28326 matches found
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
...
media: rc: sunxi-cir: Unregister rc device on probe failure
...
media: zoran: Avoid freeing a registered video_device twice
...
KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
...
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
...
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
...
KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
...
vfio/pci: clear vdev->msi_perm after freeing it on init failure
...
LoongArch: BPF: Refactor jump offset calculation in tail call
...
scsi: qla2xxx: Fix BSG job leak on validate flash image error path
...
media: cedrus: fix memory leak in cedrus_init_ctrls()
...
i2c: mux: Fix channel node leak on adapter add failure
...
mtd: mtdoops: free page bitmap when the backing MTD is removed
...
fs/ntfs3: validate ef->size covers the record's name and value
...
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
...
s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
...
nvme: add missing SRCU grace period in error path
...
media: s2255: check firmware size before reading trailing marker
...
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
...
power: supply: ab8500_fg: fix use-after-free on remove
...
scsi: pm8001: Use rollback index when freeing MSI-X vectors
...
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
...
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
...
drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
...
NFSD: Prevent client use-after-free during blocked-lock reaping
...
media: cec: disable delayed work before freeing an interrupted transmit
...
KVM: s390: Fix old_data leak in guest debug error path
...
f2fs: validate MOVE_RANGE destination size
...
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
...
media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
...
s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
...
mtd: rawnand: validate ONFI extended parameter page sections
...
drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
...
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
...
f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
...
media: i2c: ov7740: fix use-after-destroy in remove
...
media: cx23885: cancel NetUP CI work before teardown
...
powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
...
scsi: target: iscsi: Reserve a terminator byte for the login payload
...
libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.
...
xhci: fix lost bounce buffers on TDs spanning several ring segments
...
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
...
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
...
media: em28xx: fix use-after-free of dev_next->devlist on disconnect
...
scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
...
s390/vfio-ap: Fix NULL deref in status_show() during queue probe
...
mm/huge_memory: transfer the pmd dirty bit to the folio on zap
...
compression vulnerable to Denial of Service via memory leak on premature response close
...