10788 matches found
drm/sched: Increment job count before swapping tail spsc queue
...
net/sched: sch_qfq: Fix race condition on qfq_aggregate
...
blk-mq: fix IO hang from sbitmap wakeup race
...
In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.
...
RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers
...
RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
...
scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()
...
blk-mq: Fix kmemleak in blk_mq_init_allocated_queue
...
vmxnet3: unregister xdp rxq info in the reset path
...
scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
...
bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
...
RDMA/hns: Fix UAF for cq async event
...
block: fix uaf for flush rq while iterating tags
...
RDMA/mlx5: Fix the recovery flow of the UMR QP
...
Linux Kernel Security Vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from lpfc not checking for the hdwq null pointer when cleaning up vport structures...
Linux Kernel Security Vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the hibmcge driver not handling division operations correctly when the queue length is zero, which could...
CVE-2025-38703: Use After Free
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated submit queue. At t...
ublk: fix handling recovery & reissue in ublk_abort_queue()
...
net: mana: Fix TX CQE error handling
...
ArrayQueue's push_front is not panic-safe
The safe API arrayqueue::ArrayQueue::pushfront can lead to deallocating uninitialized memory if a panic occurs while invoking the clone method on the passed argument. Specifically, pushfront receives an argument that is intended to be cloned and pushed, whose type implements the Clone trait...