23108 matches found
macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF
...
thunderbolt: Bound root directory content to block size
...
Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation
...
libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler
...
sctp: purge outqueue on stale COOKIE-ECHO handling
...
batman-adv: frag: disallow unicast fragment in fragment
...
Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for cve-2024-7730)
...
USB: serial: kl5kusb105: fix bulk-out buffer overflow
...
misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
...
libslirp TCP URG OOB Read Information Leak
...
blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
...
netfilter: ip6t_hbh: reject oversized option lists
...
jq: stack overflow in deep structural equality
...
wifi: nl80211: reject oversized EMA RNR lists
...
drm/amd/display: Bound VBIOS record-chain walk loops
...
net/sched: act_api: use RCU with deferred freeing for action lifecycle
...
netfilter: nf_conntrack_sip: don't use simple_strtoul
...
jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow
...
net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
...
HAProxy - Integer Overflow in FCGI Demux Record Length Field
...
thunderbolt: Limit XDomain response copy to actual frame size
...
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
...
HAProxy - NULL Pointer Dereference in hpack_dht_insert Function
...
misc: fastrpc: fix DMA address corruption due to find_vma misuse
...
sctp: diag: reject stale associations in dump_one path
...
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
...
thunderbolt: Validate XDomain request packet size before type cast
...
bpf: Fix stale offload->prog pointer after constant blinding
...
undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
...
wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet
...
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.
...
tipc: fix double-free in tipc_buf_append()
...
bonding: 3ad: implement proper RCU rules for port->aggregator
...
drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
...
net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
...
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
...
tcp: restrict SO_ATTACH_FILTER to priv users
...
io_uring/poll: fix signed comparison in io_poll_get_ownership()
...
xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
...
nexthop: fix IPv6 route referencing IPv4 nexthop
...
net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
...
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
...
netlabel: validate unlabeled address and mask attribute lengths
...
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
...
netfilter: bridge: make ebt_snat ARP rewrite writable
...
batman-adv: v: stop OGMv2 on disabled interface
...
batman-adv: tp_meter: avoid use of uninit sender vars
...
ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
...