32226 matches found
drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
...
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
...
iio: light: ltrf216a: fix runtime PM reference leak in error path
...
media: i2c: ov02a10: fix endpoint parsing use-after-free
...
isofs: fix out-of-bounds page array access on empty zisofs block
...
dma-direct: return struct page from dma_direct_alloc_from_pool()
...
scsi: qla2xxx: Avoid double completion in async IOCB timeout
...
nvme-fabrics: fix DHCHAP secret leak on parse failure
...
media: cec: Serialize exclusive follower delivery
...
NFSD: Prevent client use-after-free during close_lru reaping
...
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
...
bpf: Disable preemption in bpf_get_stackid
...
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
...
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
...
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
...
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
...
ublk: clear VM_MAYWRITE on read-only ublk char device mmap
...
media: v4l2-async: avoid deleting unlinked ASC entry on link error
...
scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
...
drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
...
nvmet-tcp: reject unsolicited H2CData PDUs
...
drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
...
usb: gadget: fix null pointer dereference in usb_put_function_instance()
...
LoongArch: Avoid preempt count underflow without probe
...
staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
...
media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
...
drm/amdgpu: force complete the KIQ ring fences on reset
...
KVM: nVMX: Always flush vpid02 on first use
...
drm/amdgpu: force complete the MES ring fences on reset
...
HID: sony: clean up device list on probe failure
...
ext4: fix out-of-bounds read in ext4_read_inline_dir()
...
drm/gud: NUL-terminate TV mode names read from the device
...
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
...
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
...
mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
...
media: s2255: bound JPEG frame size before copying into the buffer
...
usb: typec: ucsi: displayport: Fix OOB altmode array index
...
iio: chemical: sgp30: Handle IAQ thread creation failure
...
drm: fix race between partial drm_dev_register() failure and ioctl
...
media: usbtv: keep device alive while ALSA card exists
...
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
...
media: rc: sunxi-cir: Unregister rc device on probe failure
...
media: zoran: Avoid freeing a registered video_device twice
...
KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables
...
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
...
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
...
KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
...
vfio/pci: clear vdev->msi_perm after freeing it on init failure
...