24507 matches found
udf: validate sparing table length as an entry count, not a byte count
...
smb: client: fix double-free in SMB2_ioctl() replay
...
audit: Fix data races of skb_queue_len() readers on audit_queue
...
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
...
ACPI: NFIT: core: Fix possible NULL pointer dereference
...
Input: elan_i2c - prevent division by zero and arithmetic underflow
...
HID: multitouch: fix out-of-bounds bit access on mt_io_flags
...
KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
...
USB: ulpi: fix memory leak on registration failure
...
hwrng: virtio: clamp device-reported used.len at copy_data()
...
posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
...
bpf: Support for hardening against JIT spraying
...
HID: appleir: fix UAF on pending key_up_timer in remove()
...
smb: client: harden POSIX SID length parsing
...
cpufreq: Fix hotplug-suspend race during reboot
...
ACPI: CPPC: Suppress UBSAN warning caused by field misuse
...
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
...
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
...
proc: protect ptrace_may_access() with exec_update_lock (part 1)
...
Bluetooth: fix UAF in bt_accept_dequeue()
...
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
...
netfilter: ebtables: module names must be null-terminated
...
smb: client: fix query directory replay double-free
...
Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
...
crypto: drbg - Fix returning success on failure in CTR_DRBG
...
i2c: core: fix adapter deregistration race
...
x86/bugs: Enable IBPB flush on BPF JIT allocation
...
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
...
RDMA/siw: bound Read Response placement to the RREAD length
...
usb: free iso schedules on failed submit
...
crypto: caam - use print_hex_dump_devel to guard key hex dumps
...
io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
...
Bluetooth: bnep: pin L2CAP connection during netdev registration
...
PCI: altera: Fix resource leaks on probe failure
...
smb: client: restrict implied bcc[0] exemption to responses without data area
...
tipc: fix out-of-bounds read in broadcast Gap ACK blocks
...
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
...
HID: lg-g15: cancel pending work on remove to fix a use-after-free
...
mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
...
smb: client: fix query_info() replay double-free
...
vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
...
netfilter: ebtables: terminate table name before find_table_lock()
...
block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
...
Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
...
Bluetooth: btusb: fix use-after-free on registration failure
...
ALSA: gus: check snd_ctl_new1() return value
...
usb: gadget: udc: Fix use-after-free in gadget_match_driver
...
udf: validate free block extents against the partition length
...