28400 matches found
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
...
fs: fix user path of nested backing files
...
SUNRPC: always drain cache_cleaner before destroying a cache_detail
...
ceph: bound xattr value length in __build_xattrs()
...
ecryptfs: hold msg ctx list lock when cleaning daemon queue
...
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
...
Revert "media: v4l2-dev: fix error handling in __video_register_device()"
...
wifi: mt76: mt7996: validate default EEPROM firmware size
...
HID: sensor: custom: Fix field sysfs group cleanup on failure
...
svcrdma: Validate Read chunk positions before reconstruction
...
net: ravb: serialize PTP clock teardown
...
platform/x86: hp-bioscfg: fix heap OOB read on empty password write
...
Bluetooth: RFCOMM: serialize security confirmation handling
...
platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
...
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
...
rapidio: mport_cdev: fix use-after-free in dma_req_free()
...
nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown
...
mm/migrate_device: clear stale mapping after freeing swapcache
...
bnx2x: fix double free in bnx2x_init_firmware() error path
...
RDMA/cxgb4: Cancel reg_work before freeing device on remove
...
sctp: stop processing a packet once its association is deleted
...
ocfs2: validate rl_used against rl_count in refcount block validator
...
power: supply: bq256xx: drain usb_work before freeing the charger
...
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
...
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
...
sctp: fix stream->outcnt underflow on duplicate RECONF responses
...
SUNRPC: Check svc pool percpu counter allocation
...
ocfs2: bound namelen in dlm_migrate_request_handler
...
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
...
nfsd: fix nfsd_file leak on inter-server COPY setup failure
...
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
...
ACPI: pfr_update: fix stack buffer overflow in query_capability()
...
ALSA: serial-u16550: Check card index validity at probe
...
forcedeth: fix off-by-one when saving/restoring non-PCI config space
...
RDMA/ucma: Lock the handler in ucma_set_ib_path()
...
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
...
svcrdma: Fix pcl_for_each_segment for empty chunks
...
net/smc: unregister the connection before draining the rx tasklet
...
platform/x86: ISST: Validate logical CPU id and clos id
...
NFSD: Prevent lock owner use-after-free during client teardown
...
nfsd: initialize copy-notify stateid before publishing it
...
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
...
ceph: bound num_export_targets array for mds info v2/v3
...
nfsd: gate nfs2 setacl by argp->mask
...
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
...
ntfs: validate non-resident attribute offsets
...
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
...
PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.
...