Lucene search
+L
UbuntucveRecent

75841 matches found

UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.6 views

CVE-2026-72304

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fix TOCTOU in sofipc4bytesput In sofipc4bytesput, the copy size is derived from the old data-size in the buffer rather than the incoming new data's size field from ucontrol. If the new data has a differen...

7.8CVSS5.7AI score0.00163EPSS
SaveExploits0References7
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.6 views

CVE-2026-72489

In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX transfer is detected, nvecmsgfree is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately aft...

8.4CVSS5.7AI score0.0015EPSS
SaveExploits0References10
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.7 views

CVE-2026-74309

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeonep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in octhw-irqs instead of assuming irq - irqs0. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs0 is not the ba...

10CVSS5.3AI score0.00448EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.4 views

CVE-2026-72321

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmpmodtimer and igmpstoptimer When a timer is deleted and not re-armed in igmpmodtimer, or stopped in igmpstoptimer, the code currently decrements the reference counter of the multicast...

5.6AI score0.00207EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.8 views

CVE-2026-74285

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

8.8CVSS5.5AI score0.0012EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-74380

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommumapsgtable return value check Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a zero. pinj...

8.8CVSS5.5AI score0.00129EPSS
SaveExploits0References8
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.10 views

CVE-2026-74381

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to...

5.8AI score0.00172EPSS
SaveExploits0References8
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.9 views

CVE-2026-74371

In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPFPROGQUERY OOB write and cgroup backward compat BPFPROGQUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpfattr' structure e.g. 40 bytes, which was the layout...

7.8CVSS5.8AI score0.00127EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.11 views

CVE-2026-74368

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid, causing the function to abort...

5.4AI score0.00155EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.7 views

CVE-2026-74431

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential infinite loop in rxrpcrecvmsg Fix the wait in rxrpcrecvmsg also take check the oob queue...

7.5CVSS5.3AI score0.00339EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-72417

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Validate iph-ihl in nfflowip4tunnelproto Add sanity check for iph-ihl field in nfflowip4tunnelproto before using it to compute the header size, avoiding out-of-bounds access with malformed IP headers. While ...

9.8CVSS5.5AI score0.00553EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-72443

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during sndusbmidiv2create. A later setup failure can still jump to sndusbmidiv2free, which currently frees each endpoint and its coheren...

5.6AI score0.00175EPSS
SaveExploits0References7
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.7 views

CVE-2026-74301

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix URB leak in allocmtkintrurb error path When btmtkisopktpad fails, the previously allocated URB is not freed, leaking the urb structure. Add usbfreeurb before returning the error...

5.4AI score0.00168EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.5 views

CVE-2026-72498

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid displaying the kernel pointer While dumping the info on MR using the rdma tool, we dump the mrhwq which is a kernel pointer. There is no need to expose this value for end user. So avoid it...

5.5AI score0.00166EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.6 views

CVE-2026-74278

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE with the original event embedded as variable-length data, while kernel...

5.6AI score0.00168EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.4 views

CVE-2026-72501

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Initialize dpi variable to zero dpi is initialized only for BNXTREALLOCWCPAGE, but copied for all the cases. So initialize the dpi to 0...

5.5AI score0.00166EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-72474

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor For architectures like Microblaze or arm64 where this IP is used, DMADIRECTREMAP is set which means that dmaalloccoherent might remap and hence vmalloc some memory...

5.6AI score0.00209EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-74329

In the Linux kernel, the following vulnerability has been resolved: watchdog: unregister PM notifier on watchdog unregister watchdogregisterdevice registers wdd-pmnb when WDOGNOPINGONSUSPEND is set, but watchdogunregisterdevice does not remove it. This leaves an embedded notifier block on the PM...

5.5AI score0.00172EPSS
SaveExploits0References9
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-72465

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The outnorqst exit in rpcrdmareplyhandler branches away before the credit clamp, so a reply that matches no pending request reaches outpost carrying the raw credit value...

7.5CVSS5.6AI score0.00655EPSS
SaveExploits0References8
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.4 views

CVE-2026-72461

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix refcount leak when updating the skctx Currently updateskctx transfers the plabel reference, unfortunately it is also unconditionally put in the caller. Ideally we would make the caller conditionally put the referenc...

7.8CVSS5.5AI score0.00136EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-72464

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdmawcreceive decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdmareplyhandler. The handler must post a...

7.5CVSS5.8AI score0.00675EPSS
SaveExploits0References8
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-74263

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skbclone in control TX t7xxportctrltx clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned-len, so an skbclone failure results in a NULL pointer...

5.5AI score0.00168EPSS
SaveExploits0References7
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-72486

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize e.g. firmware boot timeout, its devres unwind frees the sndsofdev object that the mailbox client mtk-adsp-ipc reaches via...

5.6AI score0.0018EPSS
SaveExploits0References8
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.4 views

CVE-2026-74300

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that many payload bytes...

8.8CVSS5.6AI score0.0026EPSS
SaveExploits0References8
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-74257

In the Linux kernel, the following vulnerability has been resolved: sockmap: Fix use-after-free in udpbpfrecvmsg syzbot reported use-after-free of struct skmsg in skmsgrecvmsg. 0 skmsgrecvmsg peeks skmsg from psock-ingressmsg under a lock, but its processing is lockless. Thus, skmsgrecvmsg must b...

7.8CVSS5.7AI score0.00124EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.5 views

CVE-2026-74402

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blocking and non-blocking paths were failing to provide valid entropy due to improper buffer management. Reading the buffer starting from byte 1, only fetch the ...

5.7AI score0.00177EPSS
SaveExploits0References10
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.7 views

CVE-2026-74337

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NMI/tracepoint re-entry deadlock on lru locks NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpflrupopfree/pushfree already hold on the same CPU, AA-deadlocking. Lockdep reports...

5.4AI score0.00166EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.7 views

CVE-2026-74275

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix out-of-bounds access in cxlcancelautoattach In cxlcancelautoattach, it assumes cxled-pos is a valid index for accessing p-targets. However, cxled-pos can be set to negative errno in cxlregionsorttargets if...

8.4CVSS5.4AI score0.00131EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-72460

In the Linux kernel, the following vulnerability has been resolved: apparmor: check label build before nonewprivs test aachangeprofile builds a replacement label with fnlabelbuildinscope before the nonewprivs subset check. The build helper can fail and return NULL or an ERRPTR, but the result was...

7.1CVSS5.5AI score0.00131EPSS
SaveExploits0References10
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.4 views

CVE-2026-74335

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpftaskfromvpid bpftaskfromvpid looks up a task in the pid namespace of the current task, via findtaskbyvpid: findtaskbyvpidvpid findtaskbypidnsvpid, taskactivepidnscurrent findpidnsnr, ns -...

5.4AI score0.00166EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.7 views

CVE-2026-74373

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix bio accounting for split md cloned bios Use mdclonedbio to control bio accounting instead of relying on r1bioexisted in raid1 or the ioaccounting flag in raid10. The previous logic does not reliably reflect...

5.5AI score0.00172EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.9 views

CVE-2026-74413

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix wrong pcigetdrvdata type in AER handlers rtw89 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume retrieve it as a netdevice pointer. This causes...

8.8CVSS5.4AI score0.00243EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-74375

In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix deadlock in read error recovery path raid1d and raid10d may resubmit a split md cloned bio while handling a read error. In this case, resubmitting the bio can lead to a deadlock if the array is suspended befo...

5.5AI score0.00155EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-74420

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Reject VMAs with VMIO or VMPFNMAP when creating SVM ranges VMAs marked with VMIO or VMPFNMAP are not backed by struct page objects, which GPUSVM requires in order to operate correctly. In particular, getpages relies o...

5.6AI score0.00155EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.9 views

CVE-2026-74412

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix wrong pcigetdrvdata type in AER handlers rtw88 stores an ieee80211hw pointer via pcisetdrvdata at probe time, but ioerrordetected and ioresume retrieve it as a netdevice pointer. This causes...

8.8CVSS5.4AI score0.00243EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.10 views

CVE-2026-74358

In the Linux kernel, the following vulnerability has been resolved: ext4: fix fast commit wait/wake bit mapping on 64-bit On 64-bit, ext4 dynamic inode states live in the upper half of iflags, and ext4testinodestate applies the corresponding +32 offset. The fast-commit wait and wake paths...

5.4AI score0.00166EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.8 views

CVE-2026-74352

In the Linux kernel, the following vulnerability has been resolved: of: reservedmem: avoid post-init UAF when allocreservedmemarray fails The global pointer 'reservedmem' continues to reference the reservedmemarray which lives in initdata if allocreservedmemarray fails. ofreservedmemlookup is...

5.4AI score0.00168EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.7 views

CVE-2026-74415

In the Linux kernel, the following vulnerability has been resolved: spi: atcspi200: fix use-after-free when driver unbind DMA resource is initialized after SPI controller registration. So when driver unbind, this can trigger a use-after-free when DMA is torn down while the controller is still ali...

5.5AI score0.00155EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.6 views

CVE-2026-74339

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read sndseqread copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRVSEQEXTCHAINED internally, and data.ext.ptr...

5.5AI score0.00172EPSS
SaveExploits0References9
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.9 views

CVE-2026-74438

In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rngalg Remove sun4issrng, as it is insecure and unused: - It has multiple vulnerabilities. sun4issprngseed is missing locking and has a buffer overflow. sun4issprnggenerate fails to...

7.8CVSS6.2AI score0.00133EPSS
SaveExploits0References9
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.10 views

CVE-2026-74408

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID athtxedmatasklet accesses sc-tx.txqts.qid where ts.qid is a 4-bit hardware field 0-15, but the txq array only has ATH9KNUMTXQUEUES 10 entries. A qid = 10 causes an OOB...

8.8CVSS5.4AI score0.00266EPSS
SaveExploits0References10
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.7 views

CVE-2026-72294

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq validity in kvmvcpuioctlinterrupt Function kvmvcpuioctlinterrupt can be called from userspace, here add irq validility cheking in kvmvcpuioctlinterrupt...

8.8CVSS5.3AI score0.00163EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-72311

In the Linux kernel, the following vulnerability has been resolved: drm/xe: free madvise VMA array on L2 flush failure xevmmadviseioctl allocates madviserange.vmas in getvmas. After getvmas succeeds with at least one VMA, error paths must go through freevmas so the array is released before the...

5.6AI score0.00198EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-72352

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hidbpfgetdata range check hidbpfgetdata returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx-allocatedsize. The current check adds rdwrbufsize and offset before...

7.8CVSS5.6AI score0.00175EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.3 views

CVE-2026-72446

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handleuaudiostreamreq resolves an interface index with infoidxfromifnum, which returns -EINVAL when no interface matches. The enable branch and the response:...

7.8CVSS5.6AI score0.00153EPSS
SaveExploits0References5
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.4 views

CVE-2026-72414

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: round up PTP perout pin duration pinduration is converted from the user-provided period to SJA1105 clock ticks and is later passed as the cycletime argument to futurebasetime. Very small period values may becom...

5.5AI score0.0022EPSS
SaveExploits0References10
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.5 views

CVE-2026-72439

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writespending leak on write request failures raid10makerequest acquires a writespending reference with mdwritestart before dispatching write requests. Several failure paths in raid10writerequest complete the bio an...

5.4AI score0.00162EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.6 views

CVE-2026-72381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

9.8CVSS6AI score0.00652EPSS
SaveExploits0References7
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.6 views

CVE-2026-72293

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: Add missing radixtreepreload in gaccessshadowfault Add missing radixtreepreload in gaccessshadowfault to guarantee forward progress. The core of gaccessshadowfault has been split into gaccessshadowfault in order ...

5.5AI score0.00189EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/15 6:22 a.m.10 views

CVE-2026-72411

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: fix use-after-free of DSA ports in crcerrwork Upon an MDIO CRC error mxl862xxcrcerrworkfn walks the DSA ports and closes the CPU port conduits: dsaswitchforeachcpuportdp, priv-ds devclosedp-conduit;...

7.8CVSS5.6AI score0.00154EPSS
SaveExploits0References4
Total number of security vulnerabilities75841