24507 matches found
net/iucv: fix use-after-free of a severed iucv_path
...
iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
...
drm/i915: Return NULL on error in active_instance
...
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
...
wifi: mt76: mt7915: guard HE capability lookups
...
mm/damon/core: disallow overlapping input ranges for damon_set_regions()
...
wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()
...
phonet: pep: fix use-after-free in pep_get_sb()
...
geneve: require CAP_NET_ADMIN in the device netns for changelink
...
bpf, sockmap: Reject unhashed UDP sockets on sockmap update
...
wifi: brcmfmac: make release_scratchbuffers idempotent
...
media: cx23885: add ioremap return check and cleanup
...
media: nxp: imx8-isi: Fix potential out-of-bounds issues
...
firewire: net: Fix fragmented datagram reassembly
...
IB/mad: Drop unmatched RMPP responses before reassembly
...
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
...
bonding: fix devconf_all NULL dereference when IPv6 is disabled
...
sctp: auth: verify auth requirement when auth_chunk is NULL
...
intel_th: fix MSC output device reference leak
...
vxlan: mdb: Fix source list corruption on a failed replace
...
Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
...
RDMA/irdma: Prevent rereg_mr for non-mem regions
...
ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
...
libceph: guard missing CRUSH type name lookup
...
watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
...
drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()
...
ALSA: seq: close a re-opened queue timer in the destructor
...
wifi: cfg80211: validate PMSR FTM preamble range
...
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
...
pds_core: fix auxiliary device add/del races
...
media: meson: vdec: Fix memory leak in error path of vdec_open
...
wifi: ath6kl: fix OOB access from firmware ADDBA window size
...
net/x25: fix use-after-free in x25_kill_by_neigh()
...
RDMA/siw: publish QP after initialization
...
usb: gadget: printer: fix infinite loop in printer_read()
...
libceph: reject zero bucket types in crush_decode
...
openvswitch: fix GSO userspace truncation underflow
...
media: pwc: Drain fill_buf on start_streaming() failure
...
nfp: Check resource mutex allocation
...
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
...
usb: gadget: function: rndis: add length check to response query
...
mm/damon/core: validate ranges in damon_set_regions()
...
media: ti: vpe: unwind v4l2 device registration on probe error
...
media: pci: dm1105: Free allocated workqueue
...
drm/amdgpu/vce: fix integer overflow in image size
...
btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
...
libceph: refresh auth->authorizer_buf{,_len} after authorizer update
...
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
...