28423 matches found
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
...
firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
...
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
...
fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
...
drm/i915/bios: range check LFP Data Block panel_type2
...
wifi: mwifiex: bound uAP association event IEs to the event buffer
...
wifi: libertas: fix memory leak in helper_firmware_cb()
...
tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
...
net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
...
drm/amdgpu: fix division by zero with invalid uvd dimensions
...
wifi: carl9170: fix buffer overflow in rx_stream failover path
...
RDMA/irdma: Prevent user-triggered null deref on QP create
...
drm/amdgpu: reject mapping a reserved doorbell to a new queue
...
sctp: fix auth_hmacs array size in struct sctp_cookie
...
net: qrtr: restrict socket creation to the initial network namespace
...
media: vivid: check for vb2_is_busy() when toggling caps
...
scsi: core: wake eh reliably when using scsi_schedule_eh
...
drm/i915/gem: Add missing nospec on parallel submit slot
...
net: hip04: fix RX buffer leak on build_skb failure
...
drm/amd/display: set new_stream to NULL after release
...
net: hsr: fix memory leak on slave unregistration by removing synced VLANs
...
rds: drop incoming messages that cross network namespace boundaries
...
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
...
drm/amdgpu/vcn4: avoid rereading IB param length
...
wifi: cfg80211: bound element ID read when checking non-inheritance
...
net/iucv: fix use-after-free of a severed iucv_path
...
iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
...
drm/i915: Return NULL on error in active_instance
...
usb: gadget: f_tcm: synchronize delayed set_alt with teardown
...
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()
...
wifi: mt76: mt7915: guard HE capability lookups
...
mm/damon/core: disallow overlapping input ranges for damon_set_regions()
...
wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()
...
phonet: pep: fix use-after-free in pep_get_sb()
...
mm/khugepaged: write all dirty file folios when collapsing
...
geneve: require CAP_NET_ADMIN in the device netns for changelink
...
bpf, sockmap: Reject unhashed UDP sockets on sockmap update
...
wifi: brcmfmac: make release_scratchbuffers idempotent
...
media: cx23885: add ioremap return check and cleanup
...
media: nxp: imx8-isi: Fix potential out-of-bounds issues
...
firewire: net: Fix fragmented datagram reassembly
...
IB/mad: Drop unmatched RMPP responses before reassembly
...
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
...
bonding: fix devconf_all NULL dereference when IPv6 is disabled
...
sctp: auth: verify auth requirement when auth_chunk is NULL
...
intel_th: fix MSC output device reference leak
...
vxlan: mdb: Fix source list corruption on a failed replace
...
Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
...