32226 matches found
nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
...
usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
...
RDMA/rvt: Return NULL after port allocation failure
...
bpf: Zero queue and stack outputs on lock failure
...
bpf: Fix use-after-free on mm_struct in bpf_find_vma()
...
iommu/dma: Check atomic pool allocation result directly
...
wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
...
firewire: core: fix memory leak in error path of build_tree()
...
ksmbd: validate ipc response length before dereferencing its fields
...
net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
...
cxl/mbox: Clamp mailbox output allocation to the payload size
...
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
...
ksmbd: safely discard unregistered deferred locks
...
net: fec: only stop PTP if it was initialized
...
drm/v3d: Associate BOs with every job that accesses them
...
bpf, cgroup: Fix storage null-ptr-deref after replacing prog
...
nvmet: fix max_qid race between configfs and controller allocation
...
wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
...
irqchip/renesas-irqc: Fix generic interrupt chip leak on remove
...
wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
...
phonet: pep: do not write beyond optlen in getsockopt
...
Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
...
esp: do not unref managed frag pages in esp_ssg_unref()
...
drm/sun4i: crtc: Propagate layer initialization error
...
remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
...
nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
...
wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
...
ipvs: fix integer overflow in ftp helper port/address parsing
...
vdpa_sim: fix cleanup after worker creation failure
...
drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
...
RDMA/erdma: Hold QP references for AE and CM processing
...
coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
...
ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
...
btrfs: defrag: fix deadlock between defrag and delalloc space reservation
...
fat: release buffer head after rebuilding parent
...
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
...
net: kcm: Hold RCU read lock while running BPF parser
...
RDMA/core: Fix potential use after free in ib_free_cq()
...
UDF symlink pathComponent header OOB read
...
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
...
bpf: Clear buf on error in __bpf_get_task_stack
...
null_blk: serialize configfs attribute updates with device setup
...
gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection
...
libceph: validate banner payload length
...
fbdev: kyro: Validate overlay viewport coordinates
...
ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
...
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
...
btrfs: always wait for ordered extents to avoid OE races
...