Lucene search
+L

400530 matches found

CVE
CVE
added 2026/09/16 10:32 a.m.12 views

CVE-2026-89961

CVE-2026-89961 affects the Linux kernel 's powerpc/mm subsystem, specifically the vmemmap_populate_compound_pages() function. The root cause is a mismatch in how addr_pfn is advanced relative to the loop's addr variable in vmemmap address space. Because each PAGE_SIZE step in addr spans PAGE_SIZE...

7.8CVSS5.8AI score0.00163EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/16 10:32 a.m.14 views

CVE-2026-89960

CVE-2026-89960 is a use-after-free in the Linux kernel's s390 vfio-ap (Protected Crypto Accelerator) subsystem. In vfio_ap_mdev_set_kvm(), the kvm->arch.crypto.pqap_hook pointer is set before checking for a conflicting mdev assignment. If another mdev already owns the KVM instance, the functio...

8.8CVSS5.7AI score0.00159EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/16 10:32 a.m.11 views

CVE-2026-89959

CVE-2026-89959 is a Linux kernel vulnerability in the s390/vfio-ap subsystem. The vfio_ap_config_remove function incorrectly used bitmap_andnot instead of bitmap_and when clearing bits from the matrix_mdev->matrix.adm bitmap (which tracks control domains assigned to a mediated device). This pr...

8.8CVSS5.8AI score0.00164EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/16 10:32 a.m.13 views

CVE-2026-89958

This vulnerability affects the Linux kernel 's s390/vfio-ap driver. The root cause is a NULL pointer dereference : the vfio_ap_on_cfg_changed and vfio_ap_on_scan_complete callback functions acquire the matrix_mdev->kvm->lock mutex without first checking whether matrix_mdev->kvm is NULL. ...

5.6AI score0.002EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/16 10:32 a.m.14 views

CVE-2026-89957

CVE-2026-89957 affects the Linux kernel s390 vfio-ap driver. In vfio_ap_mdev_hot_unplug_cfg(), the return value of bitmap_andnot() is used to decide whether the guest APCB needs updating. When the last AP adapter or domain assigned to an mdev is removed, the resulting empty bitmap causes bitmap_a...

8.8CVSS5.8AI score0.00164EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/16 10:32 a.m.10 views

CVE-2026-89955

A NULL pointer dereference vulnerability exists in the Linux kernel's s390/vfio-ap module. The race occurs when vfio_ap_mdev_probe_queue() creates the sysfs attribute group before the queue's driver data is set; a concurrent read of the status attribute then retrieves NULL via dev_get_drvdata() a...

5.6AI score0.002EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/16 10:32 a.m.12 views

CVE-2026-89956

CVE-2026-89956 affects the s390/vfio-ap subsystem of the Linux kernel. The root cause is a missing matrix_dev->guests_lock mutex when traversing or modifying the mdev_list of ap_matrix_mdev objects. Two functions are affected: vfio_ap_mdev_probe , which added objects to the list using the wron...

6AI score0.00198EPSS
SaveExploits0References3
CVE
CVE
added 2026/09/16 10:32 a.m.9 views

CVE-2026-89954

CVE-2026-89954 affects the Linux kernel 's MTD AFS (Async Flash Storage) v2 parser. The root cause is insufficient bounds validation: the parser uses footer[8] to locate the image information block and the region_count field to walk entries from a fixed local array, but neither value—both taken f...

8CVSS5.8AI score0.0018EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/16 10:32 a.m.8 views

CVE-2026-89953

CVE-2026-89953 is a memory leak in the Linux kernel's mtdoops module. The root cause is that mtdoops_notify_remove() detaches from the backing MTD device but leaves the oops_page_used bitmap allocated. When the same MTD device is subsequently re-registered, the add path allocates a new bitmap and...

5.8AI score0.0021EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/16 10:32 a.m.10 views

CVE-2026-89952

CVE-2026-89952 affects the Linux kernel's mtd: rawnand subsystem , specifically the nand_flash_detect_ext_param_page() function. The root cause is an insufficient bounds check: the function allocates memory based on the length declared in the ONFI parameter page, then reads a fixed header and wal...

5.8AI score0.00211EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/16 10:32 a.m.9 views

CVE-2026-89951

CVE-2026-89951 affects the batman-adv module in the Linux kernel. During fragment reassembly, the skb from the highest-numbered buffered fragment is reused as the merged packet. If that fragment was received on a hard interface that is deleted before reassembly completes, the merged skb re-enters...

8.8CVSS5.8AI score0.00345EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/16 10:32 a.m.6 views

CVE-2026-89950

In the Linux kernel batman-adv module, multicast packet generation functions batadv_mcast_forw_packet() and batadv_mcast_forw_scrape() can be reached via the batadv_mcast_forw_mcsend() call path, where the socket buffer is unshared but not linearized . Unlike the batadv_recv_mcast_packet() handle...

5.8AI score0.002EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/16 10:32 a.m.6 views

CVE-2026-89949

CVE-2026-89949 affects the Linux kernel 's batman-adv module, specifically the DAT (Distributed ARP Table) component. When extracting IP addresses from ARP packets, either batadv_arp_ip_src or batadv_arp_ip_dst performs an unaligned memory access that triggers a fault on hardware lacking native u...

5.8AI score0.00211EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/16 10:32 a.m.11 views

CVE-2026-89948

CVE-2026-89948 affects the batman-adv (B.A.T.M.A.N. advanced) module in the Linux kernel , specifically its BLA (Backbone Link Aggregation) subsystem. The root cause is a logic bug: when a mesh interface is deleted, batadv_bla_del_backbone_claims() is never actually executed because bat_priv->...

5.7AI score0.00211EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/16 10:32 a.m.13 views

CVE-2026-89947

CVE-2026-89947 is a global-out-of-bounds read in the Linux kernel's Amlogic Meson GXBB clock driver . When commit 7915d7d5407c removed a non-existing 32k clock parent from the gxbb_32k_clk_sel mux, it did not adjust the hard-coded num_parents field, causing __clk_register to read past the end of ...

8CVSS6.2AI score0.00182EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/16 10:32 a.m.10 views

CVE-2026-89946

CVE-2026-89946 affects the Linux kernel's ASoC cs35l33 codec driver . The root cause is that cs35l33_runtime_suspend() switches the codec into regcache_cache_only(true) and powers it down without first quiescing the threaded IRQ, leaving a window where cs35l33_irq_thread() can still execute. If t...

5.8AI score0.0021EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/16 10:32 a.m.13 views

CVE-2026-89945

CVE-2026-89945 affects the ASoC cs35l34 codec driver in the Linux kernel . The root cause is that cs35l34_runtime_suspend() transitions the codec into regcache_cache_only mode, asserts reset low, and powers the device off without first quiescing the threaded IRQ registered via devm_request_thread...

5.9AI score0.00211EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/16 10:32 a.m.8 views

CVE-2026-89944

CVE-2026-89944 is a reference-count leak in the Linux kernel's ASoC hdac_hda driver. In hdac_hda_dev_probe(), an HDA link reference is acquired via snd_hdac_ext_bus_link_get() before registering the ASoC component. If component registration fails, the function returns without calling snd_hdac_ext...

5.6AI score0.002EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/16 10:32 a.m.14 views

CVE-2026-89943

CVE-2026-89943 affects the Linux kernel's ASoC (ALSA) loongson audio driver. In the loongson_card_parse_acpi() function, the return value of device_property_read_string() for the codec-dai-name ACPI property was ignored. When the property is missing or invalid, an uninitialized pointer is subsequ...

8.4CVSS5.8AI score0.00182EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/16 10:32 a.m.14 views

CVE-2026-89942

CVE-2026-89942 is a use-after-free in the Linux kernel's IIO buffer subsystem, specifically in the anonymous buffer release path. When an anonymous buffer handle holds the last reference to an IIO device that has been removed (via unbind or hot-unplug), the release function's scoped guard causes ...

7.8CVSS6.5AI score0.00159EPSS
SaveExploits0References4
Rows per page
Query Builder