8507 matches found
In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.
...
vmxnet3: unregister xdp rxq info in the reset path
...
bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
...
RDMA/hns: Fix UAF for cq async event
...
block: fix uaf for flush rq while iterating tags
...
workqueue: Put the pwq after detaching the rescuer from the pool
...
RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers
...
RDMA/mlx5: Fix the recovery flow of the UMR QP
...
RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the hibmcge driver not handling division operations correctly when the queue length is zero, which could...
PT-2025-35992
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A division by zero issue was identified in the hibmcge network driver. This issue occurs when a network port is down, leading to the release of the queue and a zero value for ring-len...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from lpfc not checking for the hdwq null pointer when cleaning up vport structures...
scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()
...
blk-mq: Fix kmemleak in blk_mq_init_allocated_queue
...
ublk: fix handling recovery & reissue in ublk_abort_queue()
...
scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
...
net: mana: Fix TX CQE error handling
...
ArrayQueue's push_front is not panic-safe
The safe API arrayqueue::ArrayQueue::pushfront can lead to deallocating uninitialized memory if a panic occurs while invoking the clone method on the passed argument. Specifically, pushfront receives an argument that is intended to be cloned and pushed, whose type implements the Clone trait...
kernel: net/sched: Always pass notifications when child class becomes empty
A use-after-free UAF vulnerability was found in the Linux kernel's net/sched subsystem, specifically in the Credit-Based Shaper CBS qdisc implementation schcbs. The vulnerability occurs because the CBS qdisc's reset function qdiscresetqueue only resets its internal queue but fails to reset its...
kernel: net/sched: Always pass notifications when child class becomes empty
A use-after-free UAF vulnerability was found in the Linux kernel's net/sched subsystem, specifically in the Credit-Based Shaper CBS qdisc implementation schcbs. The vulnerability occurs because the CBS qdisc's reset function qdiscresetqueue only resets its internal queue but fails to reset its...