Lucene search
+L
CvelistRecent

397935 matches found

Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97945 x86/mm: Fix user-space data loss with MADV_FREE and THP

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix user-space data loss with MADVFREE and THP Some of users of Polars a data analytics library have lost production data from this bug. They seem to have just the right combination of huge pages, MADVFREE and heavy recla...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97944 x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()

In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfigetfunchash The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97942 x86/alternatives: Exclude text poking against change_page_attr()

In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Exclude text poking against changepageattr From time to time, the following BUG can be observed in the x86 alternatives patching code 0: kernel BUG at arch/x86/kernel/alternative.c:2576! Oops: invalid opcode: 00...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97943 x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm write lock on collapse to avoid UAF x86 implements page attribute modification using its Change Page Attributes CPA mechanism. This tracks properties of ranges such as cache mode through x86 page...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•3 views

CVE-2026-97941 mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race

In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n-listlock in slabtryreturnfreelist to avoid race Commit ba7425312607 "mm, slab: add an optimistic slabtryreturnfreelist" incorrectly assumed that nobody has freed an object to the slab as long as slab-freelist is...

SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97939 ipmr: account multicast table and route memory

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRTTABLE and MRT6TABLE. Each unseen id allocates an mrtable via the shared mrtablealloc...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•3 views

CVE-2026-97940 ipv6: fix fib6 walker UAF on seq stop

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6routeiteractive treats a walker in FWSU at the table root as already unlinked. fib6delroute can move a still-linked walker into that same state when the current leaf is the last route at...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97937 ftrace: fork: Initialize function graph state before copy_exec_state()

In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize function graph state before copyexecstate duptaskstruct copies the parent's taskstruct, including retstack. ftracegraphinittask clears the copied function graph state, but it currently runs after...

SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•3 views

CVE-2026-97938 reboot: fix cad_pid use-after-free race

In the Linux kernel, the following vulnerability has been resolved: reboot: fix cadpid use-after-free race cadpid is a single kernel-wide struct pid pointer. procdocadpid reads it and passes it to pidvnr without protecting the lifetime of the referenced struct pid. A concurrent writer can replace...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97936 tracing: Fix memory corruption from the histogram stacktrace modifier

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from the histogram stacktrace modifier parsefield sets HISTFIELDFLSTACKTRACE from the ".stacktrace" modifier before it looks the field name up, and nothing afterwards checks that the name resolved t...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97935 tracing: Set the trace clock before registering the histogram trigger

In the Linux kernel, the following vulnerability has been resolved: tracing: Set the trace clock before registering the histogram trigger histregistertrigger puts the trigger on the global namedtriggers list in cmdops-init, and only then sets the trace clock: if data-cmdops-init ret =...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97934 tracing: Fix memory corruption from a "STACKTRACE" histogram key

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parsefield...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97933 tracing: Take trace_array reference when opening a tracer options file

In the Linux kernel, the following vulnerability has been resolved: tracing: Take tracearray reference when opening a tracer options file When a tracer option file is opened, it is passed a descriptor that points to an element on the tracearray's topts array. This element has information to find...

SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•3 views

CVE-2026-97931 ALSA: us122l: Prevent write upgrades for read mappings

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE set on mappings created with PROTREAD. A process that can open the hwd...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•3 views

CVE-2026-97932 tracing: Don't dereference trace_event_file in deferred trigger free

In the Linux kernel, the following vulnerability has been resolved: tracing: Don't dereference traceeventfile in deferred trigger free The enableevent trigger defers traceeventputref to the trigger free kthread, but the traceeventfile can already be freed when the instance is removed. Keep the...

SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97930 ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: fix in04last array size mismatch with in04buf The in04last array in struct usx2ydev is declared as char24, but in04buf is allocated as sizeofstruct us428ctls which is 21 bytes. In iusx2yin04int, when ctlsnapshotla...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97929 ALSA: usbusx2y: validate URB actual_length in interrupt callback

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actuallength in interrupt callback iusx2yin04int processes the interrupt URB data without checking urb-actuallength. A short transfer from a malfunctioning device would cause the handler to process...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97928 drm/amdgpu: skip the VMID 0 flush for VRAM

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: skip the VMID 0 flush for VRAM Clear-on-release only runs on VRAM, which amdgputtmmapbuffer reaches via its direct MC address without programming a GART window, yet the wipe still forces a VMID 0 flush. On GFX11 e.g...

SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97926 ufs: validate cylinder group metadata before caching it

In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group metadata before caching it ufsreadcylinder copies the cylinder group index and the rotor positions straight from the on-disk group and caches them without any check: ucpi-ccgx = fs32tocpusb, ucg-cgcgx...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97927 ufs: create the root dentry after loading cylinder metadata

In the Linux kernel, the following vulnerability has been resolved: ufs: create the root dentry after loading cylinder metadata ufsfillsuper installed sb-sroot before it loaded the cylinder group structures for a writable mount: sb-sroot = dmakerootinode; ... if !sbrdonlysb if...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97925 tick/broadcast: Plug clockevents replacement race

In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Plug clockevents replacement race 朱恺乾 reported and decoded the following race condition when a broadcast device is replaced: CPUA CPUB tickbroadcastoneshotcontrol bc = tickbroadcastdevice.evtdev;...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•3 views

CVE-2026-97923 tracing: Free histogram the var ref when its initialization fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the var ref when its initialization fails createvarref allocates a VARREF histfield and then calls initvarref to fill it in. When that fails the field is leaked. commit 656fe2ba85e8 "tracing: Use hist...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97924 tracing/user_events: Don't destroy fields when event removal fails

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Don't destroy fields when event removal fails destroyuserevent destroys the event's fields before attempting to remove the trace event call. If usereventsetcallvisible fails, e.g. because the event is still...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97922 tracing: Free histogram var refs regardless of how often they are referenced

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram var refs regardless of how often they are referenced Using the same variable three or more times in one hist trigger leaks the variable reference and its strings when the trigger is removed. commit...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97921 tracing: Free histogram the field rejected for a bad modifier

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the field rejected for a bad modifier Writing a hist trigger whose value or variable carries a modifier that is not allowed there leaks the fields that were built for it. createvalfield takes the field fro...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•6 views

CVE-2026-97920 tracing: Keep the entry count when the histogram stats allocation fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails printentries uses nentries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails overwrite...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97919 tracing: Take the reference before publishing the named histogram trigger

In the Linux kernel, the following vulnerability has been resolved: tracing: Take the reference before publishing the named histogram trigger eventhisttriggernamedinit puts the trigger on the global namedtriggers list and only then takes the reference on the trigger it shares its histogram with:...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97918 tracing: Undo the registration when enabling the histogram trigger fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Undo the registration when enabling the histogram trigger fails Commit 6f86bdeab633 "tracing: Fix bad hist from corrupting namedtriggers list" described how a trigger that is registered but not on file-triggers ends up...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97917 accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97916 accel/ivpu: Validate firmware log buffer metadata

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97915 accel/ivpu: Limit firmware log name prints to field size

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97914 accel: ethosu: Fix ethosu_job_open() return value

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix ethosujobopen return value A WARNON returns a 0 or 1, not the original negative errno. Just drop the WARNON as the FD open will pass the return code to userspace and there's only one possible source of the erro...

SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•3 views

CVE-2026-97912 accel: ethosu: Ensure SRAM size is 0 on mapping failure

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM size is 0 on mapping failure On a mapping failure of the SRAM, the SRAM size is left as non-zero. The probe will succeed as the error return is not checked since having SRAM is not a hard requirement. T...

SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97913 accel: ethosu: Ensure cmd stream ends with a stop op

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure cmd stream ends with a stop op While the QSIZE register setting should prevent an out of bounds access of the command stream, it is not clear whether the h/w generates an interrupt in this case as is require...

SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•3 views

CVE-2026-97910 ASoC: sprd: validate compress buffer sizes against fixed allocations

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprdplatformcompropen allocates the stage 0 IRAM buffer 32K data area and the stage 1 DDR buffer 2M data area with fixed sizes, but sprdplatformcomprcopy derive...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97911 accel: ethosu: Ensure SRAM region size matches job

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register...

SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97909 ASoC: sti: initialize IRQ lock before requesting IRQ

In the Linux kernel, the following vulnerability has been resolved: ASoC: sti: initialize IRQ lock before requesting IRQ unireaderinit registers the shared IRQ before initializing reader-irqlock. A pending interrupt can invoke the handler while the lock is still uninitialized. Initialize the lock...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97908 Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97907 Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When keyid from chip is zero, rtlbtparsefirmwarev2 intentionally ignores all security headers. However, the implementation simply breaks from a switch...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97905 cpufreq: zero-initialize policy cpumask before sysfs publication

In the Linux kernel, the following vulnerability has been resolved: cpufreq: zero-initialize policy cpumask before sysfs publication cpufreqpolicyalloc allocates policy-cpus with alloccpumaskvar, i.e. without GFPZERO, unlike the sibling relatedcpus and realcpus masks. With CONFIGCPUMASKOFFSTACK=y...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97906 bootconfig: Fix integer overflow in initrd size check

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in getbootconfigfrominitrd, a crafted initrd with a huge bootconfig size such as 0xFFFFFFFF can cause the pointer arithmetic: data = void hdr - size; to...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•3 views

CVE-2026-97904 cpufreq: initialize policy rwsem before sysfs publication

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•3 views

CVE-2026-97903 exit: hold a reference to thread_pid across proc_flush_pid

In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to threadpid across procflushpid Commit 0a36bad01731 "releasetask: kill the no longer needed get/putpidthreadpid" removed the reference around procflushpid. It assumed that freepidspost.pids at the end of...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97902 fs: don't return -EINVAL for successful nested thaw

In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested thaw Commit 7366f8b6fc6a "fs: handle freezing from multiple devices" replaced the freezeholders bitmask with per-holder counters to allow nested freezes. In the bitmask version, a th...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•5 views

CVE-2026-97901 genetlink: pin family module during policy dump

In the Linux kernel, the following vulnerability has been resolved: genetlink: pin family module during policy dump The generic netlink controller's policy dump keeps pointers to the target family's operation and policy tables in its callback state. A dump may be split across multiple skbs and...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97900 drm/drm_exec: fix up contended obj when num_objects is 0

In the Linux kernel, the following vulnerability has been resolved: drm/drmexec: fix up contended obj when numobjects is 0 drmexecpreparearray silently returns success without calling drmexeclockcontended when numobjects is zero. This breaks the invariant upheld by drmexeclockobj, where every ent...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97899 drm/i915: Fix memory leak in query_perf_config_list()

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix memory leak in queryperfconfiglist When krealloc fails, free the original oaconfigids before returning to avoid a memory leak. cherry picked from commit 9977e9d84f46d4f12ad35fbbc0ec4638554bce87...

SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97621 drm/rockchip: analogix_dp: fix unchecked bound endpoint name length

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogixdp: fix unchecked bound endpoint name length rockchipdpdrmencoderenable uses sprintf to format a device tree path into a 32-byte stack buffer. Device tree paths are not limited to this size, so a sufficientl...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97620 drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches emitrendercacheflush sets PIPECONTROL0HDCPIPELINEFLUSH to flush the L2/HDC data cache before fence signalling, but it never requests a flush of the LSC untyped L1...

SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/25 10:22 a.m.•4 views

CVE-2026-97618 io_uring/net: don't overconsume buffers when using MSG_TRUNC

In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't overconsume buffers when using MSGTRUNC When a recv/recvmsg is issued with MSGTRUNC and the incoming packet is larger than the provided buffer, the net layer returns the full length of the packet rather than th...

SaveExploits0References3
Total number of security vulnerabilities397935