Lucene search
+L

100519 matches found

CVE
CVE
•added 2026/08/22 3:33 p.m.•31 views

CVE-2026-74703

CVE-2026-74703 affects the Linux kernel's vhost-scsi component. When T10 Protection Information (PI) is negotiated, a malformed request can declare protection bytes that cover or exceed the full payload length. This causes a zero data SGL count to reach sg_alloc_table_chained() , triggering a BUG...

7.1CVSS5.6AI score0.00184EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/08/22 3:33 p.m.•30 views

CVE-2026-74701 net/openvswitch: check Ethernet header length in key_extract()

In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in keyextract When a packet arrives on an ARPHRDNONE device e.g. TUN, ovsflowkeyextract trusts the user-provided skb-protocol field: if it is ETHPTEB, the packet is classified as...

7.8CVSS0.00176EPSS
SaveExploits0References8
EUVD
EUVD
•added 2026/08/22 3:33 p.m.•16 views

EUVD-2026-64388

In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in keyextract When a packet arrives on an ARPHRDNONE device e.g. TUN, ovsflowkeyextract trusts the user-provided skb-protocol field: if it is ETHPTEB, the packet is classified as...

5.5AI score0.00176EPSS
SaveExploits0References8
CVE
CVE
•added 2026/08/22 3:33 p.m.•48 views

CVE-2026-74701

This vulnerability affects the Open vSwitch (OVS) component of the Linux kernel in key_extract() within net/openvswitch/flow.c. When a packet with the ETH_P_TEB protocol arrives on an ARPHRD_NONE device (e.g., TUN), the function unconditionally pulls Ethernet header bytes (MAC addresses and ether...

7.8CVSS5.5AI score0.00176EPSS
SaveExploits0References8
CVE
CVE
•added 2026/08/22 3:32 p.m.•34 views

CVE-2026-74693

CVE-2026-74693 affects the Linux kernel 's Prestera network driver (net: prestera). The function prestera_fw_hdr_parse() reads the firmware header before verifying that the firmware image is long enough to contain it, resulting in an out-of-bounds read of the magic and version fields. The fix rej...

5.4AI score0.0022EPSS
SaveExploits0References8
EUVD
EUVD
•added 2026/08/22 3:32 p.m.•16 views

EUVD-2026-64363

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

5.4AI score0.0022EPSS
SaveExploits0References8
CVE
CVE
•added 2026/08/22 3:32 p.m.•50 views

CVE-2026-74676

CVE-2026-74676 affects the Linux kernel virtual terminal (VT) subsystem. The KDSKBMETA ioctl, which modifies keyboard meta mode, lacked the !perm permission check enforced by all other keyboard setter ioctls in vt_k_ioctl() . This allowed a process to change the meta mode on a non-controlling con...

5.4AI score0.0022EPSS
SaveExploits0References8
Cvelist
Cvelist
•added 2026/08/22 3:32 p.m.•35 views

CVE-2026-74676 vt: add permission check for KDSKBMETA ioctl

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

0.0022EPSS
SaveExploits0References8
OSV
OSV
•added 2026/08/22 3:32 p.m.•25 views

CVE-2026-74676 vt: add permission check for KDSKBMETA ioctl

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

5.5AI score
SaveExploits0References11
Cvelist
Cvelist
•added 2026/08/22 3:32 p.m.•31 views

CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

8.1CVSS0.00419EPSS
SaveExploits0References8
OSV
OSV
•added 2026/08/22 3:32 p.m.•21 views

CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

8.1CVSS5.9AI score
SaveExploits0References11
CVE
CVE
•added 2026/08/22 3:32 p.m.•51 views

CVE-2026-74651

CVE-2026-74651 is an out-of-bounds read in the Linux kernel's rtl8723bs Wi-Fi driver (staging). The function rtw_get_wpa_ie() reads a 4-byte OUI+type and a 2-byte version word at fixed offsets into a vendor-specific information element (EID 221) without verifying the IE body is at least 6 bytes l...

8.1CVSS5.8AI score0.00419EPSS
SaveExploits0References8
Cvelist
Cvelist
•added 2026/08/22 3:32 p.m.•34 views

CVE-2026-74650 staging: rtl8723bs: fix OOB read in WMM_param_handler()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

0.0022EPSS
SaveExploits0References8
EUVD
EUVD
•added 2026/08/22 3:32 p.m.•15 views

EUVD-2026-64587

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

5.6AI score0.0022EPSS
SaveExploits0References7
EUVD
EUVD
•added 2026/08/22 3:32 p.m.•14 views

EUVD-2026-64586

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

5.9AI score0.00465EPSS
SaveExploits0References7
OSV
OSV
•added 2026/08/22 3:32 p.m.•20 views

CVE-2026-74648 staging: rtl8723bs: validate monitor transmit frame lengths

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

7.8CVSS5.6AI score
SaveExploits0References11
EUVD
EUVD
•added 2026/08/22 3:32 p.m.•19 views

EUVD-2026-64583

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

5.8AI score0.00175EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/08/22 3:32 p.m.•33 views

CVE-2026-74646 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

7.8CVSS0.00175EPSS
SaveExploits0References5
CVE
CVE
•added 2026/08/22 3:32 p.m.•48 views

CVE-2026-74646

CVE-2026-74646 is a race condition in the Linux kernel's misc: fastrpc subsystem. When a fastrpc invoke is interrupted by a signal, fastrpc_internal_invoke() moves all buffers from fl->mmaps onto cctx->invoke_interrupted_mmaps via list_del()/list_add_tail() without holding fl->lock , the...

7.8CVSS5.8AI score0.00175EPSS
SaveExploits0References5
OSV
OSV
•added 2026/08/22 3:32 p.m.•23 views

CVE-2026-74646 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

7.8CVSS5.9AI score
SaveExploits0References8
Rows per page
Query Builder