319264 matches found
EUVD-2026-64587
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...
CVE-2026-74650
CVE-2026-74650 is an out-of-bounds read in the Linux kernel's staging: rtl8723bs driver. The function WMM_param_handler() copies a fixed 18-byte WMM parameter element from a received information element without validating that the element length is at least 24 bytes. Two of its three callers (OnA...
CVE-2026-74650
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...
EUVD-2026-64582
In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: error out for 10000 activemembp damosquotascore can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoi...
CVE-2026-74645
CVE-2026-74645 is a division-by-zero vulnerability in the Linux kernel's DAMON_LRU_SORT module. When a user sets the active_mem_bp parameter to 10002 , the cold memory scheme's quota goal target value becomes zero, causing damos_quota_score() to trigger a kernel oops (divide error). The fix retur...
CVE-2026-74645 mm/damon/lru_sort: error out for >10000 active_mem_bp
In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: error out for 10000 activemembp damosquotascore can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoi...
CVE-2026-74645
In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: error out for 10000 activemembp damosquotascore can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoi...
CVE-2026-74645 mm/damon/lru_sort: error out for >10000 active_mem_bp
In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: error out for 10000 activemembp damosquotascore can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoi...
CVE-2026-74643 samples/damon/mtier: error out for zero quota goal target values
In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damosquotascore". DAMONSAMPLEMTIER and DAMONLRUSORT allow the user to trigger division by zero in damosquotascor...
CVE-2026-74643 samples/damon/mtier: error out for zero quota goal target values
In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damosquotascore". DAMONSAMPLEMTIER and DAMONLRUSORT allow the user to trigger division by zero in damosquotascor...
CVE-2026-74643
CVE-2026-74643 is a division-by-zero vulnerability in the Linux kernel affecting the DAMON_SAMPLE_MTIER and DAMON_LRU_SORT modules. The root cause is that damos_quota_score() does not guard against a zero target_value, which users can set via the node0_mem_{used,free}_bp sysfs parameters. Trigger...
EUVD-2026-64580
In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damosquotascore". DAMONSAMPLEMTIER and DAMONLRUSORT allow the user to trigger division by zero in damosquotascor...
CVE-2026-74643
In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damosquotascore". DAMONSAMPLEMTIER and DAMONLRUSORT allow the user to trigger division by zero in damosquotascor...
CVE-2026-74638
CVE-2026-74638 affects the V3D DRM scheduler in the Linux kernel, used on hardware such as the Raspberry Pi 5 . The V3D GPU exposes multiple independent hardware queues (BIN, RENDER, TFU, CSD) but performs only a single global reset . When a timeout on one queue triggers a global reset while anot...
EUVD-2026-64575
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...
CVE-2026-74638
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...
CVE-2026-74638 drm/v3d: Serialize the scheduler timeout handlers
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...
CVE-2026-74638 drm/v3d: Serialize the scheduler timeout handlers
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...
CVE-2026-74586 sctp: clear new_transport when removing a peer
In the Linux kernel, the following vulnerability has been resolved: sctp: clear newtransport when removing a peer sctpprocessasconfparam stores a newly added peer transport in asoc-newtransport. After all parameters in the ASCONF chunk have been processed, sctpsfdoasconf uses this pointer to send...
EUVD-2026-64523
In the Linux kernel, the following vulnerability has been resolved: sctp: clear newtransport when removing a peer sctpprocessasconfparam stores a newly added peer transport in asoc-newtransport. After all parameters in the ASCONF chunk have been processed, sctpsfdoasconf uses this pointer to send...