24507 matches found
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
...
wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
...
Bluetooth: hci_sync: Protect UUID list traversal
...
wifi: mac80211_hwsim: clamp virtio RX length before skb_put
...
exec: fix unsigned loop counter wrap in transfer_args_to_stack()
...
ASoC: tas2781: bound firmware description string parsing
...
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
...
mei: bus: access mei_device under device_lock on cleanup
...
drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
...
arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates
...
smb/client: handle overlapping allocated ranges in fallocate
...
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
...
drm/i915/gem: Do not leak siblings[] on proto context error
...
ila: reload IPv6 header after pskb_may_pull in checksum adjust
...
media: stm32: dcmi: unregister notifier on probe failure
...
wifi: nl80211: free RNR data on MBSSID mismatch
...
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
...
ksmbd: validate ACE size against SID sub-authorities
...
ksmbd: bound DACL dedup walk to copied ACEs
...
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
...
binfmt_misc: set have_execfd only once the interpreter is opened
...
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
...
btrfs: reject free space cache with more entries than pages
...
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
...
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
...
Bluetooth: qca: fix NVM tag length underflow in TLV parser
...
wifi: mac80211: tear down new links on vif update error path
...
ipv6: ndisc: fix NULL deref in accept_untracked_na()
...
Rpm: heap buffer overflow in ndb slot table parsing
...
Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
...
Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass
...
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit
...
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
...
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()
...
Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
...
Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
...
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
...
nexthop: initialize extack in nh_res_bucket_migrate()
...
Apache Thrift: Python TSSLSocket Hostname Matcher Import
...
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
...
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
...
Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass
...
smb/client: Fix error code in smb2_aead_req_alloc()
...
ksmbd: validate compound request size before reading StructureSize2
...
nvmet-tcp: Fix potential UAF when ddgst mismatch
...
btrfs: do not trim a device which is not writeable
...
MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
...
crypto: amlogic - avoid double cleanup in meson_crypto_probe()
...