32226 matches found
media: cedrus: fix memory leak in cedrus_init_ctrls()
...
i2c: mux: Fix channel node leak on adapter add failure
...
mtd: mtdoops: free page bitmap when the backing MTD is removed
...
fs/ntfs3: validate ef->size covers the record's name and value
...
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
...
s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
...
nvme: add missing SRCU grace period in error path
...
media: s2255: check firmware size before reading trailing marker
...
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
...
power: supply: ab8500_fg: fix use-after-free on remove
...
scsi: pm8001: Use rollback index when freeing MSI-X vectors
...
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
...
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
...
drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
...
NFSD: Prevent client use-after-free during blocked-lock reaping
...
media: cec: disable delayed work before freeing an interrupted transmit
...
KVM: s390: Fix old_data leak in guest debug error path
...
f2fs: validate MOVE_RANGE destination size
...
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
...
media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
...
s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
...
mtd: rawnand: validate ONFI extended parameter page sections
...
drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
...
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
...
f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
...
media: i2c: ov7740: fix use-after-destroy in remove
...
media: cx23885: cancel NetUP CI work before teardown
...
powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
...
scsi: target: iscsi: Reserve a terminator byte for the login payload
...
libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.
...
xhci: fix lost bounce buffers on TDs spanning several ring segments
...
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
...
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
...
media: em28xx: fix use-after-free of dev_next->devlist on disconnect
...
scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
...
s390/vfio-ap: Fix NULL deref in status_show() during queue probe
...
mm/huge_memory: transfer the pmd dirty bit to the folio on zap
...
compression vulnerable to Denial of Service via memory leak on premature response close
...
ceph: properly decrypt filenames in vmalloc() buffers
...
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
...
kprobes: Protect kprobe_blacklist with RCU
...
usb: dwc3: clear forceRM when issuing EndTransfer
...
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
...
usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
...
minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
...
tracing: Take trace_array reference when opening options file
...
drm/amd/display: fix division by zero in get_estimated_bw()
...
drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
...