28400 matches found
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
...
drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
...
LoongArch: Move jump_label_init() before parse_early_param()
...
audit: fix recursive locking deadlock in audit_dupe_exe()
...
tipc: fix u16 MTU truncation in media and bearer MTU validation
...
ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
...
net/packet: avoid fanout hook re-registration after unregister
...
bpf: Reject redirect helpers without a bpf_net_context
...
ksmbd: defer destroy_previous_session() until after NTLM authentication
...
wifi: carl9170: fix OOB read from off-by-two in TX status handler
...
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
...
cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
...
wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()
...
Path Traversal in GNU cpio
...
sctp: close UDP tunnel sockets during netns teardown
...
net/iucv: take a reference on the socket found in afiucv_hs_rcv()
...
Uncontrolled Memory Allocation in GNU cpio
...
Improper Output Encoding in GNU cpio
...
fscrypt: Add missing superblock check in find_or_insert_direct_key()
...
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
...
drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1
...
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch
...
sctp: validate stream count in sctp_process_strreset_inreq()
...
drm/i915/mst: limit DP MST ESI service loop
...
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin
...
drm/amdgpu: Release VFCT ACPI table reference
...
drm/i915/vrr: require valid min/max vfreq for VRR
...
dpaa2-switch: put MAC endpoint device on disconnect
...
amt: re-read skb header pointers after every pull
...
drop_monitor: perform u64_stats updates under IRQ-disabled section
...
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
...
ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
...
USB: serial: io_edgeport: cap received transmit credits
...
Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
...
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
...
net: gro: fix double aggregation of flush-marked skbs
...
wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
...
Bluetooth: hci_sync: Protect UUID list traversal
...
wifi: mac80211_hwsim: clamp virtio RX length before skb_put
...
amt: fix use-after-free in AMT delayed works
...
exec: fix unsigned loop counter wrap in transfer_args_to_stack()
...
ASoC: tas2781: bound firmware description string parsing
...
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler
...
mei: bus: access mei_device under device_lock on cleanup
...
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
...
drm/i915/gt: Fix NULL deref on sched_engine alloc failure
...
drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
...
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
...