32226 matches found
SUNRPC: fix gssx_dec_option_array error path bugs
...
HID: roccat: free buffered reports when destroying device
...
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
...
nvme-tcp: fix host memory disclosure on R2T for a read command
...
NFSD: Prevent client use-after-free during delegation revoke
...
Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)
...
svcrdma: Reject connection when transport allocation fails
...
net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
...
ip6_gre: fix hardware header length for NBMA tunnels
...
ALSA: virmidi: Check card index validity at probe
...
Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block
...
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
...
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
...
Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)
...
Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound
...
timers/itimer: Zero-init old itimerval before copy to userspace
...
dm raid1: reserve space for NUL-terminator in build_constructor_string()
...
ALSA: portman2x4: Check card index validity at probe
...
power: supply: bq25890: Fix power_supply reference leak
...
power: supply: twl4030_charger: cancel workers via devm
...
audit: avoid dropping live tree ref on fsnotify rule autoremove
...
usb: gadget: midi2: remove default configfs groups on teardown
...
Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
...
ALSA: mts64: Check card index validity at probe
...
mm/mglru: fix and remove redundant unevictable folio handling
...
nfsd: validate symlink target length in NFSv4 CREATE
...
lockd, nfsd: RCU-protect nlmsvc_ops dispatch
...
remoteproc: scp: Fix device reference leak on failed lookup
...
mm/kmemleak: avoid soft lockup when scanning task stacks
...
PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()
...
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
...
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
...
ocfs2: always run deallocs on copy-on-write completion
...
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
...
eventfs: Initialize ei->children and ei->list in init_ei()
...
net/smc: fix socket refcount leak in smc_switch_conns()
...
cifs: call pagecache_isize_extended() in cifs_setsize() when extending
...
ip: orphan prefetched skbs before multicast forwarding
...
w1: ds28e17: reject an oversize length on an I2C block read
...
power: supply: max17040: propagate register read errors
...
sunrpc: defer rq_argp and rq_resp free until after RCU grace period
...
iommu/vt-d: Force requesting ACS when tboot is enabled
...
platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
...
nfsd: revoke copy-notify stateids before dropping their reference
...
openvswitch: only skb_tx_error() a packet we are about to drop
...
net: skbuff: don't touch shared zerocopy state in skb_tx_error()
...
ipmi: si: Fix NULL pointer dereference after failed registration
...
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
...