sockmap: Fix sk_redir use-after-free in send verdict
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...
CVE-2026-77992
Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...
CVE-2026-76609
Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...