28424 matches found
tracing: Check return value of __register_event() in trace_module_add_events()
...
bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
...
net: bridge: stop fast-leave after deleting a port group
...
vxlan: use neigh_ha_snapshot() in route_shortcircuit()
...
hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
...
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
...
bnxt: fix head underflow on XDP head-grow
...
wifi: ieee80211: validate MLE common info length
...
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
...
net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
...
binfmt_misc: reject a flag character as the field delimiter
...
vhost: fix vhost_get_avail_idx for a non empty ring
...
drm/vc4: Zero the tile state data array before each BIN job
...
tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
...
Vim: Use-after-free in JSON Decoding
...
Vim: Out-of-bounds Access in Popup Opacity Handling
...
tipc: avoid use-after-free in poll trace queue dumps
...
vxlan: use pskb_network_may_pull() for transmit path header pulls
...
ipmi: Fix user refcount underflow in event delivery
...
Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login
...
dm-verity: fix buffer overflow in FEC calculation
...
Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing
...
mm/hugetlb: fix list corruption in allocate_file_region_entries()
...
net: mpls: initialize rtm_tos in mpls_getroute()
...
Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing
...
ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
...
netfilter: ipset: make sure gc is properly stopped
...
net: openvswitch: fix potential UAF on meter attach failure
...
drm/vmwgfx: bound DMA command body size against suffix pointer
...
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
...
sctp: prevent peer transport count overflow
...
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
...
net/smc: fix socket use-after-free during link group termination
...
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
...
ixgbe: do not configure xps for XDP queues
...
igbvf: Fix leak in TX DMA error cleanup
...
hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
...
Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing
...
bpf: Clear rb node linkage when freeing bpf_rb_root
...
nfs: use nfsi->rwsem to protect traversal of the file lock list
...
net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
...
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
...
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
...
Bluetooth: HIDP: validate numbered report payloads
...
hwmon: (lm90) Only report alarms if driver is ready
...
drm/amd/pm: fix pptable use-after-free
...
rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
...
Bluetooth: hci_sync: Fix advertising data UAFs
...