28854 matches found
NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
...
xfrm: clear trailing padding in build_polexpire()
...
af_unix: read UNIX_DIAG_VFS data under unix_state_lock
...
batman-adv: reject oversized global TT response buffers
...
openvswitch: validate MPLS set/set_masked payload length
...
HID: alps: fix NULL pointer dereference in alps_raw_event()
...
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
...
bridge: br_nd_send: linearize skb before parsing ND options
...
rxrpc: fix reference count leak in rxrpc_server_keyring()
...
media: as102: fix to not free memory after the device is registered in as102_usb_probe()
...
net: sched: act_csum: validate nested VLAN headers
...
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
...
netfilter: xt_multiport: validate range encoding in checkentry
...
PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup
...
openvswitch: defer tunnel netdev_put to RCU release
...
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
...
KVM: x86: Use scratch field in MMIO fragment to hold small write values
...
crypto: af_alg - limit RX SG extraction by receive buffer budget
...
net: stmmac: fix integer underflow in chain mode
...
rxrpc: only handle RESPONSE during service challenge
...
net/sched: sch_netem: fix out-of-bounds access in packet corruption
...
mptcp: fix slab-use-after-free in __inet_lookup_established
...
netfilter: ip6t_eui64: reject invalid MAC header for all packets
...
pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled
...
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
...
x86/CPU: Fix FPDSS on Zen1
...
wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit
...
rxrpc: proc: size address buffers for %pISpc output
...
nfc: llcp: add missing return after LLCP_CLOSED checks
...
KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish
...
rxrpc: Fix key reference count leak from call->key
...
seg6: separate dst_cache for input and output paths in seg6 lwtunnel
...
batman-adv: hold claim backbone gateways by reference
...
usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
...
vfio/xe: Reorganize the init to decouple migration from reset
...
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
...
ASoC: qcom: q6apm: move component registration to unmanaged version
...
mm/userfaultfd: fix hugetlb fault mutex hash calculation
...
smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
...
s390/mm: Add missing secure storage access fixups for donated memory
...
ksmbd: validate EaNameLength in smb2_get_ea()
...
net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
...
PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown
...
rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1
...
spi: spi-dw-dma: fix print error log when wait finish transaction
...
xfrm_user: fix info leak in build_report()
...
i2c: s3c24xx: check the size of the SMBUS message before using it
...
arm64: mm: Handle invalid large leaf mappings correctly
...