246045 matches found
CVE-2026-98210 mmc: mxcmmc: cancel data work and watchdog on remove
In the Linux kernel, the following vulnerability has been resolved: mmc: mxcmmc: cancel data work and watchdog on remove mxcmciremove frees the host through the devm tail, but neither it nor mmcremovehost drains the driver's own asynchronous state. host-watchdog, a 10 s timer armed on the DMA pat...
CVE-2026-98208 mmc: sdio_uart: fix xmit_fifo leak when the port table is full
In the Linux kernel, the following vulnerability has been resolved: mmc: sdiouart: fix xmitfifo leak when the port table is full sdiouartaddport allocates the transmit fifo before claiming a slot in sdiouarttable. When all UARTNR slots are taken, it returns -EBUSY with the fifo still allocated, b...
CVE-2026-98209 mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-of-aspeed: Remove children before releasing SDC resources Probe failure and removal leave SDHCI child devices registered after the parent clock and managed resources are released. Unregister the OF children in reverse...
CVE-2026-98207 mmc: spi: reset bytes_xfered before retrying CRC failures
In the Linux kernel, the following vulnerability has been resolved: mmc: spi: reset bytesxfered before retrying CRC failures mmcspidatado updates data-bytesxfered after each block has been transferred successfully. If a later block in the same data request fails with a CRC error, data-bytesxfered...
CVE-2026-98206 Input: cyttsp5 - clamp the HID report size before memcpy
In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into responsebuf, which is CYMAXINPUT bytes...
CVE-2026-98205 Input: evdev - zero absinfo before partial copy in EVIOCSABS
In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct inputabsinfo: if copyfromuser&abs, p, mintsizet, size,...
CVE-2026-98204 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
In the Linux kernel, the following vulnerability has been resolved: Input: rmismbus - fix out-of-bounds read in rmismbwriteblock When chunking writes into SMBus blocks in rmismbwriteblock, the loop calculates blocklen using the original total length len instead of the remaining length curlen. If...
CVE-2026-98202 Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound Transport drivers such as rmii2c and rmispi invoke rmidriversuspend and rmidriverresume on their child rmidev device during system power management events. Howeve...
CVE-2026-98203 Input: soc_button_array - check btns_desc->package.count
In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...
CVE-2026-98201 Input: zero ff_effect before compat copy in input_ff_effect_from_user
In the Linux kernel, the following vulnerability has been resolved: Input: zero ffeffect before compat copy in inputffeffectfromuser In the compat path inputffeffectfromuser aliases the caller's native struct ffeffect with the smaller struct ffeffectcompat and copies only the compat sized prefix:...
CVE-2026-98200 hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
In the Linux kernel, the following vulnerability has been resolved: hwmon: hp-wmi-sensors Fix use-after-free in fungibleshow nsensor-currentstate is dynamically replaced as the sensor's state changes. updatenumericsensorfromwobj does this by freeing the old string and installing a new one: if...
CVE-2026-98199 hwmon: (pmbus/core) increase number of phases and add new mask
In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/core increase number of phases and add new mask Increase the number of phases to 16 as a new upcoming device supports such a number. While at it, add a new mask for controlling the source of the output voltage. Note...
CVE-2026-98197 hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
In the Linux kernel, the following vulnerability has been resolved: hwmon: w83791d remove fan/pwm 4-5 sysfs group on remove When the fan/pwm 4-5 pins are not used as GPIO, w83791dprobe creates the w83791dgroupfanpwm45 sysfs group on the I2C client device. The probe error path removes this group...
CVE-2026-98198 hwmon: (pwm-fan) Stop RPM timer before freeing tach data
In the Linux kernel, the following vulnerability has been resolved: hwmon: pwm-fan Stop RPM timer before freeing tach data sampletimer rearms the RPM timer and accesses the devm-managed ctx-tachs and ctx-pulsesperrevolution arrays. The cleanup action which stops the timer is registered before tho...
CVE-2026-98196 wifi: brcmsmac: fix UAF in brcms_free_timer()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcmsfreetimer brcmsfreetimer calls brcmsdeltimer which uses the non-synchronous canceldelayedwork to cancel the timer's underlying delayed work. If the work callback brcmstimer is already running,...
CVE-2026-98195 wifi: iwlegacy: fix broadcast stations deallocation
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of il4965up, ildeallocbcaststations clears only ILSTAUCODEACTIVE, leaving ILSTABCAST set. This causes the same broadcast stations to be deallocated again by...
CVE-2026-98194 wifi: libertas_tf: fix UAF in lbtf_free_adapter()
In the Linux kernel, the following vulnerability has been resolved: wifi: libertastf: fix UAF in lbtffreeadapter lbtffreeadapter calls lbtffreecmdbuffer to free the command buffers before calling timerdeletesync to wait for the command timer callback. If the timer callback commandtimerfn is alrea...
CVE-2026-98193 wifi: libipw: reject TKIP frames without a full MIC
In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipwmichaelmicverify assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michaelmic to read past the skb...
CVE-2026-98192 wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...
CVE-2026-98191 wifi: wlcore: release runtime PM ref on regdomain config failure
In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcoreregdomainconfig gets a runtime PM reference before sending the regulatory-domain command. When wlcorecmdregdomainconfiglocked fails, the function queues...
CVE-2026-98190 wifi: wilc1000: fix out-of-bounds read in P2P public action frames
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilcwfip2prx and mgmttx start parsing a frame once ieee80211ispublicaction returns true. That helper only verifies the frame is long enough for the action categor...
CVE-2026-98189 wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and reads tha...
CVE-2026-98188 wifi: p54: validate curve data length in the calibration curve converters
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54convertrev0 and p54convertrev1 read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken...
CVE-2026-98187 wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: require a full expif record in PDRINTERFACELIST The PDRINTERFACELIST loop only checks that the record start is within the entry before reading an entire struct expif from it. A truncated trailing record makes the...
CVE-2026-98186 wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiexsearchouiinie reads a pairwise-cipher PTK count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs, comparing...
CVE-2026-98185 wifi: mwifiex: validate scan response extents
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiexret80211scan subtracts the fixed response fields and the firmware-provided BSS length from resp-size without first proving that either extent fits. A short response or oversize...
CVE-2026-98184 wifi: mwifiex: prevent authentication frame length truncation
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiexcfg80211authenticate derives the authentication frame length from req-ielen and req-authdatalen, both of type sizet, but stores it in a u16. NL80211ATTRAUTHDATA...
CVE-2026-98183 wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211meshpreqsizeok derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header...
CVE-2026-98182 wifi: mac80211: refuse to make a monitor active when it has no queue
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor interface only gets a TXQ if it's created active, and one can't be added later. Setting the flag on a down interface is still allowed, so the driver i...
CVE-2026-98181 drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gudplaneatomiccheck The plane property loop uses req-propertiesnumproperties + i as write index while simultaneously incrementing numproperties inside the loop. At iteration i, numproperties ha...
CVE-2026-98180 drm/msm: RCU-free the scheduler-containing ring and VM objects
In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...
CVE-2026-98179 drm/amdgpu: fix rmmio iounmap skipped on device removal
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix rmmio iounmap skipped on device removal amdgpupciremove calls drmdevunplug before finisw, so drmdeventer is already false there and the iounmap guarded by it is skipped. This .remove path runs on both hot-unplug a...
CVE-2026-98178 drm/amdgpu: Skip KFD mapping clear before initialization
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Skip KFD mapping clear before initialization amdgpuamdkfdclearkfdmapping assumes that a non-NULL kfddev has a fully populated node array. This is not true when KFD device initialization fails after probe. For example,...
CVE-2026-98176 drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as ffsq-eopringbuffersize / sizeofunsigned int - 1 - 1 But...
CVE-2026-98177 drm/amdkfd: Avoid integer underflow in EOP ring size calculation.
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow in EOP ring size calculation. The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as orderbase2q-eopringbuffersize / 4 - 1 But orderbase2 can ...
CVE-2026-98175 smb: client: cancel reconnect work in clean_demultiplex_info()
In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...
CVE-2026-98174 smb: client: fix rlist race and missing initialization
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCPServerInfo.rlist is allocated via kzalloc which zeros both -next and -prev to NULL instead of pointing to itself, making listempty always return false and listadd...
CVE-2026-98173 smb: client: fix use-after-free of iface in cifs_try_adding_channels()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels cifstryaddingchannels iterates ses-ifacelist with listforeachentrysafefrom, which captures the next entry niface under ifacelock. The loop body then drops ifaceloc...
CVE-2026-98172 smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdconnection leak on cifsgettcpsession error When an RDMA connection is successfully established via smbdgetconnection but cifsgettcpsession later fails e.g. kthreadcreate returns an error, the error path frees...
CVE-2026-98171 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...
CVE-2026-98170 smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...
CVE-2026-98169 smb: client: fix potential OOB read in smb3_enum_snapshots()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...
CVE-2026-98168 smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...
CVE-2026-98167 smb: client: fix server->total_read for compound encrypted PDUs
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server-totalread for compound encrypted PDUs In receiveencryptedstandard, server-totalread is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result,...
CVE-2026-98165 drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs only
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs only The BAR0 fallback read path was introduced as a workaround for SR-IOV VFs where the VRAM aperture is not available during early init. Restrict this workaround to only...
CVE-2026-98166 drm/ttm: fix swapped-out resources never leaving their bulk_move range
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulkmove range ttmttswapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...
CVE-2026-94206 Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloakecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...
CVE-2026-95105 Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping
Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR...
CVE-2026-59357 Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions
Insufficient verification of data authenticity CWE-345 in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting...
CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type
Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...