113087 matches found
CVE-2026-93212 nfsd: guard nfsd_serv deref in nfsd_file_net_dispose
In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsdserv deref in nfsdfilenetdispose nfsdfilenetdispose is the consumer side of l-freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via...
EUVD-2026-85941
In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsdserv deref in nfsdfilenetdispose nfsdfilenetdispose is the consumer side of l-freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via...
CVE-2026-93210 smb: client: harden DFS cache against invalid target hints
In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...
CVE-2026-93210
The Linux kernel contains a vulnerability in the SMB client component where the DFS cache is not properly hardened against invalid target hints. Specifically, the get_tgt_name() function returns ERR_PTR(-ENOENT) when ce->tgthint is NULL, while dfs_cache_noreq_update_tgthint() incorrectly assum...
CVE-2026-93210 smb: client: harden DFS cache against invalid target hints
In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...
EUVD-2026-85939
In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...
CVE-2026-93207 SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpcgsswirecred at svcauthgssdecodecredbody entry svcauthgssdecodecredbody writes the caller's rpcgsswirecred field by field and assigns gcctx.len only on the success tail. The caller storage is svcdata-clcred, which...
CVE-2026-93207 SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpcgsswirecred at svcauthgssdecodecredbody entry svcauthgssdecodecredbody writes the caller's rpcgsswirecred field by field and assigns gcctx.len only on the success tail. The caller storage is svcdata-clcred, which...
EUVD-2026-85936
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpcgsswirecred at svcauthgssdecodecredbody entry svcauthgssdecodecredbody writes the caller's rpcgsswirecred field by field and assigns gcctx.len only on the success tail. The caller storage is svcdata-clcred, which...
CVE-2026-93207
The Linux kernel is affected by a SUNRPC vulnerability where the svcauth_gss_decode_credbody() function fails to properly clear the rpc_gss_wire_cred field before decoding. Because this storage is reused across requests, early decode failures leave partially decoded states mixed with residues fro...
CVE-2026-58007 Unchecked SDM mailbox response address enables EL3 secure-memory corruption
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpgav2.14.0...
EUVD-2026-85928
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpgav2.14.0...
CVE-2026-58007 Unchecked SDM mailbox response address enables EL3 secure-memory corruption
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpgav2.14.0...
CVE-2026-58007
The Altera Trusted Firmware on HPS is vulnerable to an untrusted pointer dereference due to an unchecked SDM mailbox response address . This flaw allows for the exploitation of improperly configured or implemented memory protections , specifically leading to EL3 secure-memory corruption . The vul...
CVE-2026-58006
A high-severity untrusted pointer dereference vulnerability exists in Altera Trusted Firmware on HPS, affecting versions through socfpga_v2.14.0 . The root cause is insufficient validation of the Mailbox Output Pointer in the SoCFPGA BL31 component, which enables EL3 secure-memory corruption . Th...
EUVD-2026-85927
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpgav2.14.0...
CVE-2026-58006 Altera SoCFPGA BL31 Mailbox Output Pointer Validation Enables EL3 Secure-Memory Corruption
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpgav2.14.0...
CVE-2026-58006 Altera SoCFPGA BL31 Mailbox Output Pointer Validation Enables EL3 Secure-Memory Corruption
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpgav2.14.0...
openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...