32226 matches found
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
...
scsi: libiscsi: Validate the task named by a management response
...
drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
...
drm/exec: don't immediately add prelocked obj to array of locked objs
...
drm/i915/dmc: Add sanity check for DMC load address
...
tracing: Keep the predicate limit separate from program capacity
...
tracing: Check operator stack capacity before pushing
...
tracing: Fix hist trigger timestamps for buffered events
...
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
...
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
...
dm-crypt: fix a tiny race condition in crypt_dec_pending
...
dm-integrity: fix infinite loop on discard with large tag size
...
net/iucv: fix the recvmsg window update
...
xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
...
xfs: fix capability check in xfs
...
io_uring/cancel: don't spin on local work the task can't run
...
sctp: validate chunk length in the inqueue parser
...
page_pool: keep frag_offset aligned for odd-sized requests
...
s390/ctcm: Prevent XID null dereference
...
s390/pci: Fix leak of uninitialized kernel data in SCLP report
...
vsock/virtio: validate packet source for connected sockets
...
vsock/vmci: validate packet source for connected sockets
...
ipv4: avoid divide by zero in fib_rebalance
...
drm/i915/dmc: Harden DMC firmware payload parsing
...
net: bridge: mcast: don't truncate the port group walk on teardown
...
ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
...
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
...
ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
...
net/sched: cls_flower: validate mask pointer after nla_next()
...
smb: client: fix heap overflow in cifs_do_set_acl()
...
smb: client: reject SetEA requests that do not fit the request buffer
...
drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
...
ntfs: move attribute payload before shrinking its record
...
zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()
...
X.Org Server XKB SetGeometry TextDoodad Double Free
...
Lenient parsing of integers for response body and chunk framing
...
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
...
libXtst RECORD EnableContext Reply Endless Loop
...
libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
...
libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow
...
wifi: p54: validate firmware record lengths
...
libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
...
libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser
...
Go: CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509
...
StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
...
Tencent RapidJSON Regex stream.h Take out-of-bounds
...
libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table
...
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...