5683 matches found
CVE-2026-89493
A flaw was found in the Linux kernel's ocfs2 component. A local attacker with CAPSYSADMIN privileges could exploit this by mounting a crafted or corrupted ocfs2 image, or by performing a raw write to the block device backing an already-mounted ocfs2 filesystem. This vulnerability arises from...
CVE-2026-89735
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: remove default configfs groups on teardown fmidi2allocinst creates default configfs child groups for the default endpoint and default block using configfsadddefaultgroup, setting their internal refcount to 1...
CVE-2026-89664
In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via posixaclalloc and stores them in open-oppacl and open-opdpacl. These pointe...
CVE-2026-89544
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...
CVE-2026-89493
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs lives in a single...
CVE-2026-80983
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...
DEBIAN-CVE-2026-80983
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...
AZL-100289 CVE-2026-80983 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...
CVE-2026-89735
CVE-2026-89735 is a memory leak in the Linux kernel 's USB gadget MIDI 2.0 driver. During function teardown in f_midi2_free_inst() or endpoint cleanup in f_midi2_ep_opts_release(), the function configfs_remove_default_groups() was never called, so the internal refcounts of the default configfs ch...
EUVD-2026-76647
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: remove default configfs groups on teardown fmidi2allocinst creates default configfs child groups for the default endpoint and default block using configfsadddefaultgroup, setting their internal refcount to 1...
CVE-2026-89688 nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...
CVE-2026-89688
CVE-2026-89688 is a Linux kernel vulnerability in the NFS server daemon (nfsd) , specifically in the error-handling path of nfs4_preprocess_seqid_op(). When nfsd4_cstate_assign_replay() returns -EAGAIN (replay owner being torn down), the code incorrectly called nfs4_put_stateowner() on a referenc...
CVE-2026-89544
CVE-2026-89544 affects the Linux kernel's SUNRPC subsystem, specifically the gssx XDR option-array decoder (gssx_dec_option_array()). Four coupled defects in its error paths are: (1) a NULL pointer dereference in the caller when oa->count is set to 1 before oa->data is allocated and the all...
CVE-2026-89544 SUNRPC: fix gssx_dec_option_array error path bugs
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...
EUVD-2026-76455
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...
CVE-2026-89493 ocfs2: validate rl_used against rl_count in refcount block validator
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs lives in a single...
EUVD-2026-76399
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs lives in a single...
CVE-2026-89493
CVE-2026-89493 affects the ocfs2 filesystem in the Linux kernel. In ocfs2_validate_refcount_block(), the rl_used and rl_count fields of an on-disk refcount block are never checked against the block's fixed record capacity (247 for a 4K block) or against each other. A crafted or corrupted block wi...
CVE-2026-89453 iommu/amd: Put PCI device after handling PPR faults
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...
EUVD-2026-76359
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...