28326 matches found
crypto: drbg - Fix returning success on failure in CTR_DRBG
...
i2c: core: fix adapter deregistration race
...
x86/bugs: Enable IBPB flush on BPF JIT allocation
...
xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
...
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
...
RDMA/siw: bound Read Response placement to the RREAD length
...
usb: free iso schedules on failed submit
...
crypto: caam - use print_hex_dump_devel to guard key hex dumps
...
io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
...
Bluetooth: bnep: pin L2CAP connection during netdev registration
...
PCI: altera: Fix resource leaks on probe failure
...
smb: client: restrict implied bcc[0] exemption to responses without data area
...
tipc: fix out-of-bounds read in broadcast Gap ACK blocks
...
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
...
HID: lg-g15: cancel pending work on remove to fix a use-after-free
...
mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
...
smb: client: fix query_info() replay double-free
...
vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
...
netfilter: ebtables: terminate table name before find_table_lock()
...
block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
...
netpoll: fix a use-after-free on shutdown path
...
Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
...
smb/client: fix chown/chgrp with SMB3 POSIX Extensions
...
Bluetooth: btusb: fix use-after-free on registration failure
...
usb: gadget: udc: Fix use-after-free in gadget_match_driver
...
ALSA: gus: check snd_ctl_new1() return value
...
udf: validate free block extents against the partition length
...
usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
...
fuse: re-lock request before returning from fuse_ref_folio()
...
smb: client: Fix next buffer leak in receive_encrypted_standard()
...
ipv4: igmp: remove multicast group from hash table on device destruction
...
bpf: Reject fragmented frames in devmap
...
smb: client: fix double-free in SMB2_flush() replay
...
Bluetooth: btusb: fix use-after-free on marvell probe failure
...
iio: event: Fix event FIFO reset race
...
ALSA: usb-audio: avoid kobject path lookup in DualSense match
...
net/handshake: Take a long-lived file reference at submit
...
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
...
isofs: bound Rock Ridge symlink components to the SL record
...
tracing: Prevent out-of-bounds read in glob matching
...
udf: validate VAT header length against the VAT inode size
...
partitions: aix: bound the pp_count scan to the ppe array
...
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
...
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
...
Bluetooth: L2CAP: validate option length before reading conf opt value
...
libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation
...
libssh2 Heap Buffer Overflow via ETM Cipher Negotiation
...
KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
...