424077 matches found
PT-2026-116801
In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfca hci i2c repack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...
PT-2026-116798
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfc genl llc sdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfc llcp send snl sdr...
PT-2026-116925
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update num sta ps and the...
PT-2026-116934
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control i.e. pending TLB flush on failed VMRUN Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN, as empirical testing shows that the CPU performs the requested TLB flush if and only...
PT-2026-116922
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrel ht: validate fixed rate index The fixed rate idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel ht update stats then copies the value into mi-max tp rate and mi-max pro...
PT-2026-116890
In the Linux kernel, the following vulnerability has been resolved: iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure If devm thermal of zone register fails, probe returns without unregistering the IIO map array or disabling runtime PM. Jump to err map to release them...
PT-2026-116913
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...
PT-2026-116918
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF mesh fast tx cache stores raw mesh path pointers. Path deletion flushes the cache and then frees the path with kfree rcu, but a lookup that already holds the path can insert a...
PT-2026-116923
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits...
PT-2026-116928
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211 vif use reserved switch validates a replacement by counting assigned links on ctx-replace ctx and treating reservations too broadly. A link can still b...
PT-2026-116920
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESH MAX MPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from...
PT-2026-116898
In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013 write event config already ignores repeated enable requests, but a repeated disable...
PT-2026-116953
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Serialize SCO and ISO scheduling with teardown hci low sent selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used...
PT-2026-116974
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc send ctl The stack-allocated struct vio vcc pkt was partially initialized, leaving the tag.stype env field uninitialized before being sent via ldc write, potentially leaking kernel...
PT-2026-116944
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet auth challenge nvmet auth challenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A...
PT-2026-116977
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmic glink client is released by the devres cleanup, which runs after pmic glink ucsi remove has returned, so its notification callbacks can queue work until then...
PT-2026-116955
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: Lock parent access during enhanced SCO setup Bluetooth: hci conn: Lock parent access during enhanced SCO setup hci enhanced setup sync runs on the request workqueue without the hci dev lock held by its caller...
PT-2026-116986
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count When dwc3 check event buf reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 "usb: dwc3: gadget: check that event count does not exceed...
PT-2026-116954
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Serialize ACL scheduling with channel deletion hci chan sent selects a channel under RCU but drops the read lock before accessing chan-conn and returning the channel. The ACL and LE schedulers then use its...
PT-2026-116678
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hci bind bis hci conn link takes a lifetime reference to its parent with hci conn get, but only takes an operational hold on the child. hci conn unlink later balances both a hold and a...
PT-2026-116744
In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctp lookup prealloc tag When a socket transmits a packet with MCTP TAG PREALLOC set, mctp lookup prealloc tag iterates over the per-netns &mns-keys list and matches netid, req tag, peer...
PT-2026-116712
In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic dhcp init options appends the hostname option 12, vendor-class option 60 and client-ID option 61 options into the fixed 312-byte bootp pkt.exten buffer. Only the client-ID branch...
PT-2026-116702
In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfc get local general bytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfc llcp find local" attempted to fix a use-after-free UAF issue by invoking nfc llcp local putlocal after accessi...
PT-2026-116700
In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100 recv response passes the URB transfer buffer to port100 rx frame is valid, which checksums le16 to cpuframe-datalen bytes of frame-data. datalen ...
PT-2026-116735
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1a ram new pci get domain bus and slot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before...
PT-2026-116746
In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pm runtime get sync leaves the usage counter incremented even when it fails, and zynq gpio request returns the error without dropping it. gpiolib does not call -free when...
PT-2026-116730
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveau bo pin locked nouveau bo pin locked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it...
PT-2026-116705
In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure ena device init initializes the MMIO read mechanism with ena com mmio reg read request init, which allocates a coherent DMA buffer for MMIO read responses. The normal removal...
PT-2026-116733
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validate init On the ttm bo reserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drm gem objec...
PT-2026-116681
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci conn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hci conn" made hci bind cis and hci connect cis return a connection with one hold for the ISO layer. hci bind...
PT-2026-116677
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hci bind cis and hci connect cis return one hci conn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by iso conn fre...
PT-2026-116658
In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finis...
PT-2026-116654
In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Use parent device for devres in altr portb setup Anchor the devres group and the devm-managed IRQ requests in altr portb setup to the actual parent device device-edac-dev instead of the embedded struct device inside...
PT-2026-116641
VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with tit...
PT-2026-116736
Name of the Vulnerable Software and Affected Versions Linux kernel version 7.2.0 Description A slab-use-after-free issue exists in the nouveau GPU driver. The nouveau uvmm sm function calls op map, which passes bo-resource through nouveau mem to nouveau uvma map, where nouveau uvmm vmm map...
PT-2026-116723
In the Linux kernel, the following vulnerability has been resolved: PCI: of property: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...
PT-2026-116701
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc llcp recv hdlc nfc llcp recv hdlc reads the sequence byte skb-data2, via nfc llcp ns/nfc llcp nr, before any length check. The receive path only guarantees the two-byte LLCP header -...
PT-2026-116695
In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccw device get util str The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid to chp can retu...
PT-2026-116668
Content removed...
PT-2026-116684
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the RISC-V KVM implementation, device ioctls are not serialized against KVM RUN. This allows the kvm riscv aia imsic rw attr function to snapshot the physical CPU and HGEI Hart Group...
PT-2026-127665
TuxCare rebuilt @angular/common to address 5 CVEs. Fixed in 5.1.0-tuxcare.3...
PT-2026-127696
TuxCare rebuilt @angular/common to address 7 CVEs. Fixed in 4.3.5-tuxcare.3...
PT-2026-127645
TuxCare rebuilt @angular/common to address 1 CVE. Fixed in 8.2.14-tuxcare.3...
PT-2026-127667
TuxCare rebuilt @angular/common to address 2 CVEs. Fixed in 7.2.1-tuxcare.4...
PT-2026-127663
TuxCare rebuilt @angular/common to address 14 CVEs. Fixed in 15.2.6-tuxcare.2...
PT-2026-127668
TuxCare rebuilt @angular/common to address 2 CVEs. Fixed in 13.3.11-tuxcare.3...
PT-2026-127669
TuxCare rebuilt @angular/common to address 2 CVEs. Fixed in 15.2.9-tuxcare.3...
PT-2026-127699
TuxCare rebuilt @angular/common to address 13 CVEs. Fixed in 11.2.0-tuxcare.3...