28424 matches found
blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
...
libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
...
netfilter: ip6t_hbh: reject oversized option lists
...
tarfile opened in streaming mode mishandles EOF
...
jq: stack overflow in deep structural equality
...
wifi: nl80211: reject oversized EMA RNR lists
...
drm/amd/display: Bound VBIOS record-chain walk loops
...
net/sched: act_api: use RCU with deferred freeing for action lifecycle
...
netfilter: nf_conntrack_sip: don't use simple_strtoul
...
jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow
...
net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
...
HAProxy - Integer Overflow in FCGI Demux Record Length Field
...
thunderbolt: Limit XDomain response copy to actual frame size
...
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
...
HAProxy - NULL Pointer Dereference in hpack_dht_insert Function
...
misc: fastrpc: fix DMA address corruption due to find_vma misuse
...
sctp: diag: reject stale associations in dump_one path
...
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
...
thunderbolt: Validate XDomain request packet size before type cast
...
vdpa: use generic driver_override infrastructure
...
bpf: Fix stale offload->prog pointer after constant blinding
...
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
...
wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet
...
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.
...
tipc: fix double-free in tipc_buf_append()
...
bonding: 3ad: implement proper RCU rules for port->aggregator
...
drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
...
net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
...
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
...
tcp: restrict SO_ATTACH_FILTER to priv users
...
io_uring/poll: fix signed comparison in io_poll_get_ownership()
...
xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
...
nexthop: fix IPv6 route referencing IPv4 nexthop
...
net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
...
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
...
netlabel: validate unlabeled address and mask attribute lengths
...
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
...
netfilter: bridge: make ebt_snat ARP rewrite writable
...
Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service
...
batman-adv: v: stop OGMv2 on disabled interface
...
batman-adv: tp_meter: avoid use of uninit sender vars
...
Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions
...
ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
...
libexpat before 2.8.2 has an integer overflow in storeAtts.
...
drm/vc4: fix krealloc() memory leak
...
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
...
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
...
ipvs: clear the svc scheduler ptr early on edit
...