Lucene search
+L

434743 matches found

EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59052

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

5.4AI score0.00198EPSS
SaveExploits0References2
EUVD
EUVD
•added 4 days ago•7 views

EUVD-2026-59050

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops defines that callback. aie4vfops the AIE4 SR-IOV virtual function does...

5.4AI score0.00206EPSS
SaveExploits0References3
EUVD
EUVD
•added 4 days ago•5 views

EUVD-2026-59051

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free in amdxdnagemdmabufmmap When vminsertpages fails, the error path calls vma-vmops-closevma which internally calls drmgemvmclose → drmgemobjectput, releasing the GEM object reference acquired at th...

5.5AI score0.00168EPSS
SaveExploits0References3
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59049

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...

5.5AI score0.00198EPSS
SaveExploits0References2
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59048

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

5.3AI score0.00154EPSS
SaveExploits0References2
EUVD
EUVD
•added 4 days ago•5 views

EUVD-2026-59047

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never checks that log-size is at least log-headersize. fwlogprintbuffer th...

5.7AI score0.00166EPSS
SaveExploits0References5
EUVD
EUVD
•added 4 days ago•8 views

EUVD-2026-59046

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If physdisk-inreset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG...

5.3AI score0.0021EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•8 views

EUVD-2026-59045

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfcsli4driverresourcesetup The memory allocated for mboxq using mempoolalloc is not freed in some of the early exit error paths. Fix that by moving the mempoolfree call to an earlier point after la...

5.4AI score0.00215EPSS
SaveExploits0References6
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59044

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...

5.5AI score0.00205EPSS
SaveExploits0References7
EUVD
EUVD
•added 4 days ago•7 views

EUVD-2026-59043

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

5.5AI score0.00177EPSS
SaveExploits0References7
EUVD
EUVD
•added 4 days ago•4 views

EUVD-2026-59041

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE corescsi3emulateproregisterandmove maps the PERSISTENT RESERVE OUT parameter list with transportkmapdatasg and parses the destination TransportID with...

5.8AI score0.00734EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59042

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...

5.8AI score0.00728EPSS
SaveExploits0References7
EUVD
EUVD
•added 4 days ago•10 views

EUVD-2026-59040

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efcthwioabort When efcthwreqtagalloc fails in efcthwioabort, the error path returns -ENOSPC without releasing the reference obtained via krefgetunlesszero earlier in the function. All other...

5.5AI score0.00215EPSS
SaveExploits0References7
EUVD
EUVD
•added 4 days ago•5 views

EUVD-2026-59039

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix I/O leak on unsupported additional CDB efctdispatchfcpcmd allocates an efctio before dispatching an unsolicited FCP command. If the command has an unsupported additional CDB, the function returns -EIO before...

5.5AI score0.00215EPSS
SaveExploits0References7
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59037

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix use-after-free and double-free in disconnect imspcudisconnect only intended to perform cleanup when the primary control interface is unbound. However, it currently relies on the interface class to distinguish...

5.5AI score0.0022EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59038

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix use-after-free during unmount During unmount or failure teardown all mondata structures that contain monitoring event file private data are freed after which kernfs nodes are removed. However, the RDTDELETED flag ...

5.6AI score0.00168EPSS
SaveExploits0References3
EUVD
EUVD
•added 4 days ago•7 views

EUVD-2026-59036

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - validate control endpoint type The driver currently assumes that the first endpoint of the control interface is an interrupt IN endpoint without verifying it. A malicious device could provide a different endpoint...

5.4AI score0.0022EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•7 views

EUVD-2026-59035

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix firmware leak in async update The firmware object was not being released if validation failed. Use freefirmware to ensure the firmware is always released...

5.4AI score0.00209EPSS
SaveExploits0References5
EUVD
EUVD
•added 4 days ago•5 views

EUVD-2026-59033

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...

5.7AI score0.00215EPSS
SaveExploits0References6
EUVD
EUVD
•added 4 days ago•7 views

EUVD-2026-59034

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt fired for pcu-urbctrl, the actual data resides in...

5.7AI score0.0022EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•4 views

EUVD-2026-59032

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix type confusion in CDC union descriptor parsing The driver currently trusts the bMasterInterface0 from the CDC union descriptor without verifying that it matches the interface being probed. This could lead to...

5.5AI score0.0022EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59031

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on probe failure The vub300 driver lifetime-manages its controller state using vub300-kref, with vub300delete freeing the mmc host when the last reference is dropped. The probe error path after the...

5.7AI score0.00219EPSS
SaveExploits0References3
EUVD
EUVD
•added 4 days ago•5 views

EUVD-2026-59029

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Fix use-after-free in usereventmmdup usereventmmdup walks the parent mm's enabler list locklessly under rcureadlock during fork from copyprocess; it does not take eventmutex: rcureadlock;...

5.6AI score0.0017EPSS
SaveExploits0References5
EUVD
EUVD
•added 4 days ago•7 views

EUVD-2026-59030

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx freed the per-SC metadatadst with metadatadstfree, which kfrees the object unconditionally and ignor...

5.6AI score0.00171EPSS
SaveExploits0References6
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59028

In the Linux kernel, the following vulnerability has been resolved: wifi: libertastf: fix use-after-free in lbtffreeadapter lbtffreeadapter calls timerdelete&priv-commandtimer, which does not wait for a running commandtimerfn callback. lbtffreeadapter runs on the teardown path right before...

5.5AI score0.00209EPSS
SaveExploits0References5
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59027

In the Linux kernel, the following vulnerability has been resolved: locking/rt: Fix the incorrect RCU protection in rtspinunlock rtspinunlock releases the RCU protection before unlocking the lock. That opens the door for the following UAF scenario: T1 T2 spinlock&p-lock; rcureadlock; invalidatep;...

5.4AI score0.00663EPSS
SaveExploits0References5
EUVD
EUVD
•added 4 days ago•4 views

EUVD-2026-59026

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Use u64 multiplication in updaterlimitcpu updaterlimitcpu converts the RLIMITCPU value to nanoseconds with u64 nsecs = rlimnew NSECPERSEC; On 32-bit kernels both rlimnew unsigned long and NSECPERSEC 1000000000L...

5.3AI score0.0022EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59025

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhpinvokecallback unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the...

5.3AI score0.00176EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•5 views

EUVD-2026-59024

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output statesshow adds CPU hotplug state names into a single sysfs buffer using sprintf. With enough registered states, this can write past the end of the PAGESIZE buffer. Use sysfsemitat ...

5.3AI score0.00176EPSS
SaveExploits0References7
EUVD
EUVD
•added 4 days ago•5 views

EUVD-2026-59022

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

5.7AI score0.00553EPSS
SaveExploits0References2
EUVD
EUVD
•added 4 days ago•8 views

EUVD-2026-59023

In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted...

5.3AI score0.00663EPSS
SaveExploits0References5
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59021

In the Linux kernel, the following vulnerability has been resolved: gpio: tegra: do not call pinctrl for GPIO direction tegragpiodirectioninput and tegragpiodirectionoutput already program the GPIO controller direction registers directly. The additional pinctrlgpiodirectioninput/output calls do n...

5.5AI score0.00209EPSS
SaveExploits0References5
EUVD
EUVD
•added 4 days ago•4 views

EUVD-2026-59020

In the Linux kernel, the following vulnerability has been resolved: gpio: mt7621: avoid corruption of shared interrupt trigger state The bank-shared fields like 'rising' and 'falling' are modified using non-atomic read-modify-write operations. Since every gpio chip instance represents an entire...

5.5AI score0.00209EPSS
SaveExploits0References5
EUVD
EUVD
•added 4 days ago•4 views

EUVD-2026-59019

In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAPNETADMIN in the device netns for changelink ipip6changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

5.5AI score0.00176EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•5 views

EUVD-2026-59018

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssgndogetstats64 unconditionally calls emacgetstatbyname with FW PA stat names regardless of whether the PA stats block is present on the hardware. emacgetstatbyname already guard...

5.5AI score0.00206EPSS
SaveExploits0References3
EUVD
EUVD
•added 4 days ago•5 views

EUVD-2026-59017

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xxcldmalateinit creates mdctrl-gpddmapool before initializing the TX and RX rings. If any ring initialization fails, the error path frees the already initialized ring...

5.3AI score0.00215EPSS
SaveExploits0References6
EUVD
EUVD
•added 4 days ago•4 views

EUVD-2026-59016

In the Linux kernel, the following vulnerability has been resolved: net: ixp4xxhss: fix duplicate HDLC netdev allocation ixp4xxhssprobe allocates two HDLC netdevs. The first one is stored in ndev, initialized, and registered with registerhdlcdevice. The second one is stored in port-netdev and lat...

5.5AI score0.00215EPSS
SaveExploits0References6
EUVD
EUVD
•added 4 days ago•5 views

EUVD-2026-59015

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: preserve tcskbcb across defragmentation tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defrag helper clears IPCB/IP6CB, which aliases the tcskbcb/qdiscskbcb control buffe...

5.4AI score0.00552EPSS
SaveExploits0References5
EUVD
EUVD
•added 4 days ago•5 views

EUVD-2026-59014

In the Linux kernel, the following vulnerability has been resolved: net: ena: clean up XDP TX queues when regular TX setup fails createqueueswithsizebackoff creates XDP TX queues before setting up the regular TX path. If the subsequent allocation or creation of regular TX queues fails, the error...

5.4AI score0.0022EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•9 views

EUVD-2026-59013

In the Linux kernel, the following vulnerability has been resolved: net: ip6vti: require CAPNETADMIN in the device netns for changelink vti6changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than...

5.4AI score0.00164EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•7 views

EUVD-2026-59012

In the Linux kernel, the following vulnerability has been resolved: net: ipvti: require CAPNETADMIN in the device netns for changelink vtichangelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

5.4AI score0.00164EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•4 views

EUVD-2026-59010

In the Linux kernel, the following vulnerability has been resolved: net: ip6gre: require CAPNETADMIN in the device netns for changelink ip6grechangelink and ip6erspanchangelink operate on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or...

5.4AI score0.00164EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•4 views

EUVD-2026-59011

In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAPNETADMIN in the device netns for changelink ipipchangelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

5.4AI score0.00164EPSS
SaveExploits0References6
EUVD
EUVD
•added 4 days ago•7 views

EUVD-2026-59009

In the Linux kernel, the following vulnerability has been resolved: net: ip6tunnel: require CAPNETADMIN in the device netns for changelink ip6tnlchangelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other...

5.4AI score0.00163EPSS
SaveExploits0References5
EUVD
EUVD
•added 4 days ago•7 views

EUVD-2026-59008

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Free BPID bitmap on setup failure nixsetupbpids allocates bp-bpids with rvuallocbitmap, which uses a plain kcalloc. If any of the following devmkcalloc allocations for the BPID mapping arrays fails, the function...

5.3AI score0.002EPSS
SaveExploits0References4
EUVD
EUVD
•added 4 days ago•5 views

EUVD-2026-59006

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix casctl leak on spiasync failure ca8210spitransfer allocates casctl with kzallocobjGFPATOMIC and relies entirely on the SPI completion callback ca8210spitransfercomplete to free it. The spiasync API only...

5.5AI score0.0021EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•7 views

EUVD-2026-59007

In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154NL family ops table builds the LLSEC dump entries LLSECLISTKEY, LLSECLISTDEV, LLSECLISTDEVKEY, LLSECLISTSECLEVEL with...

5.4AI score0.0016EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59005

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210testintdriverwrite and ca8210testintuserread exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to...

5.8AI score0.0021EPSS
SaveExploits0References8
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59003

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvumboxhandlerlmtsttblsetup uses req-basepcifunc as a direct index into the LMT map table to read another function's LMTLINE physical base address and copy it into th...

5.4AI score0.00163EPSS
SaveExploits0References5
EUVD
EUVD
•added 4 days ago•6 views

EUVD-2026-59004

In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...

5.9AI score0.00626EPSS
SaveExploits0References4
Total number of security vulnerabilities434743