1739 matches found
kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
A flaw was found in the Linux kernel's NFSv4/pNFS implementation. The nfs4decodempdsaddr function, responsible for decoding network address information, does not properly handle zero-length raddr opaque data. A malicious or compromised metadata server can exploit this by providing a zero-length...
kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range
A flaw was found in the Linux kernel's iomap subsystem. An unsigned subtraction underflow occurs when ifssetrangedirty or ifssetrangeuptodate are called with a zero-length range. This can lead to an out-of-bounds write via bitmapset, potentially allowing a local attacker to cause memory corruptio...
kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
A flaw was found in the Linux kernel's NFSv4/pNFS implementation. The nfs4decodempdsaddr function, responsible for decoding network address information, does not properly handle zero-length raddr opaque data. A malicious or compromised metadata server can exploit this by providing a zero-length...
kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
A flaw was found in the Linux kernel's NFSv4/pNFS implementation. The nfs4decodempdsaddr function, responsible for decoding network address information, does not properly handle zero-length raddr opaque data. A malicious or compromised metadata server can exploit this by providing a zero-length...
kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
A flaw was found in the Linux kernel's NFSv4/pNFS implementation. The nfs4decodempdsaddr function, responsible for decoding network address information, does not properly handle zero-length raddr opaque data. A malicious or compromised metadata server can exploit this by providing a zero-length...
CVE-2026-80652
A flaw was found in the Linux kernel's Cryptographic Co-processor CCP driver. A local attacker could trigger a kernel crash, leading to a denial of service DoS, by providing a zero-length certificate chain buffer during a Platform Dynamic Hardware PDH export operation. This issue specifically...
CVE-2026-80594
A flaw was found in the Linux kernel's ims-pcu driver. This vulnerability allows a malicious device to trigger an infinite loop by providing a specially crafted descriptor with a zero-length field during the parsing of CDC union descriptors. This can lead to a Denial of Service DoS condition,...
Linux Distros Unpatched Vulnerability : CVE-2026-80652
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to...
libevent: Libevent: Memory corruption due to use-after-free
A flaw was found in Libevent, an event notification library. A use-after-free vulnerability exists in the evbufferaddbufferreference function when it processes an output buffer with a zero length. This can lead to a dangling pointer, which an attacker could exploit to cause memory corruption or...
CVE-2026-80652
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...
UBUNTU-CVE-2026-80652
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...
CVE-2026-80652 crypto: ccp - Treat zero-length cert chain as query for blob lengths
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...
EUVD-2026-67528
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...
CVE-2026-80652
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...
CVE-2026-80652
CVE-2026-80652 affects the Linux kernel 's AMD SEV/CCP driver (drivers/crypto/ccp/sev-dev.c ). When handling a PDH export, a zero-length userspace cert chain buffer is not treated as a blob-length query, causing a BUG_ON() crash at arch/x86/mm/physaddr.c due to a physical-address lookup on ZERO_S...
CVE-2026-26457
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coapdumpmsg function when processing COAP messages containing options with zero length...
CVE-2026-63381
A flaw was found in Libevent, an event notification library. A use-after-free vulnerability exists in the evbufferaddbufferreference function when it processes an output buffer with a zero length. This can lead to a dangling pointer, which an attacker could exploit to cause memory corruption or...
CVE-2026-26457
ccoap (commit 77f55c4b) is vulnerable to a null pointer dereference in the coap_dump_msg() function when processing COAP messages containing options with zero length. The flaw requires no authentication or user interaction and is reachable over the network, leading to a high availability impact (...
