12 matches found
SUSE CVE-2026-64331
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...
CVE-2026-64331
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...
CVE-2026-64331
The CVE-2026-64331 vulnerability in the Linux kernel affects usbip vudc: vep_dequeue() could dereference a NULL UDC reference due to vep_alloc_request() not initializing vrequest->udc. The fix removes vrequest->udc and uses ep_to_vudc() to obtain the UDC reference consistently across vep op...
CVE-2026-64331 usbip: vudc: fix NULL deref in vep_dequeue()
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...
EUVD-2026-48875
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...
CVE-2026-64331
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: fix NULL deref in vepdequeue vepallocrequest wasn't initializing vrequest-udc, so cancellations on the FunctionFS AIO path were arriving in vepdequeue without a valid UDC reference. Since vrequest-udc is never actual...
PT-2026-64552
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the vep dequeue function within the usbip vudc component. The issue occurs because vep alloc request fails to initialize the vrequest-udc variable...
New White House Announcement on the Vulnerability Equities Process
The White House has released a new version of the Vulnerabilities Equities Process VEP. This is the inter-agency process by which the US government decides whether to inform the software vendor of a vulnerability it finds, or keep it secret and use it to eavesdrop on or attack other systems. You...
White House Releases VEP Disclosure Rules
The U.S. government took steps toward offering more transparency into the Vulnerabilities Equities Process. On Wednesday it released of the “Vulnerabilities Equities Policy and Process” PDF charter that outlines how the government will disclose cyber security flaws and when it will keep them...
PATCH Act Calls for VEP Review Board
The U.S. government took the first steps toward codifying the Vulnerabilities Equities Process into law yesterday through the introduction of the Protecting Our Ability to Counter Hacking PATCH Act of 2017. The VEP is the internal process by which the government decides which software...
ShadowBrokers' Windows Zero-Days Already Patched
Hours after what was thought to be a damaging release of NSA hacking tools for Windows systems, Microsoft quelled some anxiety with a late-night statement on Friday that most of the vulnerabilities disclosed by the ShadowBrokers had already been patched. The biggest surprise was that the most...
Policy Experts Push To Make Vulnerability Equities Process Law
The U.S. government’s role in vulnerability disclosures is a vital part of our national security and should be codified in law, said a group of policy experts at a panel discussion last week at the RSA Conference. The panelists argued that the government’s current process of vulnerability use and...