420618 matches found
PT-2026-128530
In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV SHUTDOWN after the sendmsg connect wait sctp wait for connect drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog and unlink the association. If a concurre...
PT-2026-128495
In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfc get local general bytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfc llcp find local" attempted to fix a use-after-free UAF issue by invoking nfc llcp local putlocal after accessi...
PT-2026-128507
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6 ATTR DST In seg6 genl policy, SEG6 ATTR DST is defined with .type = NLA BINARY and .len = sizeofstruct in6 addr. For NLA BINARY, .len only enforces the maximum payload length and...
PT-2026-128533
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet auth challenge nvmet auth challenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A...
PT-2026-128498
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client-ioctl mutex, but the translated port-info compat path invokes the same handlers through snd seq kernel client ctl...
PT-2026-128492
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f uac1 legacy: validate bRequest index in generic set,get cmd generic set cmd and generic get cmd use the low nibble of ctrl-bRequest as an index into con-data: u8 cmd = ctrl-bRequest & 0x0F; / 0 .. 15 /...
PT-2026-128517
In the Linux kernel, the following vulnerability has been resolved: net: extend IPv6 exthdr detection of tunneled packets Commit c4336a07eb6b "net: correctly handle tunneled traffic on IPV6 CSUM GSO fallback" split skb gso has extension hdr into mutually exclusive branches on skb-encapsulation...
PT-2026-128508
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcc cleanup vcc cleanup sets port-tty to NULL without holding port-lock, racing with vcc event LDC callbacks that read port-tty under port-lock and then use tty-port. This can...
PT-2026-128557
In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd otp nvmem add unregisters the user device but leaves mtd-otp user nvmem set. On an error, the...
PT-2026-128548
In the Linux kernel, the following vulnerability has been resolved: smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races The invalidHandle, swapfile, oplock break cancelled, offload, and status file deleted fields are stored in the same bitfield byte in struct cifsFileInfo, bu...
PT-2026-128589
In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctp dev only after it is initialised mctp add dev links the new mctp dev into dev-mctp ptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a net device pointer...
PT-2026-128568
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skb pointer if linear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. Th...
PT-2026-128587
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfc genl llc sdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfc llcp send snl sdr...
PT-2026-128585
In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finis...
PT-2026-128584
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Serialize fragmented ISO packet queueing The fragmented path in hci queue iso calls skb queue tail without holding conn-data q.lock. The socket lock serializes senders, but the transmit worker can concurrentl...
PT-2026-128551
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink queue: hold nfnl mutex in event notifier We must serialize the release notifier and the config netlink function. A concurrent thread can issue close which can call the release function while unrelated socket...
PT-2026-128554
In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcp write collapse fence sets TCP SKB CBskb-eor = 1 on tcp write queue tailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier...
PT-2026-128522
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst dev overhead The seg6, ioam6 and rpl lwtunnels size their skb cow head request as the length they are about to push plus dst dev overhead, then push the new headers and rebuild the m...
PT-2026-128538
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945 pci probe calls il eeprom init, which allocates memory for the EEPROM data. The probe failure paths release this allocation with il eeprom free, but the remove path does not...
PT-2026-128527
In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens open cached dir sends CREATE and QUERY INFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...
PT-2026-128521
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc llcp recv hdlc nfc llcp recv hdlc reads the sequence byte skb-data2, via nfc llcp ns/nfc llcp nr, before any length check. The receive path only guarantees the two-byte LLCP header -...
PT-2026-128500
In the Linux kernel, the following vulnerability has been resolved: tty: tty port: restore TTY IO ERROR on activation failure Make sure to restore the TTY IO ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel...
PT-2026-128506
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized stream config-type stream config is not initialized before being passed to sdw stream add slave. The type field may contain garbage and is later copied to stream-type by sdw config stream...
PT-2026-128516
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup The sampling frequency tables store each frequency as an integer part and a fractional part in micro units. num sampling freq avail is initialized to th...
PT-2026-128525
In the Linux kernel, the following vulnerability has been resolved: nitro enclaves: fix use-after-free on SLOT ALLOC failure When ne create vm ioctl fails the SLOT ALLOC request after anon inode getfile has succeeded, the error path calls fputenclave file and then frees ne enclave. In normal...
PT-2026-128494
In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds add changeset property links a new property of a not-yet-live target node into the node's deadprops list before handing it to of changeset add property. If...
PT-2026-128511
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dc sink dereferences in MST mode validation dm dp mst is port support mode reads aconnector-dc sink-dsc caps... for the DSC branch-throughput check, and get conv frl bw's HDMI-PCON FRL-bandwidth path reads...
PT-2026-128535
In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOU ATTR IPPROTO on FOU ENCAP DIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOU ATTR IPPROTO." added NLA POLICY MINNLA U8, 1 to fou nl policyFOU ATTR IPPROTO, which rejects an explicitly supplied FOU ATTR...
PT-2026-128514
In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013 write event config already ignores repeated enable requests, but a repeated disable...
PT-2026-128520
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk eth soc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummy dev. mtk probe creates that dummy device, and adds the shared tx/rx NAPI to it, only...
PT-2026-128503
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: Lock parent access during enhanced SCO setup Bluetooth: hci conn: Lock parent access during enhanced SCO setup hci enhanced setup sync runs on the request workqueue without the hci dev lock held by its caller...
PT-2026-128540
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rtt min in sock ops A sockops prog reading skops-rtt min never checks the sk type: on the tcp conn request path sock ops-sk is a request sock non-full, and the ctx rewrite casts it to a tcp sock ful...
PT-2026-128529
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2 parse contexts validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose byt...
PT-2026-128493
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NF FLOW HW PENDING to NF FLOW PENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nf flow offload stats ca...
PT-2026-128542
In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advance nextseg modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6 next csid advance arg...
PT-2026-128563
In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debug info copy When debug register static fails, it clears areas, active pages and active entries but leaves the area bounds unchanged. Copying such an area, either by opening its view...
PT-2026-128566
In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails init overlay changeset stores the number of initialized fragments in ovcs-count only on full success. When find target or the symbols lookup fails partway...
PT-2026-128560
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESH MAX MPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from...
PT-2026-128564
In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3 get invariants can register an MDIO bus and connect a PHY for USE PHYLIB devices. If tg3 init one later fails, its common error path releases the mappings and netdev without...
PT-2026-128578
In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devm clk get error pointer in probe devm clk get&pdev-dev, "rtcref"'s return value was passed straight into clk get rate without checking it for an error first, unlike the "rtc" clock a few lines above...
PT-2026-128586
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfc llcp wks sap and nfc llcp build sdreq tlv pass non-null- terminated strings to pr debug using the %s format specifier. The buffers are allocated via kmemdup o...
PT-2026-128572
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in free by rcu ttrace do call rcu ttrace returns early when call rcu ttrace in progress is set and leaves the objects in free by rcu ttrace. free rcu frees waiting for gp ttrace only and clears the flag...
PT-2026-128544
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iio push to buffers with ts unaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is...
PT-2026-128575
In the Linux kernel, the following vulnerability has been resolved: net: flush skb defer nodes in dev cpu dead When a CPU goes offline, dev cpu dead drains its softnet queues completion queue, output queue, poll list, process queue, and input pkt queue, but leaves net hotdata.skb defer nodes...
PT-2026-127974
TuxCare rebuilt @next/polyfill-module to address 2 CVEs. Fixed in 15.5.23-tuxcare.4...
PT-2026-127926
TuxCare rebuilt react-test-renderer to address 1 CVE. Fixed in 16.4.1-tuxcare.1...
PT-2026-128033
TuxCare rebuilt @babel/helper-hoist-variables to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
PT-2026-127980
TuxCare rebuilt @storybook/sveltekit to address 1 CVE. Fixed in 7.0.7-tuxcare.1...