5,730 results · Feed
-
Unscored —
Bluetooth: RFCOMM: free the skb when the DLC has no owner
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm_recv_data() hands the skb to d->data_ready() and returns 0 without freeing it, so the callback owns the skb from that point on…
-
Unscored —
Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an RFCOMM tty is closed. rfcomm_dev_add() puts the n…
-
High 7.8
drm/vmwgfx: validate pitch coming from userspace
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads wi…
-
Unscored —
fs: don't silently unmount busy mounts
In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts …
-
High 7.8
namespace: don't inherit MNT_UMOUNT in clone_mnt()
In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has taken out of its namespace. It's never cleared. __detach_mounts() u…
-
Unscored —
namespace: don't copy an unmounted mount tree
In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may_copy_tree() accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsf…
-
Unscored —
namespace: check a submount for references right before unmounting it
In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrink_submounts() and mark_mounts_for_expiry() first collect all the mounts they are allowed to unmount and then unmount…
-
Unscored —
namespace: check a recursive bind mount for mount namespace loops
In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do_loopback() refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount nam…
-
Unscored —
namespace: check the mounts before reading their parents in pivot_root()
In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot_root() path_pivot_root() reads the parents of new_root and of the caller's root and checks whether they are shared before it …
-
Unscored —
dcache: don't put a mountpoint on a dentry that's being removed
In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir(), unlink() and rename() call dont_mount() on the victim and then detach_mounts() with the victim's inode locked. do_lock…
-
High 8.8
namespace: unhash a dentry before detaching the mounts on it
In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(), rmdir() and rename() remove the entry from the filesystem, call detach_mounts() on the entry with the inode locked and t…
-
High 8.8
namei: don't reveal overmounted entries in refwalk
In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. step_into() step_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_loc…
-
High 8.4
namespace: never expire a locked mount
In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. do_umount() refuses to unmount locked mounts but shrin…
-
Unscored —
namespace: handle mount locking for automounts correctly
In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attach_recursive_mnt() locks every copy of the source mount to protect overmounts fro…
-
Unscored —
net/sched: em_text: reject unterminated algo before autoload
In the Linux kernel, the following vulnerability has been resolved: net/sched: em_text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a ("net/sched: fix potential stack infoleak in em_text_dump()"), which zero-initialised t…
-
Critical 9.8
btrfs: fix xattr replace when multiple xattrs are packed in the same item
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs_dir_item item that packs multiple xattrs and then we replace the value of one of them (with the se…
-
Unscored —
flow_dissector: avoid u16 truncation of skb->len when computing thoff
In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of skb->len when computing thoff __skb_flow_dissect() computes key_control->thoff using: key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen); mi…
-
Unscored —
vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmci_transport_recv_dgram_cb() During the closure of a datagram socket, the vmci_transport_recv_dgram_cb() function may be called, which will add the packets to the …
-
High 7.8
HID: steam: Rearrange teardown sequence
In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer…
-
High 7.8
HID: steam: Refactor registration
In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic fo…
-
Unscored —
sched_ext: Build the cid tables privately and publish them with RCU
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before fi…
-
Unscored —CVE-2026-98937 Public exploit
perf/core: Check kernel access when kernel callchains are requested
In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel…
-
Unscored —
KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When __inject_sigp_stop() is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pend…
-
Unscored —
drm/amd/display: Remove sink usage from DPMS
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS [Why] stream->sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences …
-
Unscored —
fs: avoid repeated scans in evict_inodes()
In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evict_inodes() We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fs_bd…
-
Unscored —
parisc: Increase kernel stack size to 32kb
In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size (THREAD_SIZE_ORDER) to 32 kB, in order to avoid kernel crashes which have been trig…
-
Unscored —
wifi: nl80211: check link is beaconing for color change
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link.
-
Unscored —
media: video-i2c: use vb2_video_unregister_device on driver removal
In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal The driver uses vb2_fop_release() as its file release operation, so vb2_video_unregister_device() should be used instead of…
-
Unscored —
drm/amdgpu: cap ATOM command table nesting depth
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with execute_depth and return -ELOOP when exceeded.
-
Unscored —
net: thunderx: fix PTP device ref leak in nicvf_probe()
In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf_probe() cavium_ptp_get() acquires a reference to the PTP PCI device through pci_get_device(). If any initialization step fails after cavium_ptp…
-
Unscored —
ALSA: seq: oss: Reject reads that cannot fit the next event
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it fro…
-
High 7.5
dpaa2-switch: fix the error path in dpaa2_switch_rx()
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect since …
-
Unscored —
drm/amdkfd: Unwind debug trap enable on copy_to_user failure
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying runtime_info to userspace, it had already activated the trap, set debug_trap_enabled,…
-
Unscored —
net: cpsw_new: unregister devlink on port registration failure
In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only unregister…
-
Unscored —
net: microchip: sparx5: clean up PSFP resources on flower setup failure
In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP act…
-
Unscored —
btrfs: protect sb_write_pointer() with invalidate lock
In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLKBS…
-
Unscored —
net: lan966x: restore RX state on reload failure
In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x_fdma_reload() backs up rx->page_pool and rx->fdma before reallocating the RX resources for the new MTU. If the allocation fails, the r…
-
Unscored —
drm/amdkfd: Properly acquire queue buffers in CRIU restore
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfd_queue_acquire_buffers() was split off from set_queue_properties_from_user(), set_queue_properties_from_criu() was missed. T…
-
Unscored —
mailbox: imx: Use devm_pm_runtime_enable()
In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm_pm_runtime_enable() sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm_runtime_enable() into the r…
-
Unscored —
mailbox: imx: Add a channel shutdown field
In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imx_mu_isr() imx_mu_shutdown() imx_mu_xcr_rmw(priv, IMX_MU_RCR, 0, IMX_…