32226 matches found
Apache Thrift: c_glib `read_all` spins when the underlying read returns 0
...
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
...
Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound
...
wifi: cfg80211: don't free driver-owned scan requests
...
wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
...
net/packet: clear RX owner on VNET header error
...
Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame
...
net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
...
wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
...
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
...
firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
...
Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count
...
RDMA/rtrs: guard against null kobj name
...
net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
...
hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
...
Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)
...
Bluetooth: hci_codec: validate vendor codec count length
...
i2c: atr: fix dangling adapter pointer on add failure
...
RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables
...
mmc: mmci: Fix use-after-free in busy-timeout work
...
wifi: virt_wifi: free skb when disconnected
...
hwmon: (pwm-fan) Stop RPM timer before freeing tach data
...
Input: zero ff_effect before compat copy in input_ff_effect_from_user
...
Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM
...
wifi: cfg80211: only group hidden BSSes with beacon entries
...
Apache HTTP Server: mod_vhost_alias stack overflow
...
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
...
Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
...
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
...
net: mvpp2: prevent buffer overflow in page_pool allocation
...
wifi: iwlegacy: fix broadcast stations deallocation
...
ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
...
ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
...
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
...
RDMA/rxe: validate access flags before swapping the MR's PD
...
ALSA: bcd2000: Fix race between rawmidi and disconnect
...
wifi: libipw: reject TKIP frames without a full MIC
...
selinux: recheck intermediate backing files on mprotect()
...
netfilter: nft_nat: fully initialise new_addr in netmap setup
...
wifi: wlcore: release runtime PM ref on regdomain config failure
...
net: bridge: vlan: fix bugs caused by switchdev deletion errors
...
btrfs: abort transaction on failure to update inode for hole punching and reflinking
...
Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
...
RDMA/siw: Bound fragmented header copies by the remaining length
...
hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
...
arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
...
IB/hfi1: Fix the PIO_CRED credit-return mmap
...
net: stmmac: fix TSO header length truncation
...