105047 matches found
CVE-2026-98323
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...
CVE-2026-98181
In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gudplaneatomiccheck The plane property loop uses req-propertiesnumproperties + i as write index while simultaneously incrementing numproperties inside the loop. At iteration i, numproperties ha...
CVE-2026-98230
In the Linux kernel, the following vulnerability has been resolved: xfrm: use hlistdelinitrcu for statecache and statecacheinput Commit 14acf9652e56 "xfrm: defensively unhash xfrmstate lists in xfrmstatedelete" converted bydst/bysrc/byseq/byspi from hlistdelrcu to hlistdelinitrcu so that a second...
CVE-2026-98361
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...
CVE-2026-98189
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and reads tha...
CVE-2026-98199
In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/core increase number of phases and add new mask Increase the number of phases to 16 as a new upcoming device supports such a number. While at it, add a new mask for controlling the source of the output voltage. Note...
CVE-2026-98318
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying t...
UBUNTU-CVE-2026-98222
In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...
CVE-2026-98222
In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...
CVE-2026-98365
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...
CVE-2026-98361 RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...
CVE-2026-98361
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...
CVE-2026-98361 RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...
CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...
EUVD-2026-93308
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...
CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...
CVE-2026-98323
The Linux kernel is vulnerable to an out-of-bounds (OOB) write due to how the RDMA/siw component handles fragmented header copies. Specifically, the siw_get_hdr() function can receive an extended DDP/RDMAP header across multiple TCP callbacks. If the first callback receives most of the header, th...
CVE-2026-98318 smb: client: validate absolute native symlink targets before NT fixups
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying t...
EUVD-2026-93303
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying t...
CVE-2026-98318
The Linux kernel contains a vulnerability in the smb client where absolute native symlink targets are not properly validated before NT fixups when symlinkroot is unset. Because the code incorrectly assumes an NT prefix is present, providing a target like "/ab" causes out-of-bounds writes to the s...