177035 matches found
CVE-2026-93541 Out-of-bounds read in libXi's XQueryDeviceState()
An out-of-bounds read in libXi's XQueryDeviceState in libXi before 1.8.4 could be used by a...
CVE-2026-93281 wifi: rtw89: fix HE extended capability length check
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89maccheckheobssnarrowbwruiter reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen = 11 before...
EUVD-2026-86153
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89maccheckheobssnarrowbwruiter reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen = 11 before...
CVE-2026-93281 wifi: rtw89: fix HE extended capability length check
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89maccheckheobssnarrowbwruiter reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen = 11 before...
CVE-2026-93280 greybus: audio: bound the topology section sizes against the fetched size
In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...
EUVD-2026-86152
In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...
CVE-2026-93280
The Linux kernel is vulnerable to an out-of-bounds read within the greybus: audio component. The issue occurs because gb_audio_gb_get_topology() fetches a topology blob based on a size provided by a module, but gbaudio_tplg_parse_data() fails to verify if the module-supplied section sizes (size_d...
CVE-2026-93280 greybus: audio: bound the topology section sizes against the fetched size
In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...
CVE-2026-93246 octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvuregisterinterrupts walks every MSI-X vector and uses strstr to match "Mbox" or "FLR" in irqname before pinning those interrupts to CPU 0. irqname is a per-vector...
CVE-2026-93246 octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvuregisterinterrupts walks every MSI-X vector and uses strstr to match "Mbox" or "FLR" in irqname before pinning those interrupts to CPU 0. irqname is a per-vector...
EUVD-2026-86256
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvuregisterinterrupts walks every MSI-X vector and uses strstr to match "Mbox" or "FLR" in irqname before pinning those interrupts to CPU 0. irqname is a per-vector...
CVE-2026-93246
A vulnerability in the Linux kernel (specifically the octeontx2-af driver) allows an out-of-bounds read during the setting of MSI-X IRQ affinity. The rvu_register_interrupts() function uses strstr() to search for "Mbox" or "FLR" within the irq_name buffer. Because this buffer may contain uninitia...
CVE-2026-93234 drm/gud: validate TV mode names before creating enum property
In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...
EUVD-2026-86239
In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...
CVE-2026-93234 drm/gud: validate TV mode names before creating enum property
In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...
CVE-2026-93234
A vulnerability exists in the Linux kernel 's drm/gud component where the gud_connector_add_tv_mode() function fails to validate that TV mode names returned via the GUD protocol are NUL-terminated. Because the protocol uses fixed-size entries, a device returning a name without a terminating NUL b...
EUVD-2026-86234
In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...
CVE-2026-93229
In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...
CVE-2026-93229 nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...
