DEBIAN-CVE-2026-80970

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...

DEBIAN-CVE-2026-80956

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: only hand out initialized cache segments getcachesegment scans the segment map up to cache-nsegs, the physical device segment count, but cachesegsinit only initializes the first cacheinfo-nsegs segments. A crafted imag...

CVE-2026-89765 timers/itimer: Zero-init old itimerval before copy to userspace

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

CVE-2026-89618 eventfs: Initialize ei->children and ei->list in init_ei()

In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei-children and ei-list in initei eventfscreatedir allocates the eventfsinode and initializes it with initei. But this does not initialize the eventfsinode listheads. If the eventfscreatedir fails due to memor...

CVE-2026-89616 fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89616

CVE-2026-89616 is an information disclosure vulnerability in the Linux kernel's NTFS3 filesystem driver. When ni_read_frame() decompresses an LZNT $DATA frame, decompress_lznt() may return fewer bytes than frame_size if the compressed stream is exhausted early. The unwritten tail region retains r...

CVE-2026-89554

CVE-2026-89554 affects the Linux kernel's MPTCP (Multipath TCP) implementation. When reconstructing a MP_JOIN request under SYN cookies, mptcp_token_join_cookie_init_state() fails to restore the local_id field from the saved cookie entry. Because the request-sock slab is SLAB_TYPESAFE_BY_RCU and ...

EUVD-2026-76421

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsiallocsgtables During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x4a/0x70...

CVE-2026-89515

CVE-2026-89515 is a Linux kernel vulnerability in the SCSI core subsystem, specifically in scsi_alloc_sgtables(). When processing the last unaligned scatterlist element, padding bytes (pad_len) remain uninitialized , causing an uninit-value access in __dma_map_sg_attrs (detected by KMSAN). The tr...

CVE-2026-89483 nvme: zero the discard fallback page

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of...

CVE-2026-89483

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of...

CVE-2026-89483

CVE-2026-89483 is an information disclosure flaw in the Linux kernel NVMe subsystem . When nvme_setup_discard() falls back to the per-controller ctrl->discard_page (allocated via alloc_page(GFP_KERNEL) without zeroing) under memory pressure, up to 4080 bytes of uninitialized kernel memory (inc...

CVE-2026-89483 nvme: zero the discard fallback page

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of...

EUVD-2026-76389

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of...

CVE-2026-80970 ALSA: FCP: do not copy out an uninitialised init response

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...

EUVD-2026-76293

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...

CVE-2026-80956

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: only hand out initialized cache segments getcachesegment scans the segment map up to cache-nsegs, the physical device segment count, but cachesegsinit only initializes the first cacheinfo-nsegs segments. A crafted imag...

CVE-2020-1206-POC

CVE-2020-1206 未初始化内核内存读取 POC c 2020 ZecOps, Inc. - https://www.zecops.com - 寻找攻击者的错误 用于检查 CVE-2020-1206 / "SMBleed" 的POC 预期结果：包含目标计算机内核内存的本地文件。 仅用于教育和企业环境测试。 ZecOps 不对代码承担任何责任，使用风险自负。 如果您对用于服务器、终端和移动设备的无代理 DFIR 工具感兴趣，请通过 [email protected] 联系我们，这些工具能够自动检测 SMBleed 及其他类型的攻击。 用法 SMBleed.exe...

PT-2026-90337

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221 raw event mcp2221 raw event never validates the size of incoming HID reports. In the MCP2221 I2C GET DATA path it trusts the device-supplied data3 as the copy length without checking...

PT-2026-90199

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvme setup discard always maps sizeofstruct nvme dsm range NVME DSM MAX RANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number...