9,105 results · Feed
-
Unscored —
net: skbuff: propagate shared-frag marker in skb_zerocopy()
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)…
-
Unscored —
netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 ("netfilter: conntrack: tcp: only close if RST matches exact sequence") keeps an established connt…
-
Unscored —
net/sched: sch_teql: fix use-after-free on lower qdisc drop
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: fix use-after-free on lower qdisc drop The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return value against NETDEV_TX_OK alone. A slave that consumes the…
-
High 7.8
tun: Require CAP_NET_ADMIN to attach to an ownerless device
In the Linux kernel, the following vulnerability has been resolved: tun: Require CAP_NET_ADMIN to attach to an ownerless device Twenty years ago I made creating a tuntap device require CAP_NET_ADMIN in commit ca6bb5d7ab22 ("[NET]: Require CAP_NET_ADMIN to cre…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reclaim ended sessions on logoff and expirat…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection The pendin…
-
High 7.5
ksmbd: hold a connection reference for each session channel
In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A conc…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer connection scavenging while session lo…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short SESSION_SETUP responses s…
-
Unscored —
smb: client: fix fiemap wild read on empty truncated response
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix fiemap wild read on empty truncated response smb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob and loops for the next chunk. If the server reports STATU…
-
Unscored —CVE-2026-99273 Public exploit
ksmbd: reserve space for the UTF-16 terminator in stream info
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream info smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the converted characters, but get_file_stream_info() budgets …
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2_read() …
-
Unscored —
ALSA: line6: Clear prev_fbuf on capture buffer release
In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Clear prev_fbuf on capture buffer release A KASAN slab-use-after-free read was reported in submit_audio_out_urb() when generating an impulse test signal: BUG: KASAN: slab-use-aft…
-
High 7.8
xen-netback: defer xenvif_mcast_addr_list_free()
In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen f…
-
Unscored —
xen-blkback: Avoid UAF when reading I/O statistics
In the Linux kernel, the following vulnerability has been resolved: xen-blkback: Avoid UAF when reading I/O statistics Reading I/O statistics via sysfs concurrently with tearing down a frontend device might result in UAF or a NULL dereference, as the reading …
-
Unscored —
xen-netback: Fix UAF when reading statistics data
In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix UAF when reading statistics data The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to …
-
High 8.1
tcp: Fix potential UAF in reqsk_timer_handler().
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk imm…
-
Unscored —
drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs.
-
Unscored —
ntfs: fix resident conversion in ntfs_new_attr_flags
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfs_new_attr_flags When setting sparse/compressed flags on a resident attribute, the function skipped the resident-to-non-resident conversion and terminated.
-
Unscored —
dm cache: fix issue with background work locking
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rw_semaphore for background_work_lock. Write locks on rw_semaphores have strict owner semantics, but there was no guarantee th…
-
Unscored —
x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() hv_apicid_to_vp_index() currently uses the per-cpu hypercall input and output pages. This function is called when runnin…
-
Unscored —
io_uring/io-wq: don't hide a link from cancellations
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. io_uring_cancel_generic() looks everywhere a request can be,…
-
Unscored —
io_uring: don't flood a cancelling task with task_work
In the Linux kernel, the following vulnerability has been resolved: io_uring: don't flood a cancelling task with task_work io_ring_exit_work() asks each task which has used the ring to remove its tctx node, by task_work, and repeats that until the list is emp…
-
Unscored —
Drivers: hv: Avoid infinite retry loop in init_vp_index()
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in init_vp_index() There is a retry loop in init_vp_index() where the CPUs from a certain node are stripped out if they have already been in the allocat…
-
Unscored —
pid_namespace: make zap_pid_ns_processes() freezable
In the Linux kernel, the following vulnerability has been resolved: pid_namespace: make zap_pid_ns_processes() freezable When the init of a pid namespace exits, zap_pid_ns_processes() waits until all other pids in the namespace are freed. A tracer outside the…
-
Unscored —
tracing: Do not initialize tracefs work if tracing is disabled
In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot (e.g. in early_trace_init() -> allocate_trace_buffers()), tracing_disabled is…
-
High 8.1
tipc: protect node reset trace dump with node lock
In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipc_node_reset_links trace event asks tipc_node_dump() to walk the node's link entries. Unlike the other node events that request link …
-
Unscored —
KEYS: Fix key_reject_and_link() race with keyring restriction
In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix key_reject_and_link() race with keyring restriction The restrict_link check in key_reject_and_link() is done before taking the keyring semaphore, racing with a concurrent keyring_re…
-
Unscored —
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
In the Linux kernel, the following vulnerability has been resolved: pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper Since commit 7fea700e04bd ("zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processe…
-
High 7.8
Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn l2cap_chan may be linked to l2cap_conn at most once. This is assumed in several places, eg l2cap_chan_del cleanup. There is …
-
Unscored —
mm/damon/core: error damos_commit_quota_goal() for zero target_value
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: error damos_commit_quota_goal() for zero target_value Patch series "mm/damon: move zero damos quota target_value handling to the core layer". Having zero DAMOS quota target val…
-
High 7.8
tracing: Reject incomplete event filter expressions
In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to …
-
Unscored —
tracing: Unregister field variable histograms when the command fails
In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An action that names a field on another event needs that field as a variable, so create_field_var_hist() registers a secon…
-
High 7.8
tracing: Save the event file instead of the compatible histogram
In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram create_field_var_hist() creates a histogram on the matched event to supply a field variable, and records it on the target so i…
-
High 7.8
tracing/histograms: Verify event_call identity when updating synth_event refcount
In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Verify event_call identity when updating synth_event refcount In event_hist_trigger_parse() and hist_unreg_all(), the histogram registration and unregistration paths look …
-
High 7.8
io_uring/waitid: own the request before clearing ->head
In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: own the request before clearing ->head io_waitid_remove_wq() only takes the wait queue lock if ->head is set. io_waitid_wait() clears ->head first thing, before it tries to b…
-
Unscored —
io_uring/wait: don't spin on a stuck overflow list
In the Linux kernel, the following vulnerability has been resolved: io_uring/wait: don't spin on a stuck overflow list As long as IO_CHECK_CQ_OVERFLOW_BIT is set, io_cqring_wait_schedule() returns right away, before it gets to look at signals or arms the time…
-
Unscored —
io_uring/cmd: don't leave list poison in ->hash_node
In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: don't leave list poison in ->hash_node io_uring_cmd_del_cancelable() uses hlist_del() to take a command off ->cancelable_uring_cmd, which leaves LIST_POISON1/2 behind in ->hash_…
-
High 7.8
io_uring/waitid: prevent cancel reference wrap
In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: prevent cancel reference wrap io_waitid packs the cancellation state into bit 31 of ->refs and uses bits 30:0 as a 31-bit reference counter: #define IO_WAITID_CANCEL_FLAG BIT…