3210 matches found
CVE-2026-23473
The CVE-2026-23473 issue affects the Linux kernel io_uring/poll path. A race occurs when a socket send and shutdown() wake up the poll loop back-to-back; the first wake assigns poll ownership (poll_refs=1) and the second increments to 2. io_poll_check_events() calls io_poll_issue(), which perform...
CVE-2026-23453
In the Linux kernel, the following vulnerability has been resolved: net: ti: icssg-prueth: Fix memory leak in XDPDROP for non-zero-copy mode Page recycling was removed from the XDPDROP path in emacrunxdp to avoid conflicts with AFXDP zero-copy mode, which uses xskbufffree instead. However, this...
CVE-2026-23450 net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smctcpsynrecvsock Syzkaller reported a panic in smctcpsynrecvsock 1. smctcpsynrecvsock is called in the TCP receive path softirq via icskafops-synrecvsock on the clcsock TCP listening...
CVE-2026-23450: Use After Free
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smctcpsynrecvsock Syzkaller reported a panic in smctcpsynrecvsock 1. smctcpsynrecvsock is called in the TCP receive path softirq via icskafops-synrecvsock on the clcsock TCP listening...
CVE-2026-5244 Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mgtlsrecvcert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been...
PT-2026-37408
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NFC s3fwrn5 component where the s3fwrn82 uart read function reports accepted bytes to the serdev core. The system may deliver a complete frame before allocating a...
PT-2026-29692
Name of the Vulnerable Software and Affected Versions Cesanta Mongoose versions up to 7.20 Description A flaw exists in the TLS 1.3 Handler component of Cesanta Mongoose, specifically within the mg tls recv cert function in the mongoose.c file. Manipulation of the pubkey argument can lead to a...
PT-2026-47789
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overflow exists in the greybus gb-beagleplay component. The cc1352 bootloader rx function appends serdev chunks into a fixed rx buffer before parsing bootloader packets. Because...
The vulnerability of the mousevsc_on_receive() function in the drivers/hid/hid-hyperv.c file of the Linux kernel subsystem for user interface devices’ drivers allows a hacker to cause a service failure.
The vulnerability of the mousevsconreceive function in the drivers/hid/hid-hyperv.c file of the Linux kernel’s input device subsystem driver is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability could allow...
CVE-2026-28526: Out-of-bounds Read
BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller LISTPLAYERAPPLICATIONSETTINGATTRIBUTES and LISTPLAYERAPPLICATIONSETTINGVALUES handlers that allows attackers to read beyond buffer boundaries. A nearby attacker with a paired Bluetooth...
GHSA-F359-R3PV-2PHF AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
Summary isSSRFSafeURL validates URLs against private/reserved IP ranges before fetching, but urlgetcontents follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target. Root Cause Check-time:...
IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
...
PT-2026-40503
Уязвимость функции pn532 receive buf ядра операционных систем Linux связана с некорректным вводом конфигурационных данных. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...
PT-2026-28536
Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0 Description AVideo, an open source video platform, is susceptible to a Server-Side Request Forgery SSRF bypass. The isSSRFSafeURL function validates URLs against private IP ranges before fetching, but t...
PT-2026-36449
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the NFC pn533 component, the pn532 receive buf function appends incoming bytes to dev-recv skb and only resets the buffer upon recognition of a complete frame by pn532 uart rx is fram...
CVE-2026-23394
A flaw was found in the Linux kernel's afunix component. A race condition exists between the MSGPEEK operation and the garbage collection process. This can allow a local user to cause the garbage collector to incorrectly purge the receive queue of an alive socket, potentially leading to a denial ...
kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code execution
A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rxe component. This use-after-free vulnerability occurs in the rxecreatecq function. When the rxecqfrominit function fails, the subsequent call to rxecleanup attempts to free memory resource...
CVE-2026-23289
A flaw was found in the Linux kernel's IB/mthca component. A local user could exploit this vulnerability by triggering a system call failure path related to the mthcacreatesrq function. This oversight leads to a missed unmapping of user database resources, resulting in a resource leak...
