24507 matches found
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
...
batman-adv: stop tp_meter sessions during mesh teardown
...
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()
...
RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()
...
dm-thin: fix metadata refcount underflow
...
vsock: fix buffer size clamping order
...
staging: media: atomisp: Disallow all private IOCTLs
...
drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
...
drm/amdkfd: validate SVM ioctl nattr against buffer size
...
mptcp: pm: ADD_ADDR rtx: always decrease sk refcount
...
batman-adv: bla: prevent use-after-free when deleting claims
...
openvswitch: vport: fix self-deadlock on release of tunnel ports
...
md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
...
spi: fsl: fix controller deregistration
...
smb/client: fix out-of-bounds read in symlink_data()
...
btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
...
fbcon: Avoid OOB font access if console rotation fails
...
block: add pgmap check to biovec_phys_mergeable
...
wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
...
Off-by-One Leading to Out-of-Bounds Write in bzip2
...
btrfs: fix missing last_unlink_trans update when removing a directory
...
exit: prevent preemption of oopsing TASK_DEAD task
...
ipmi: Check event message buffer response for bad data
...
drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
...
usb: ulpi: fix memory leak on ulpi_register() error paths
...
net: stmmac: Prevent NULL deref when RX memory exhausted
...
smb: client: validate dacloffset before building DACL pointers
...
KVM: x86: check for nEPT/nNPT in slow flush hypercalls
...
Bluetooth: hci_conn: fix potential UAF in create_big_sync
...
wifi: b43legacy: enforce bounds check on firmware key index in RX path
...
batman-adv: fix integer overflow on buff_pos
...
mptcp: fix scheduling with atomic in timestamp sockopt
...
ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
...
Bluetooth: virtio_bt: validate rx pkt_type header length
...
drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
...
mptcp: pm: ADD_ADDR rtx: fix potential data-race
...
vsock/virtio: fix accept queue count leak on transport mismatch
...
batman-adv: bla: put backbone reference on failed claim hash insert
...
spi: mpc52xx: fix use-after-free on unbind
...
ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
...
net: qrtr: ns: Limit the total number of nodes
...
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
...
net: qrtr: ns: Limit the maximum number of lookups
...
rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
...
remoteproc: xlnx: Only access buffer information if IPI is buffered
...
net: strparser: fix skb_head leak in strp_abort_strp()
...
LoongArch: Add spectre boundry for syscall dispatch table
...
misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()
...