59325 matches found
DEBIAN-CVE-2026-80622
In the Linux kernel, the following vulnerability has been resolved: char: tlclk: fix use-after-free in tlclkcleanup This patch improves the module cleanup process in the tlclk driver to prevent potential use-after-free and race conditions. Currently, the fileoperations structure does not specify...
DEBIAN-CVE-2026-80620
In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...
DEBIAN-CVE-2026-80626
In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: fix preempt count underflow in fslembpmudel fslembpmudel unconditionally calls putcpuvarcpuhwevents at the 'out:' label, but only calls the matching getcpuvar after the 'i hw.idx is negative the function jumps to...
DEBIAN-CVE-2026-80614
In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in emacprobe Move devmrequestirq after devmplatformioremapresource so that dev-emacp is mapped before the interrupt handler can fire. An early interrupt hitting emacirq would dereference th...
DEBIAN-CVE-2026-80616
In the Linux kernel, the following vulnerability has been resolved: ieee802154: Avoid calling WARNON on -ENOMEM in cfg802154switchnetns It's pointless to call WARNON in case of an allocation failure in devchangenetnamespace and devicerename, since it only leads to useless splats caused by...
DEBIAN-CVE-2026-80619
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix potential UAF in aareplaceprofiles The function aareplaceprofiles was accessing udata-size after calling aaputloaddataudata, causing a potential UAF. Fixed this by saving the size to a local variable before dropping...
DEBIAN-CVE-2026-80612
In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb-data. LWT programs cannot access the skbuff-datameta...
DEBIAN-CVE-2026-80618
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free amdgpuamdkfdgpuvmfreememoryofgpu unpinned DOORBELL and MMIO remap BOs which are pinned at allocation time before checking whether the BO is still mapped to the GPU. When...
DEBIAN-CVE-2026-80613
In the Linux kernel, the following vulnerability has been resolved: veth: fix NAPI leak in XDP enable error path During XDP enablement in veth, if xdprxqinforeg or xdprxqinforegmemmodel fails, the driver rolls back the changes. However, the rollback loop: for i--; i = start; i-- decrements the lo...
DEBIAN-CVE-2026-80615
In the Linux kernel, the following vulnerability has been resolved: net: dstmetadata: fix false-positive memcpy overflow in tundstunclone kmallocflex in metadatadstalloc sets countedby for the structure to the optionslen, which is then initialized to zero. Later, we're initializing the structure ...
DEBIAN-CVE-2026-80617
In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix foechecktime allocation size foechecktime is declared as u16 pointer but was allocated with only ppenumentries bytes instead of ppenumentries sizeofu16. When airohappefoeverifyentry is called with hash =...
DEBIAN-CVE-2026-80611
In the Linux kernel, the following vulnerability has been resolved: ACPI: processoridle: Mark LPI enter functions as cpuidle When function tracing or Kprobes is enabled, entering an ACPI Low Power Idle LPI state triggers the following RCU splat: RCU not on for: acpiidlelpienter+0x4/0xd8 WARNING:...
DEBIAN-CVE-2026-80606
In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifierlock for write on inject test path When CONFIGDRMXEUSERPTRINVALINJECT=y, xeptsvmuserptrprecommit runs vmacheckuserptr with the svm notifierlock taken for read. The test injection causes vmacheckuserpt...
DEBIAN-CVE-2026-80610
In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix potential divide-by-zero when numvsi is zero For i.MX94 series, all the standalone ENETCs do not support SR-IOV, so pf-caps.numvsi is zero. This leads to a divide-by-zero in enetc4defaultringsallocation when...
DEBIAN-CVE-2026-80602
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERFSAMPLEBRANCHUSER is requested. On AM...
DEBIAN-CVE-2026-80605
In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'rawdata'. If the loop execute...
DEBIAN-CVE-2026-80607
In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Remove WARNONONCE from parsebtfarg Sashiko found that user can cause this WARNONONCE easily with adding a kprobe event based on a raw address with BTF parameter. Since this is not an unexpected condition, remove t...
DEBIAN-CVE-2026-80609
In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe-lenlist Move index check before element access...
DEBIAN-CVE-2026-80603
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackirc: fix parsedcc off-by-one OOB read parsedcc treats dataend as an inclusive end pointer, but its only caller passes datalimit = ibptr + datalen, which points one past the last valid byte. The newline searc...
DEBIAN-CVE-2026-80608
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix iommu domain lifetime race during device removal When forceiova mode is enabled, amdxdnaremove frees xdna-domain. If amdxdnagemobjfree is called after device removal, it may attempt to access xdna-domain,...
DEBIAN-CVE-2026-80604
In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hidgetreport for numbered reports When a caller passes a size of 0 to hidreportrawevent for a numbered report, the function originally called hidgetreport before performing any size validation. Inside...
DEBIAN-CVE-2026-80600
In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...
DEBIAN-CVE-2026-80596
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes on control interface When the driver was converted to use the driver core to instantiate device attributes via .devgroups in the usbdriver structure, the attributes started appearing ...
DEBIAN-CVE-2026-80599
In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible ethhdr proto field When batadvgetvid accesses the proto field of the ethernet header, it is not checking if the data itself is accessible. The caller is responsible for it. But in contrast to...
DEBIAN-CVE-2026-80595
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - add response length checks The driver processes response data from device buffers without verifying that the device actually sent enough data. This can lead to out-of-bounds reads or processing stale data. Add...
DEBIAN-CVE-2026-80601
In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...
DEBIAN-CVE-2026-80598
In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in decompresslznt decompresslznt does not validate array index bounds before accessing the decompression table. A corrupted NTFS3 image with invalid compressed data can trigger an out-of-bounds read...
DEBIAN-CVE-2026-80597
In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization The mtdinfo contains a struct device, which must be linked to its parent. Without this, the initialization of the MTD fails with a NULL pointer dereference...
DEBIAN-CVE-2026-80594
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in imspcugetcdcuniondesc by iterating through the extra descriptor data. However, it does not verify that the...
DEBIAN-CVE-2026-80593
In the Linux kernel, the following vulnerability has been resolved: hwmon: asusatk0110 Check package count before accessing element atkecpresent walks the management group package returned by the GGRP ACPI method and, for each sub-package, reads its first element: id = &obj-package.elements0; if...
DEBIAN-CVE-2026-80590
In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtionethdr tun/tap, or AFPACKET with PACKETVNETHDR can mark an IPv4 or IPv6 fragment as GSO; nothing relates gsotype to fragoff...
DEBIAN-CVE-2026-80591
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix listxattr handling of corrupted xattr entries Validate the xattr entry before reading its fields in f2fslistxattr. Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a...
DEBIAN-CVE-2026-80592
In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: fail early if address range parameters are invalid The comment on top of struct damonregion clearly says that For any use case, @ar should be non-zero positive size. which is now verified in...
DEBIAN-CVE-2026-81499
Bulletin has no description...
DEBIAN-CVE-2026-81501
Bulletin has no description...
DEBIAN-CVE-2026-81494
Bulletin has no description...
DEBIAN-CVE-2026-81500
Bulletin has no description...
DEBIAN-CVE-2026-81495
Bulletin has no description...
DEBIAN-CVE-2026-81498
Bulletin has no description...
DEBIAN-CVE-2026-81497
Bulletin has no description...
DEBIAN-CVE-2026-81496
Bulletin has no description...
DEBIAN-CVE-2026-81493
Bulletin has no description...
DEBIAN-CVE-2026-38819
Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minutes...
DEBIAN-CVE-2026-38822
In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...
DEBIAN-CVE-2026-38820
openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...
DEBIAN-CVE-2026-38821
A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon denial of service and potentially achieve remote code execution. This is in httpmicrohttpd.c...
DEBIAN-CVE-2026-82072
Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
DEBIAN-CVE-2026-80179
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...
DEBIAN-CVE-2026-77341
cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP respons...
DEBIAN-CVE-2026-77358
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdownandclose the SSL object is freed and the pointer...