24507 matches found
smb: client: Fix next buffer leak in receive_encrypted_standard()
...
ipv4: igmp: remove multicast group from hash table on device destruction
...
bpf: Reject fragmented frames in devmap
...
smb: client: fix double-free in SMB2_flush() replay
...
Bluetooth: btusb: fix use-after-free on marvell probe failure
...
iio: event: Fix event FIFO reset race
...
ALSA: usb-audio: avoid kobject path lookup in DualSense match
...
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
...
isofs: bound Rock Ridge symlink components to the SL record
...
tracing: Prevent out-of-bounds read in glob matching
...
udf: validate VAT header length against the VAT inode size
...
partitions: aix: bound the pp_count scan to the ppe array
...
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
...
Bluetooth: L2CAP: validate option length before reading conf opt value
...
libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation
...
libssh2 Heap Buffer Overflow via ETM Cipher Negotiation
...
KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
...
libssh2 Double-Free Heap Corruption via sftp_open()
...
libssh2 Heap Out-of-Bounds Read via publickey subsystem
...
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
...
staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
...
fbdev: modedb: fix a possible UAF in fb_find_mode()
...
gpio: eic-sprd: use raw_spinlock_t in the irq startup path
...
LoongArch: Report dying CPU to RCU in stop_this_cpu()
...
smb: client: fix double-free in SMB2_open() replay
...
MIPS: smp: report dying CPU to RCU in stop_this_cpu()
...
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
...
Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
...
KVM: x86: hyper-v: Bound the bank index when querying sparse banks
...
crypto: ecc - Fix carry overflow in vli multiplication
...
drivers/base/memory: set mem->altmap after successful device registration
...
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
...
smb: client: mask server-provided mode to 07777 in modefromsid
...
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
...
mm: do file ownership checks with the proper mount idmap
...
Capstone has a NULL Pointer Dereference with 3DNow! opcodes
...
Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formatting
...
Librest: weak random number generation in pkce implementation
...
Libssh: libssh: use-after-free via data callbacks on closed channels
...
Libssh: libssh: denial of service via oversized sftp read length
...
Libssh: libssh: denial of service via unchecked proxycommand fork() failure
...
Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification
...
Libssh: libssh: denial of service via zero advertised channel packet size
...
Libssh: libssh: denial of service via sftp responses with unknown request ids
...
Record ordering based unexpected exit with CNAME or DNAME
...
Potential memory usage beyond configured limits
...
Cache poisoning possible with label count discrepancy, RRSIG, and wildcards
...
Potential wildcard CNAME RPZ policy bypass
...