178042 matches found
CVE-2026-74707
In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...
CVE-2026-74708
In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsktxmetadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the...
CVE-2026-74703
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cove...
CVE-2026-74693
In the Linux kernel, the following vulnerability has been resolved: net: prestera: validate firmware header length presterafwhdrparse reads the firmware header before checking that the firmware image contains that header. Reject images shorter than struct presterafwheader before decoding the magi...
CVE-2026-74689
In the Linux kernel, the following vulnerability has been resolved: net/atm: fix slab-out-of-bounds read in vccsetsockopt vccsetsockopt contained an ineffective optlen check: if SOLEVELMATCHoptname, level && optlen != SOSIZEoptname return -EINVAL; If SOLEVELMATCHoptname, level evaluated to false...
CVE-2026-74650
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...
CVE-2026-74648
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...
CVE-2026-74643
In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damosquotascore". DAMONSAMPLEMTIER and DAMONLRUSORT allow the user to trigger division by zero in damosquotascor...
CVE-2026-74621
In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...
CVE-2026-74598
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...
CVE-2026-74707
In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...
CVE-2026-74708
In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsktxmetadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the...
CVE-2026-74598
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...
CVE-2026-74701
In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in keyextract When a packet arrives on an ARPHRDNONE device e.g. TUN, ovsflowkeyextract trusts the user-provided skb-protocol field: if it is ETHPTEB, the packet is classified as...
UBUNTU-CVE-2026-74598
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of 8...
CVE-2026-74648
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...
UBUNTU-CVE-2026-74707
In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...
UBUNTU-CVE-2026-74703
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cove...
UBUNTU-CVE-2026-74708
In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsktxmetadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the...
CVE-2026-74710 xsk: require at least 16 bytes of TX metadata
In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AFXDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the...