247212 matches found
CVE-2026-92362 ag-ui-protocol ag-ui SSE Frame sse.rs resource consumption
A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the file crates/ag-ui-client/src/sse.rs of the component SSE Frame Parser. Performing a manipulation results in resource consumption. The attack is possible to be carried out remotely. The pull request t...
CVE-2026-92361 ag-ui-protocol ag-ui SSE Client client.go resource consumption
A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. This affects an unknown function of the file sdks/community/go/pkg/client/sse/client.go of the component SSE Client. Such manipulation leads to resource consumption. The attack can be executed remotely. The pull request to fi...
CVE-2026-92360 ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation
A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXTMESSAGESTART causes origin validation error. Remote exploitation of the...
CVE-2026-92359 ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy
A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function createstrandsapp of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted...
CVE-2026-92357 a2ui-project a2ui Model Processor model-processor.ts information disclosure
A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the component Model Processor. The manipulation of the argument currentsegment leads to information disclosure. The attack may be initiated remotely. The identifier o...
CVE-2026-90049 net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...
CVE-2026-90048 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in nicreateattrlist nicreateattrlist allocates a fixed buffer of alalignedrecordsize == recordsize bytes and then walks every attribute of the primary MFT record, writing one ATTRLISTENTRY p...
CVE-2026-90046 mm/page_alloc: don't spin_trylock() in NMI on UP
In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: don't spintrylock in NMI on UP Patch series "mm/pagealloc: fixes for freepagesnolock on RT/UP". Pre-existing bugs found by Sashiko during review of this other series:...
CVE-2026-90047 drm/xe: Don't hand out the flat CCS storage as usable VRAM
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't hand out the flat CCS storage as usable VRAM getflatccsoffset reads the base of the flat CCS storage from the hardware, scales it by the number of enabled L3 nodes, and rounds the result up to 128K. Everything below...
CVE-2026-90045 USB: gadget: ffs: fix mm lifetime handling
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling iodata stores a pointer to the submitting task's mmstruct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task...
CVE-2026-90044 usb: gadget: f_fs: Fix Use-After-Free in AIO error path
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix Use-After-Free in AIO error path In ffsepfilewriteiter and ffsepfilereaditer, when ffsepfileio fails with an error other than -EIOCBQUEUED, the iodata structure p is freed. However, for AIO operations, the...
CVE-2026-90043 zram: fix slot lock bit position on big-endian 64-bit
In the Linux kernel, the following vulnerability has been resolved: zram: fix slot lock bit position on big-endian 64-bit The slot lock is a bit operation on the whole lock word, which flags and actime alias as two u32s. On little-endian the lock bit lands in the position ZRAMENTRYLOCK reserves i...
CVE-2026-90042 ceph: properly decrypt filenames in vmalloc() buffers
In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc ...
CVE-2026-90041 HID: sony: clean up device list on probe failure
In the Linux kernel, the following vulnerability has been resolved: HID: sony: clean up device list on probe failure sonyinputconfigured adds some controllers to sonydevicelist before HID core registers their input devices. inputregisterdevice can fail after the callback returns successfully...
CVE-2026-90039 NFSD: Guard admin state-revocation walks with NFSD_NET_UP
In the Linux kernel, the following vulnerability has been resolved: NFSD: Guard admin state-revocation walks with NFSDNETUP Writing to /proc/fs/nfsd/unlockfilesystem, or sending the NFSDCMDUNLOCKFILESYSTEM or NFSDCMDUNLOCKEXPORT netlink command, walks the NFSv4 client hash tables to revoke open...
CVE-2026-90040 KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being...
CVE-2026-90038 NFSD: Prevent client use-after-free during export state revocation
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4revokeexportstates has the same use-after-free as nfsd4revokestates: it drops nn-clientlock across revokeonestid and the following read of clp-clminorversion...
CVE-2026-90037 NFSD: Prevent client use-after-free during close_lru reaping
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during closelru reaping An nfs4openowner left on nn-closelru after its final CLOSE keeps its last closed stateid in oolastclosedstid, holding only a raw pointer to its nfs4client. The laundroma...
CVE-2026-90036 NFSD: Prevent client use-after-free during blocked-lock reaping
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn-blockedlockslru -- holds a raw pointer to its nfs4client but no reference keeping the client...
CVE-2026-90035 drm/amd/display: fix division by zero in get_estimated_bw()
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix division by zero in getestimatedbw getestimatedbw divides by link-dpiabwallocconfig.bwgranularity, which is zeroed by resetbwallocstruct and only populated once DPTUNNELINGBWALLOCCAPCHANGED has been handled...
CVE-2026-90034 usb: image: mdc800: change kmalloc() to kzalloc()
In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: change kmalloc to kzalloc Change the kmalloc calls in usbmdc800init for irqurbbuffer and downloadurbbuffer to kzalloc, avoiding potential stack leaks if a shorter message is received in mdc800usbirq and...
CVE-2026-90032 media: usbtv: keep device alive while ALSA card exists
In the Linux kernel, the following vulnerability has been resolved: media: usbtv: keep device alive while ALSA card exists The ALSA PCM callbacks store the driver state in pcm-privatedata. An open PCM file can outlive USB disconnect because usbtvaudiofree uses sndcardfreewhenclosed. The disconnec...
CVE-2026-90033 ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidius122loutput The sndusbmidius122loutput picks a count of 2 on anything slower than high speed and never relates it to ep-maxtransfer. The URB buffer holds exactly maxtransfer bytes, so ...
CVE-2026-90031 usb-storage: ene_ub6250: fix race between scan work and probe
In the Linux kernel, the following vulnerability has been resolved: usb-storage: eneub6250: fix race between scan work and probe eneub6250probe calls usbstorprobe2, which starts the usb-storage infrastructure and schedules the delayed scan work. The driver then calls enegetcardtype, which sends a...
CVE-2026-90030 usb: dwc3: clear forceRM when issuing EndTransfer
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: clear forceRM when issuing EndTransfer The forceRM bit of the DEPCMD register controls the behavior of the EndTransfer command used to stop an active transfer. Older DWC3 programming guide revisions recommended setting...
CVE-2026-90029 usb: storage: realtek_cr: fix use-after-free on disconnect
In the Linux kernel, the following vulnerability has been resolved: usb: storage: realtekcr: fix use-after-free on disconnect realtekcrdestructor calls timerdelete before the chip containing the timer is freed. The timer callback may still be running and can rearm itself, resulting in a...
CVE-2026-90028 usb: typec: hd3ss3220: track VBUS enable state per consumer
In the Linux kernel, the following vulnerability has been resolved: usb: typec: hd3ss3220: track VBUS enable state per consumer regulatorisenabled reports the aggregate regulator state, not whether this consumer holds an enable reference. If another consumer enables VBUS first, the driver can ski...
CVE-2026-90027 usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: disable ccdebouncedwork on stop ccdebouncedwork is queued from the setcc and starttoggling callbacks, which run from TCPM's kthread worker. portstop returns before tcpmunregisterport destroys that...
CVE-2026-90026 usb: typec: qcom-pmic: cancel reset_work on stop
In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: cancel resetwork on stop pdphystop disables IRQs but leaves resetwork pending. If the IRQ handler schedules it just before disableirq, the work runs after remove frees the struct via devm. Call cancelworksy...
CVE-2026-90025 usb: typec: ucsi: displayport: Fix OOB altmode array index
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GETCURRENTCAM response after checking it is not 0xff. The port altmode array is...
CVE-2026-90024 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix null-pointer dereference in fmidi2freeepreqs A null-pointer dereference occurs in fmidi2freeepreqs when attempting to clean up an endpoint that was never initialized. When configuring the MIDI 2.0 gadget v...
CVE-2026-90022 usb: gadget: f_midi2: fix use-after-free in string attribute show path
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi2: fix use-after-free in string attribute show path fmidi2optsstrshow takes the string lock internally, but its callers dereference the opts-info. pointer before calling it, outside the lock. This races with...
CVE-2026-90023 usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmassstorage: fix null pointer dereference in fsgcommonsetnumbuffers Previously fsgnumbuffersvalidate was removed as it was not necessary due to Kconfig setting the limits for n from 2 to 256 with default as 2...
CVE-2026-90021 usb: gadget: f_midi: initialize work in f_midi_alloc()
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fmidi: initialize work in fmidialloc fmidialloc initializes freeref to 1 and it can only be incremented when a sound card is registered via fmidiregistercard. fmidiregistercard is only called in fmidibind which...
CVE-2026-90020 USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fix NULL pointer dereference in gadgetdevioctl gadgetdevioctl reads dev-gadget before acquiring dev-lock, but dev-state is checked after acquiring the lock. Therefore a concurrent bind can change the device state...
CVE-2026-90019 usb: gadget: fix null pointer dereference in usb_put_function_instance()
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usbputfunctioninstance usbputfunctioninstance attempts to dereference fd inside fi struct to get mod in uvcallocinst error path. However, fd is not allocated until later in...
CVE-2026-90018 staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtwgetwpsattr rtwgetwpsattr walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte...
CVE-2026-90017 staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwactionframeparse rtwactionframeparse takes a framelen parameter but never actually checks it before indexing into the frame body: const u8 framebody = frame + sizeofstruct ieee80211hdr3addr;...
CVE-2026-90016 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD && ... ... break; i += iniei + 1 + 2; / to the next IE element / When the "i + ...
CVE-2026-90015 xhci: fix lost bounce buffers on TDs spanning several ring segments
In the Linux kernel, the following vulnerability has been resolved: xhci: fix lost bounce buffers on TDs spanning several ring segments When a TD reaches a link TRB with data that is not aligned to the endpoint's wMaxPacketSize, xhcialigntd stages the unalignable tail through the bounce buffer of...
CVE-2026-90013 tracing: Take trace_array reference when opening options file
In the Linux kernel, the following vulnerability has been resolved: tracing: Take tracearray reference when opening options file The options files do not take the tracearray reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by...
CVE-2026-90014 tracing: Have show_event_filters/triggers files take trace array ref
In the Linux kernel, the following vulnerability has been resolved: tracing: Have showeventfilters/triggers files take trace array ref The newly added files showeventfilters and showeventtriggers that show all filters or triggers that are set within the trace array do not take a reference for the...
CVE-2026-90012 spi: Fix DMA mapping ownership on partial map failure
In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...
CVE-2026-90011 scsi: target: iscsi: Reserve a terminator byte for the login payload
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsitargetcheckloginrequest rejects a login PDU whose DataSegmentLength exceeds MAXKEYVALUEPAIRS, but the test is '' and login-reqbuf is allocated with exactly...
CVE-2026-90010 scsi: bsg: Cap io_uring sense copy to max_response_len
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...
CVE-2026-90009 scsi: bsg: Fix TOCTOU in io_uring passthrough command setup
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...
CVE-2026-90008 scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
In the Linux kernel, the following vulnerability has been resolved: scsi: megaraidsas: Limit NVMe request size to the PRP chain frame megasasmakeprpnvme builds a command's PRP list in cmd-sgframe, a DMA pool buffer of instance-maxchainframesz bytes, spending one entry per NVMe page of the transfe...
CVE-2026-90007 scsi: pm8001: Use rollback index when freeing MSI-X vectors
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001requestmsix unwinds previously registered handlers with freeirq when requestirq fails. The rollback loop uses the failing index i for every iteration instead of th...
CVE-2026-90006 samples/damon/mtier: handle damon_stop() failure
In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: handle damonstop failure damonsamplemtierstop assumes its damonstop call will always successfully stops the two DAMON contexts. Hence it deallocates the two DAMON contexts after the damonstop call. However, i...
CVE-2026-90004 mm/damon/core: handle region split failure in apply_min_nr_regions()
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: handle region split failure in applyminnrregions damonapplyminnrregions repeatedly split each region until its size becomes small enough to meet the user-defined low limit of the number of regions. The loop assumes...