397917 matches found
CVE-2026-100172 Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes
The AIL Framework ail-project/ail-framework contains a stored cross-site scripting XSS vulnerability in two Jinja2 templates that render popovers for matched, tracked, or tagged content: var/www/templates/chatsexplorer/blockmessage.html and var/www/templates/objects/item/showitem.html. In both...
CVE-2026-80430 Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory
Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdirdatafordrag in kitty/dnd.c...
CVE-2026-98161 nvdimm: pmem: keep PREFLUSH before data writes
In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmemsubmitbio records a REQPREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQFUA flush. That lets data writes run after a fail...
CVE-2026-98162 smb/server: fix tree connection leak in smb2_tree_connect()
In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2treeconnect See the procedure below: smb2treeconnect ksmbdtreeconnconnect xastore&sess-treeconns, treeconn-id, treeconn ksmbdcounterincKSMBDCOUNTERTREECONNS ksmbdsharetreeconnincsc...
CVE-2026-98160 staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtwsdioif1init padapter-HalData is allocated via vzalloc, but incorrectly freed using kfree in the rtwsdioif1init error path. Using kfree to release this vmalloc-backed buffer...
CVE-2026-100078 wifi: iwlwifi: mei: pass correct argument to function
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: pass correct argument to function The first argument to iwlmeiwritecyclicbuf should be the cldev but the qhead pointer is passed instead. Fix it...
CVE-2026-100079 usb: typec: ucsi: unregister debugfs entries on teardown
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: unregister debugfs entries on teardown ucsiregister creates per-instance debugfs entries, but ucsiunregister keeps them around until ucsidestroy. Drivers like ucsiglink that unregister/register the same UCSI...
CVE-2026-100076 staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix xmitframe/xmitbuf leaks on mgnt-frame error paths issuebeacon, issueprobersp and issueasocrsp obtain a management xmitframe together with its xmitbuf from the driver's fixed-size management-TX pools via...
CVE-2026-100077 drm/msm: Recover HW before retire hung submit
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in GPU pagefaults since the GPU may be...
CVE-2026-100075 RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srptallocrwctxs unwind counters When srptallocrwctxs fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale nrwctx and nrdma values and a dangling rwctxs...
CVE-2026-100073 ext4: fix transaction overflow during writeback
In the Linux kernel, the following vulnerability has been resolved: ext4: fix transaction overflow during writeback Commit 95ad8ee45cdb "ext4: correct the reserved credits for extent conversion" was correct to note that we need to reserve enough credits for all extents possibly underlying a large...
CVE-2026-100074 bpf: Mark bpf_refcount field as unique
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfrefcount field as unique BPFREFCOUNT is not marked as a unique field, while it should be. Fix this oversight...
CVE-2026-100072 ACPI: platform: Use acpi_bus_get_primary_device()
In the Linux kernel, the following vulnerability has been resolved: ACPI: platform: Use acpibusgetprimarydevice The acpigetfirstphysicalnode usage in acpiplatformfillresource and acpicreateplatformdevice is generally unsafe because in theory the device returned by it may be freed at any time 1. I...
CVE-2026-100071 net: hsr: free learned nodes on device setup failure
In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsrdevfinalize can fail after a lower-device RX handler has already been registered slave A is added before the failable slave B and interlink adds. RX handlers run in softirq...
CVE-2026-100070 netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnatsip: rewind offset when NAT shrinks the packet sashiko says: If mapaddr changes the packet length, such as when the public NAT IP string is shorter or longer than the internal IP, coff will still point to the offs...
CVE-2026-97864 GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication
A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...
CVE-2026-95832 Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because colorcontrol in kitty/window.py...
CVE-2026-97875 DNS rebinding vulnerability in rojo serve HTTP API
Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...
CVE-2026-98159 wifi: mt76: mt7921: validate CLC firmware records
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: validate CLC firmware records The CLC region is supplied by firmware, but the loader trusts the region count and each record length. A malformed image can make the region table pointer precede the firmware...
CVE-2026-98157 EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
In the Linux kernel, the following vulnerability has been resolved: EDAC/devicesysfs: Use kstrtouint for pollmsec to prevent truncation The pollmsec sysfs store file uses simplestrtoul which accepts an unsigned long, but the target field pollmsec is unsigned int. On 64-bit systems, a value UINTMA...
CVE-2026-98158 ppp_async: drop the errored frame instead of resetting its headroom
In the Linux kernel, the following vulnerability has been resolved: pppasync: drop the errored frame instead of resetting its headroom pppreceivenonmpframe prepends a two-byte direction tag before running the pass/active BPF filters: be16 skbpushskb, 2 = htonsPPPFILTERINBOUNDTAG; Nothing on the...
CVE-2026-98156 drm/virtio: use the DMA API for resource backing on Xen
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtioring.c handles this correctly, vringusemapapi...
CVE-2026-98155 accel/qaic: Address potential out-of-bounds read in resp_worker()
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in respworker Although 'commit 2feec5ae5df7 "accel/qaic: Handle DBC deactivation if the owner went away"' fixes the scenario it was intended for by walking the message and only...
CVE-2026-98154 nvme-rdma: fix -EIO cleanup order in queue_rq
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queuerq On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double...
CVE-2026-98153 nvme: fix racy access to FDP placement id array
In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp registration. But nothing protects that pair from concurrent access -...
CVE-2026-98152 nvmet-rdma: fix queue leak when connect backlog is exceeded
In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources...
CVE-2026-98151 bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic Take the following unprivileged program as an example: r0 = bpfmaplookupelem... / PTRTOMAPVALUE, offset 0 / ... 14: r0 += r1 / r1 is a bounded scalar / 15: r9 = ...
CVE-2026-98150 bpf: Fix BPF_F_CPU validation for sparse CPU IDs
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPFFCPU validation for sparse CPU IDs BPFFCPU stores the target CPU ID in the upper 32 bits of the map operation flags. bpfmapcheckopflags currently compares that ID with numpossiblecpus, which is the number of possible...
CVE-2026-98149 bpf: Fix percpu map update indexing with sparse CPU IDs
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array, hash, and cgroup storage map updates without BPFFCPU or BPFFALLCPUS use a value buffer whose per-CPU slots are packed in possible-CPU order. The buffer is siz...
CVE-2026-98148 drm/gud: validate GUD_ROTATION_0 is present in supported rotations
In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...
CVE-2026-98147 printk: Don't WARN on kthread_run failure.
In the Linux kernel, the following vulnerability has been resolved: printk: Don't WARN on kthreadrun failure. Since kthreadcreateonnode returns -EINTR upon SIGKILL, we should not use WARNON in order to catch kthreadrun failure...
CVE-2026-98146 accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...
CVE-2026-98144 accel/amdxdna: put the chained BO when its mapping fails
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in...
CVE-2026-98145 accel/amdxdna: reject a command chain that carries no commands
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...
CVE-2026-98143 accel: ethosu: Don't read the U65 rounding mode as a storage mode
In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits 15:14 of NPUSETIFM,OFMPRECISION select the activation storage mode on U85 only. On U65 the same field holds the rounding mode, and the command stream parser h...
CVE-2026-98141 ntfs: propagate reparse index insertion failure
In the Linux kernel, the following vulnerability has been resolved: ntfs: propagate reparse index insertion failure updatereparsedata ignores the return value of setreparseindex. When index insertion fails, the code removes the just-written reparse data as cleanup but still returns 0, so symlink2...
CVE-2026-98142 drm/cirrus-qemu: Validate BAR0 size during probe
In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...
CVE-2026-98140 ntfs: fix kmap_local leak in write_mft_record_nolock() error paths
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix kmaplocal leak in writemftrecordnolock error paths writemftrecordnolock maps the MFT record folio with kmaplocalfolio, but the prewritemstfixup and bioaddfolio failure paths jump to the error label without unmapping it...
CVE-2026-98138 ntfs: do not mark the volume clean in sync_fs when errors were recorded
In the Linux kernel, the following vulnerability has been resolved: ntfs: do not mark the volume clean in syncfs when errors were recorded ntfsputsuper and the remount-read-only path both clear the dirty bit only when NVolErrorsvol is false. ntfssyncfs clears it unconditionally, so any sync on a...
CVE-2026-98139 ntfs: only count successfully cleared runs when freeing clusters
In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping condition is false, which includes cases where ntfsbitmapclearrun actually...
CVE-2026-98136 ntfs: bound $AttrDef table walk to the loaded table size
In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfsattrfindinattrdef walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry: for ad = vol-attrdef; u8 ad - u8...
CVE-2026-98137 ntfs: treat any nonzero dio zero-range return as an error
In the Linux kernel, the following vulnerability has been resolved: ntfs: treat any nonzero dio zero-range return as an error ntfsdiozerorange returns either 0 or a negative errno from blkdevissuezeroout; it never returns a positive value. The zeroing failure check in ntfsattrfallocate therefore...
CVE-2026-98135 ntfs: reject invalid sectors_per_cluster in the boot sector
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid sectorspercluster in the boot sector isbootsectorntfs checks the boot sector's sectorspercluster field with a range test that rejects 0x81..0xf3 but accepts 0 and other non-power-of-two counts. A zero value...
CVE-2026-98133 ntfs: leave HasEA flag untouched on setxattr failure
In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfssetea, the exit path unconditionally updates the HasEA flag based on eainfoqsize. When an error occurs before eainfoqsize is updated, NInoClearHasEA hides existing on-di...
CVE-2026-98134 bpf: check_cond_jmp_op(): properly infer if register is null
In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...
CVE-2026-98132 bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO
In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACKZERO states.c:cleanfuncstate can downgrade scalar zero spill to STACKZERO in the following case: u64 r10 - 8 = 0; ... checkpoint ... r1 = u32 r10 - 4; ... no reads from...
CVE-2026-98131 net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmactsoxmit In stmmactsoxmit, if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped before t...
CVE-2026-98130 sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTPCMDTIMERSTART The SCTPCMDTIMERSTART handler checks timerpending before calling timerreduce. The timer can expire and detach between these operations, causing timerreduce to rearm the timer without...
CVE-2026-98129 scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...
CVE-2026-98128 scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...