101920 matches found
UBUNTU-CVE-2026-97619
In the Linux kernel, the following vulnerability has been resolved: iouring/rw: end write accounting from -kicomplete Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the ioreqrwcomplete taskwork. However, only the fsnotify pa...
UBUNTU-CVE-2026-97931
In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE set on mappings created with PROTREAD. A process that can open the hwd...
CVE-2026-97875
The rojo serve HTTP API (default port 34872 ) is vulnerable to DNS rebinding because it lacks Host/Origin header validation . This flaw allows a malicious webpage to access project source code, write malicious code to the local disk, and execute local programs using opener::open() without user in...
EUVD-2026-86991
Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...
CVE-2026-97875 DNS rebinding vulnerability in rojo serve HTTP API
Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...
EUVD-2026-86973
In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...
CVE-2026-98142
The Linux kernel contains a vulnerability in the cirrus-qemu driver where it fails to verify that the PCI BAR0 resource size matches the expected CIRRUS_VRAM_SIZE (4 MB) during the probe process. If a device with a BAR0 smaller than 4 MB is bound, the driver may allow the creation of framebuffers...
CVE-2026-98142 drm/cirrus-qemu: Validate BAR0 size during probe
In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...
CVE-2026-98142 drm/cirrus-qemu: Validate BAR0 size during probe
In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...
CVE-2026-98119
A null-pointer dereference vulnerability exists in the Linux kernel 's netfs component. When netfs_alloc_subrequest() fails during an unbuffered write, it returns a NULL subrequest. The system subsequently attempts to initialize members of this NULL pointer within netfs_prepare_write() , leading ...
CVE-2026-98119 netfs: break unbuffered write when netfs_alloc_subrequest() fails
In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 When netfsallocsubrequest fails, subreq is NULL. Later, netfspreparewri...
CVE-2026-98119
In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 When netfsallocsubrequest fails, subreq is NULL. Later, netfspreparewri...
CVE-2026-98107 Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...
EUVD-2026-86938
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...
EUVD-2026-86939
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...
CVE-2026-98108 Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...
CVE-2026-98108
The Linux kernel Bluetooth L2CAP component contains a vulnerability where l2cap_le_connect_req() fails to correctly set the channel mode, potentially allowing FLAG_DEFER_SETUP channels to send incorrect L2CAP_ECRED_CONN_RSP replies. Furthermore, because the function fails to limit the number of d...
CVE-2026-98108 Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...
CVE-2026-98107 Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...
CVE-2026-98107
The Linux kernel Bluetooth L2CAP component contains an out-of-bounds write vulnerability in l2cap_ecred_connect. The root cause is in l2cap_chan_connect(), where the check for pending ECRED channels incorrectly counts only deferred channels. Specifically, if 6 L2CAP sockets are connected in a spe...