[CVE-2026-98557][LOW] gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO [ Upstream
2026-10-24 12:28 UTC
[CVE-2026-98646][LOW] tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context [ Upstream
2026-10-24 12:26 UTC
[CVE-2026-98721][LOW] mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
2026-10-24 12:24 UTC
[CVE-2026-98526][IMPORTANT] llc: reserve device headroom for allocated frames
2026-10-24 12:21 UTC
[CVE-2026-98636][LOW] squashfs: Add dictionary size range check to prevent shift-out-of-bounds [ Upstream
2026-10-24 12:17 UTC
[CVE-2026-98517][MODERATE 7.0] drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
2026-10-24 12:13 UTC
[CVE-2026-98494][LOW] net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
2026-10-24 12:11 UTC
[CVE-2026-98485][MODERATE REGULAR] netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
2026-10-24 12:07 UTC
[CVE-2026-98827][IMPORTANT] wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE [ Upstream
2026-10-24 12:04 UTC
[CVE-2026-98816][MODERATE REGULAR] bpf: Fix overflow of jump offset in constant blinding [ Upstream
2026-10-24 12:00 UTC
[CVE-2026-98553][LOW] autofs: fix sbi->pipe file reference leak in autofs_kill_sb() [ Upstream
2026-10-24 11:58 UTC
[CVE-2026-98666][MODERATE 7.0] iio: gyro: adis16136: fix unprotected debugfs reads
2026-10-24 11:55 UTC
[CVE-2026-98559][MODERATE 7.0] net/smc: fix UAF on lgr list traversal in smcr_port_err() [ Upstream
2026-10-24 11:52 UTC
[CVE-2026-98822][MODERATE 7.0] wifi: mac80211: prevent AP VLAN tx from other interfaces [ Upstream
2026-10-24 11:48 UTC
[CVE-2026-98794][MODERATE 7.0] ipvs: filter some flags received in the backup server [ Upstream
2026-10-24 11:45 UTC
[CVE-2026-98785][LOW] drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
2026-10-24 11:43 UTC
[CVE-2026-98540][MODERATE 7.0] fprobe: Terminate the fgraph_data list when the reservation is not filled
2026-10-24 11:41 UTC
[CVE-2026-98620][LOW] net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure [ Upstream
2026-10-24 11:38 UTC
[CVE-2026-98530][LOW] kprobes: Fix permanent hang when flushing the kprobe optimizer
2026-10-24 11:36 UTC
[CVE-2026-98560][LOW] net/rds: size a connection's path set by the transport it ends up with [ Upstream
2026-10-24 11:34 UTC
[CVE-2026-98706][MODERATE 7.0] wifi: mac80211: drain PS delivery work during station teardown
2026-10-24 11:32 UTC
[CVE-2026-98501][MODERATE 7.0] HID: alps: fix use-after-free on input2 registration failure
2026-10-24 11:28 UTC
[CVE-2026-98512][IMPORTANT] drm/nouveau: RCU-free the scheduler-containing nouveau_sched
2026-10-24 11:25 UTC
[CVE-2026-98558][LOW] net: flush skb_defer_nodes in dev_cpu_dead() [ Upstream
2026-10-24 11:21 UTC
[CVE-2026-98786][LOW] drm/amd/display: guard dc_sink dereferences in MST mode validation
2026-10-24 11:19 UTC
[CVE-2026-98581][MODERATE REGULAR] nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() [ Upstream
2026-10-24 11:17 UTC
[CVE-2026-98772][MODERATE 7.0] USB: serial: fix port tear down use-after-free
2026-10-24 11:14 UTC
[CVE-2026-98454][MODERATE 7.0] smb: client: fix create context out-of-bounds reads
2026-10-24 11:12 UTC
[CVE-2026-98599][MODERATE 7.0] bpf: Reject non-negative offsets in stack_slot_obj_get_spi() [ Upstream
2026-10-24 11:09 UTC
[CVE-2026-98593][LOW] s390/debug: Fix NULL pointer dereference in debug_info_copy() [ Upstream
2026-10-24 11:06 UTC
[CVE-2026-98678][LOW] iio: adc: ad4030: fix invalid oversampling_ratio validation [ Upstream
2026-10-24 11:04 UTC
[CVE-2026-98705][MODERATE REGULAR] wifi: mac80211: account proxy paths against the mesh path limit
2026-10-24 11:02 UTC
[CVE-2026-98614][MODERATE REGULAR] sctp: avoid livelock while updating retransmit path [ Upstream
2026-10-24 10:59 UTC
[CVE-2026-98645][IMPORTANT] HID: winwing: fix use-after-free in force feedback teardown [ Upstream
2026-10-24 10:56 UTC
[CVE-2026-98598][LOW] ipv6: Prevent rt6_insert_exception() for dying fib6_info. [ Upstream
2026-10-24 10:53 UTC
[CVE-2026-98635][IMPORTANT] scsi: block: Fix zones_cond out-of-bounds write on zone report [ Upstream
2026-10-24 10:50 UTC
[CVE-2026-98864][LOW] sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task [ Upstream
2026-10-24 10:47 UTC
[CVE-2026-98525][MODERATE 7.0] mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
2026-10-24 10:45 UTC
[CVE-2026-98844][MODERATE REGULAR] netfs: clear post-EOF pagecache when extending a file via write [ Upstream
2026-10-24 10:43 UTC
[CVE-2026-98815][MODERATE 7.0] nvme: fix cdev lifetime [ Upstream
2026-10-24 10:40 UTC
[CVE-2026-98777][MODERATE REGULAR] binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
2026-10-24 10:38 UTC
[CVE-2026-98486][LOW] net: ena: fix MMIO read buffer leak on probe failure [ Upstream
2026-10-24 10:36 UTC
[CVE-2026-98472][LOW] KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV
2026-10-24 10:33 UTC
[CVE-2026-98754][MODERATE 7.0] tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
2026-10-24 10:31 UTC
[CVE-2026-98679][LOW] iio: accel: kxcjk-1013: reject duplicate event disable
2026-10-24 10:29 UTC
[CVE-2026-98673][LOW] iio: adc: pac1934: check ACPI label duplication
2026-10-24 10:27 UTC
[CVE-2026-98834][MODERATE 7.0] mtd: core: avoid double-free of OTP NVMEM device [ Upstream
2026-10-24 10:24 UTC
[CVE-2026-98665][LOW] iio: health: max30102: fix NULL dereference in interrupt handler
2026-10-24 10:22 UTC
[CVE-2026-98693][MODERATE 7.0] thunderbolt: Hold a router reference for each allocated HopID
2026-10-24 10:20 UTC
[CVE-2026-98699][MODERATE 7.0] wifi: mac80211: fix mesh fast xmit path deletion UAF
2026-10-24 10:17 UTC
[CVE-2026-98492][LOW] net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths [ Upstream
2026-10-24 10:14 UTC
[CVE-2026-98797][MODERATE 7.0] net: cap skb->queue_mapping when the tx queue is picked [ Upstream
2026-10-24 10:12 UTC
[CVE-2026-98681][MODERATE 7.0] smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
2026-10-24 10:09 UTC
[CVE-2026-98480][LOW] nfc: trf7970a: power down on startup RX gain failure
2026-10-24 10:07 UTC
[CVE-2026-98578][IMPORTANT] nfc: st21nfca: validate ISO15693 inventory length [ Upstream
2026-10-24 10:05 UTC
[CVE-2026-98625][MODERATE 7.0] netfilter: flowtable: publish HW_DEAD after worker is done [ Upstream
2026-10-24 10:00 UTC
[CVE-2026-98535][LOW] fsl/fman: Fix clk reference leak in read_dts_node()
2026-10-24 9:56 UTC
[CVE-2026-98698][MODERATE REGULAR] wifi: mac80211: handle empty FILS association request payload
2026-10-24 9:53 UTC
[CVE-2026-98780][LOW] drm/amdgpu: fix IP instance memory leak on kobject add failure
2026-10-24 9:51 UTC
[CVE-2026-98545][MODERATE 7.0] ata: libata-scsi: bound the ATA passthru sense descriptor writes
2026-10-24 9:49 UTC
[CVE-2026-98514][LOW] drm/nouveau: Fix gem reference leak in validate_init()
2026-10-24 9:46 UTC
[CVE-2026-98824][MODERATE 7.0] wifi: mac80211: validate TX status rate metadata [ Upstream
2026-10-24 9:43 UTC
[CVE-2026-98792][MODERATE 7.0] netfilter: flowtable: generalize pending status bit [ Upstream
2026-10-24 9:40 UTC
[CVE-2026-98565][LOW] net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 [ Upstream
2026-10-24 9:37 UTC
[CVE-2026-98497][MODERATE 7.0] net/mlx5e: fix swapped IPv6 IPsec policy masks
2026-10-24 9:34 UTC
[CVE-2026-98573][MODERATE 7.0] net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() [ Upstream
2026-10-24 9:31 UTC
[CVE-2026-98579][LOW] nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure [ Upstream
2026-10-24 9:27 UTC
[CVE-2026-98719][IMPORTANT] KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it
2026-10-24 9:24 UTC
[CVE-2026-98713][LOW] KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT [ Upstream
2026-10-24 9:21 UTC
[CVE-2026-98617][MODERATE 7.0] eth: fbnic: use the Rx queue napi pointer to find the napi vector [ Upstream
2026-10-24 9:18 UTC
[CVE-2026-98731][LOW] Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
2026-10-24 9:16 UTC
[CVE-2026-98536][MODERATE REGULAR] writeback: report a Tasks-RCU quiescent state per cgwb drain pass
2026-10-24 9:14 UTC
[CVE-2026-98626][MODERATE REGULAR] bpf: Restrict CO-RE poisoning to relocatable instructions [ Upstream
2026-10-24 9:10 UTC
[CVE-2026-98867][MODERATE 7.0] dm-pcache: bound the logical key offset from persistent memory [ Upstream
2026-10-24 9:07 UTC
[CVE-2026-98546][MODERATE REGULAR] arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
2026-10-24 9:05 UTC
[CVE-2026-98741][IMPORTANT] ALSA: ua101: reject mismatched capture/playback packet sizes
2026-10-24 9:02 UTC
[CVE-2026-98808][MODERATE 7.0] net: systemport: Fix buffer overflow in bcm_sysport_get_stats() [ Upstream
2026-10-24 8:58 UTC
[CVE-2026-98851][LOW] netfilter: nft_flow_offload: drop flowtable reference on init error path
2026-10-24 8:55 UTC
[CVE-2026-98757][MODERATE 7.0] usb: cdns3: fix use-after-free in cdns3_gadget_exit()
2026-10-24 8:53 UTC
[CVE-2026-98761][LOW] usb: typec: tcpm: recover after failure to start the frs ams
2026-10-24 8:51 UTC
[CVE-2026-98659][LOW] iio: pressure: rohm-bm1390: Return error when read fails
2026-10-24 8:48 UTC
[CVE-2026-98700][MODERATE REGULAR] wifi: mac80211: set info->band for 802.3 encap offload frames [ Upstream
2026-10-24 8:47 UTC
[CVE-2026-98774][LOW] rust_binder: cancel deferred work items in thread exit
2026-10-24 8:44 UTC
[CVE-2026-98566][MODERATE 7.0] drm/imagination: clamp freelist reconstruction requests [ Upstream
2026-10-24 8:42 UTC
[CVE-2026-98847][LOW] rtc: spear: initialize IRQ state before requesting alarm IRQ
2026-10-24 8:39 UTC
[CVE-2026-98452][MODERATE REGULAR] smb: client: clean up failed cached directory opens
2026-10-24 8:36 UTC
[CVE-2026-98653][LOW] KVM: s390: Fix _gaccess_shadow_fault() [ Upstream
2026-10-24 8:33 UTC
[CVE-2026-98837][MODERATE 7.0] ALSA: caiaq: unregister the input device when probe fails
2026-10-24 8:31 UTC
[CVE-2026-98457][MODERATE 7.0] Bluetooth: L2CAP: validate frame length before control and FCS access
2026-10-24 8:28 UTC
[CVE-2026-98842][LOW] module: fix lost error code from codetag_load_module()
2026-10-24 8:25 UTC
[CVE-2026-98630][LOW] eth: fbnic: Fix payload page pool error cleanup [ Upstream
2026-10-24 8:23 UTC
[CVE-2026-98718][IMPORTANT] KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state
2026-10-24 8:21 UTC
[CVE-2026-98474][MODERATE REGULAR] s390/pci: Fix missing device lock in zpci_report_status()
2026-10-24 8:17 UTC
[CVE-2026-98461][MODERATE REGULAR] Bluetooth: hci_sock: validate event length before filtering
2026-10-24 8:14 UTC
[CVE-2026-98520][MODERATE 7.0] drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
2026-10-24 8:11 UTC
[CVE-2026-98752][MODERATE 7.0] tty: port: fix tty_port_tty_vhangup() race [ Upstream
2026-10-24 8:08 UTC
[CVE-2026-98640][LOW] HID: amd_sfh: Validate PCI BAR size before mapping [ Upstream
2026-10-24 8:05 UTC
[CVE-2026-98809][LOW] Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister [ Upstream
2026-10-24 8:01 UTC
[CVE-2026-98832][LOW] blk-cgroup: save IRQ state in blkg_tryget_closest() [ Upstream
2026-10-24 7:59 UTC
[CVE-2026-98803][MODERATE 7.0] net: stmmac: fix rx Scatter-Gather support [ Upstream
2026-10-24 7:58 UTC
[CVE-2026-98658][MODERATE REGULAR] iio: proximity: aw96103: validate firmware data length
2026-10-24 7:55 UTC
[CVE-2026-98612][MODERATE REGULAR] net: usb: catc: bound the RX packet length in catc_rx_done() [ Upstream
2026-10-24 7:52 UTC
[CVE-2026-98601][MODERATE REGULAR] Bluetooth: btintel_pcie: validate device-supplied DMA indices [ Upstream
2026-10-24 7:48 UTC
[CVE-2026-98660][MODERATE REGULAR] iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
2026-10-24 7:46 UTC
[CVE-2026-98810][LOW] wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() [ Upstream
2026-10-24 7:43 UTC
[CVE-2026-98441][MODERATE 7.0] net/sched: act_ct: avoid modifying shared unconfirmed ct entry [ Upstream
2026-10-24 7:41 UTC
[CVE-2026-98862][IMPORTANT] audit: fix exe mark UAF in kill_rules()
2026-10-24 7:35 UTC
[CVE-2026-98728][MODERATE REGULAR] tpm: fix off-by-four bounds check in tpm2_get_random() [ Upstream
2026-10-24 7:31 UTC
[CVE-2026-98784][LOW] drm/amdgpu/gfx6: fix firmware leak on teardown
2026-10-24 7:28 UTC
[CVE-2026-98510][MODERATE REGULAR] drm/xe/vm: nuke PTs only after unlinking contested VMAs [ Upstream
2026-10-24 7:26 UTC
[CVE-2026-98562][IMPORTANT] net: libwx: fix races in Tx timestamp handling [ Upstream
2026-10-24 7:24 UTC
[CVE-2026-98456][IMPORTANT] Bluetooth: mgmt: fix race in read_unconf_index_list()
2026-10-24 7:21 UTC
[CVE-2026-98795][MODERATE REGULAR] net: sparx5: skip ptp deinit if init was skipped [ Upstream
2026-10-24 7:18 UTC
[CVE-2026-98532][IMPORTANT] ipv6: do not let ipv6_find_hdr() return an offset past the packet end
2026-10-24 7:15 UTC
[CVE-2026-98503][IMPORTANT] packet: use ubuf_info completion for TX_RING packets [ Upstream
2026-10-24 7:11 UTC
[CVE-2026-98622][MODERATE REGULAR] net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure [ Upstream
2026-10-24 7:07 UTC
[CVE-2026-98509][LOW] drm/virtio: fix memory leak of fence event on execbuffer failure
2026-10-24 7:03 UTC
[CVE-2026-98542][MODERATE REGULAR] cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict [ Upstream
2026-10-24 7:01 UTC
[CVE-2026-98820][LOW] blk-mq: set RQF_USE_SCHED when the operation is known [ Upstream
2026-10-24 6:59 UTC
[CVE-2026-98627][IMPORTANT] bpf: Preserve packet pointer class displacement in regsafe() [ Upstream
2026-10-24 6:57 UTC
[CVE-2026-98537][LOW] workqueue: Fix NULL current_pwq deref in flush dependency check
2026-10-24 6:54 UTC
[CVE-2026-98616][LOW] eth: fbnic: reset num_napi when the napi vectors are freed [ Upstream
2026-10-24 6:51 UTC
[CVE-2026-98729][MODERATE REGULAR] x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
2026-10-24 6:49 UTC
[CVE-2026-98723][IMPORTANT] nvmet: copy the hostid into the ctrl before creating PR pc_refs [ Upstream
2026-10-24 6:47 UTC
[CVE-2026-98547][LOW] af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
2026-10-24 6:44 UTC
[CVE-2026-98866][MODERATE 7.0] sched/cache: Introduce task_struct->sched_cache_grp to fix UAF [ Upstream
2026-10-24 1:59 UTC
[CVE-2026-98484][MODERATE REGULAR] netfilter: nf_tables: skip expired catchall elements on insert and delete
2026-10-24 1:56 UTC
[CVE-2026-98508][MODERATE REGULAR] drm/virtio: fix NULL pointer dereference on fence allocation failure
2026-10-24 1:53 UTC
[CVE-2026-98846][IMPORTANT] sctp: check RCV_SHUTDOWN after the sendmsg connect wait
2026-10-24 1:44 UTC
[CVE-2026-98567][IMPORTANT] net: xps: reject an out of range traffic class [ Upstream
2026-10-24 1:40 UTC
[CVE-2026-98495][MODERATE REGULAR] net: arp: terminate device name before lookup
2026-10-24 1:32 UTC
[CVE-2026-98756][MODERATE REGULAR] usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
2026-10-24 1:27 UTC
[CVE-2026-98551][MODERATE REGULAR] perf/core: Fill branch entries with a single assignment [ Upstream
2026-10-24 1:25 UTC
[CVE-2026-98836][IMPORTANT] ALSA: line6: reject oversized playback packets
2026-10-24 1:16 UTC
[CVE-2026-98644][MODERATE REGULAR] bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() [ Upstream
2026-10-24 1:12 UTC
[CVE-2026-98615][MODERATE REGULAR] eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox [ Upstream
2026-10-24 1:09 UTC
[CVE-2026-98634][MODERATE REGULAR] scsi: sd_zbc: Reject disks with too many zones [ Upstream
2026-10-24 1:07 UTC
[CVE-2026-98588][IMPORTANT] bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc [ Upstream
2026-10-24 1:04 UTC
[CVE-2026-98865][LOW] sched_ext: Don't run ops.dequeue() with a DSQ lock held [ Upstream
2026-10-24 1:00 UTC
[CVE-2026-98470][LOW] KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode
2026-10-24 0:57 UTC
[CVE-2026-98524][MODERATE 7.0] rds: ib: Clear the sg list when mapping an MR fails
2026-10-24 0:56 UTC
[CVE-2026-98755][MODERATE REGULAR] tty: vcc: zero-initialize control packet in vcc_send_ctl()
2026-10-24 0:51 UTC
[CVE-2026-98496][MODERATE 7.0] net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
2026-10-24 0:48 UTC
[CVE-2026-98814][MODERATE 7.0] nvme: fix command effects log lifetime for multipath heads [ Upstream
2026-10-24 0:45 UTC
[CVE-2026-98845][MODERATE 7.0] tpm: Disable TPM on null key name mismatch
2026-10-24 0:35 UTC
[CVE-2026-98835][MODERATE REGULAR] iio: accel: kionix-kx022a: Fix array boundary check [ Upstream
2026-10-24 0:32 UTC
[CVE-2026-98664][MODERATE 7.0] iio: imu: adis16400: fix unprotected debugfs reads
2026-10-24 0:30 UTC
[CVE-2026-98671][LOW] iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
2026-10-24 0:26 UTC
[CVE-2026-98796][MODERATE 7.0] net: ethernet: mtk_eth_soc: allocate dummy netdev sooner [ Upstream
2026-10-24 0:24 UTC
[CVE-2026-98591][MODERATE 7.0] bpf: Fix bounds check for skb-backed dynptrs [ Upstream
2026-10-24 0:21 UTC
[CVE-2026-98455][MODERATE REGULAR] Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
2026-10-24 0:17 UTC
[CVE-2026-98589][MODERATE 7.0] bpf: Reject pkt arguments in mutating subprogs [ Upstream
2026-10-24 0:14 UTC
[CVE-2026-98583][MODERATE REGULAR] nfc: nfcmrvl: validate helper command length before pull [ Upstream
2026-10-24 0:11 UTC
[CVE-2026-98770][MODERATE 7.0] usb: gadget: midi2: Fix the jack descriptor array sizes
2026-10-24 0:08 UTC
[CVE-2026-98704][MODERATE 7.0] wifi: mac80211: keep fallback association elements alive
2026-10-24 0:04 UTC
[CVE-2026-98624][IMPORTANT] netfilter: nfnetlink_queue: hold nfnl mutex in event notifier [ Upstream
2026-10-24 0:01 UTC
[CVE-2026-98688][MODERATE REGULAR] thunderbolt: Fix NULL dereference in tb_remove_work()
2026-10-23 23:56 UTC
[CVE-2026-98534][MODERATE 7.0] ipe: fix use-after-free when auditing a newly loaded policy [ Upstream
2026-10-23 23:54 UTC
[CVE-2026-98515][IMPORTANT] drm/nouveau: fix double-free in nvif_vmm_dtor
2026-10-23 23:50 UTC
[CVE-2026-98544][MODERATE 7.0] bna: prevent IOC timer rearm during teardown [ Upstream
2026-10-23 23:46 UTC
[CVE-2026-98790][LOW] perf: Fix race between perf_event_exit_task() and perf_pending_task() [ Upstream
2026-10-23 23:44 UTC
[CVE-2026-98782][LOW] drm/mediatek: Fix ovl adaptor platform device leak
2026-10-23 23:41 UTC
[CVE-2026-98825][MODERATE REGULAR] rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() [ Upstream
2026-10-23 23:39 UTC
[CVE-2026-98869][MODERATE 7.0] bpf: Infer zext_dst based on static register liveness analysis As reported in the thread [1], the verifier's 32-bit operations zero extension logic is broken. This logic is responsible for correct semantics of 32-bit operations on s390 architecture. According to BPF semantics, operation `w1 += 1` is supposed to zero extend the upper half of the register `r1`. On s390 the JIT relies on the verifier emitting explicit zero extension before such operations. The verifier attempts to minimize the amount of zero extensions inserted by tracking whether upper halves of the 64-bit registers are ever used. Previously such tracking worked as follows: - bpf_reg_state->subreg_def field was set by do_check_insn() for each operation defining lower but not the upper halves of the register. - Whenever an operation reading the whole register was verified, the verifier checked register's subreg_def and set bpf_insn_aux_data->zext_dst flag as true via a call to mark_insn_zext() function. - After the verification was complete, a special pass bpf_opt_subreg_zext_lo32_rnd_hi32() extended 32-bit operations with bpf_insn_aux_data->zext_dst set as true by adding explicit zero extension. Note that the logic above relies on bpf_reg_state->subreg_def, which is a property of a current verifier state. Before the commit [2] two additional steps happened: - The verifier tracked upper and lower register halves' liveness as flags REG_LIVE_READ{32,64} in bpf_reg_state->live. - The function propagate_liveness() called mark_insn_zext() in order to transfer the knowledge about which registers have their upper halves alive (and thus might require zero extension). The commit [2] removed the two steps described above, hence making possible a situation like below: - The register's upper half is set and is used on some verification path P1 and the register happens not to be marked as precise. - The checkpoint C is created while processing some instruction between register initialization and usage. - On some other verification path P2 the register's upper half is not initialized and that path ends hitting the checkpoint C. - In such a case the register's initialization on path P2 would lack zext_dst mark, making it possible for the program to inject an arbitrary value in the register's upper half. This commit replaces subreg_def based logic with computing zext_dst statically, as a part of the bpf_compute_live_registers() analysis: - The analysis now tracks usage of upper and lower halves of the registers separately. - If some instruction defines a 32-bit subregister, but not the whole register, *and* the upper half of the register is alive after that instruction, the instruction is marked as zext_dst. There is one notable drop in precision: whenever a BPF subprogram is called, all 64 bits of parameter registers are presumed to be used. The assumption is that such a drop in precision would not inflict a noticeable performance penalty. [1] https://lore.kernel.org/bpf/CAGKGUv=sOuqQtA1Ub-5JXfA4FPosJFYKAQE4B79cK+P1erxqtg@mail.gmail.com/ [2]
2026-10-22 2:11 UTC
[CVE-2023-7356][IMPORTANT] Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID [ Upstream
2026-10-22 2:08 UTC
[CVE-2026-98487][MODERATE 7.0] net: bridge: mdb: restart port group walk after deletion
2026-10-19 10:44 UTC
[CVE-2026-98571][MODERATE 7.0] net: stmmac: clear stale buf->page after recycling on skb build failure [ Upstream
2026-10-19 10:41 UTC
[CVE-2026-98776][MODERATE 7.0] binderfs: fix UAF write in binder_add_device
2026-10-19 10:36 UTC
[CVE-2026-98564][MODERATE REGULAR] net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq [ Upstream
2026-10-19 10:33 UTC
[CVE-2026-98683][LOW] smb: client: flush dirty data before zeroing a range [ Upstream
2026-10-19 10:30 UTC
[CVE-2026-98482][MODERATE REGULAR] nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
2026-10-19 10:28 UTC
[CVE-2026-98689][MODERATE REGULAR] thunderbolt: Don't access a DP tunnel after its DPRX read was canceled [ Upstream
2026-10-19 10:24 UTC
[CVE-2026-98476][MODERATE REGULAR] s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
2026-10-19 10:22 UTC
[CVE-2026-98787][MODERATE REGULAR] bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch() [ Upstream
2026-10-19 10:18 UTC
[CVE-2026-98691][MODERATE REGULAR] thunderbolt: Tear down inactive DP tunnels when the domain is stopped
2026-10-19 10:16 UTC
[CVE-2026-98490][MODERATE 7.0] net: openvswitch: conntrack: fix helper UAF due to extensions realloc
2026-10-19 10:13 UTC
[CVE-2026-98801][MODERATE 7.0] net: restrict SO_RESERVE_MEM to TCP sockets and cap max value [ Upstream
2026-10-19 10:08 UTC
[CVE-2026-98748][MODERATE 7.0] serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
2026-10-19 10:05 UTC
[CVE-2026-98860][MODERATE REGULAR] HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
2026-10-19 10:02 UTC
[CVE-2026-98475][MODERATE 7.0] s390/cmf: Fix virtual vs physical address confusion
2026-10-19 10:00 UTC
[CVE-2026-98858][MODERATE 7.0] io_uring: fix task_work add use-after-free with SQPOLL [ Upstream
2026-10-19 9:56 UTC
[CVE-2026-98812][MODERATE REGULAR] net/mctp: publish the mctp_dev only after it is initialised [ Upstream
2026-10-19 9:52 UTC
[CVE-2026-98463][MODERATE 7.0] sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags [ Upstream
2026-10-19 9:49 UTC
[CVE-2026-98469][MODERATE REGULAR] KVM: arm64: Fix AArch32 DBGBXVR<n> handling
2026-10-19 9:45 UTC
[CVE-2026-98662][MODERATE 7.0] iio: light: gp2ap020a00f: drain irq_work after free_irq
2026-10-19 9:43 UTC
[CVE-2026-98610][MODERATE REGULAR] net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget [ Upstream
2026-10-19 9:40 UTC
[CVE-2026-98738][MODERATE 7.0] Bluetooth: Serialize SMP remote OOB data access [ Upstream
2026-10-19 9:37 UTC
[CVE-2026-98830][MODERATE 7.0] wifi: wfx: validate MIB read length before copying to caller [ Upstream
2026-10-19 9:33 UTC
[CVE-2026-98443][IMPORTANT] xfs: fix cursor and pointer handling when recovering iunlink buckets [ Upstream
2026-10-19 9:30 UTC
[CVE-2026-98642][MODERATE 7.0] bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk [ Upstream
2026-10-19 9:26 UTC
[CVE-2026-98449][MODERATE REGULAR] smb: client: delete compound mids on send failure before unlock
2026-10-19 9:23 UTC
[CVE-2026-98433][LOW] KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure [ Upstream
2026-10-19 9:20 UTC
[CVE-2026-98609][LOW] drm/virtio: fix object leak when drm_gem_handle_create() fails [ Upstream
2026-10-19 9:17 UTC
[CVE-2026-98522][MODERATE REGULAR] drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
2026-10-19 9:14 UTC
[CVE-2026-98750][MODERATE 7.0] tty: fix saved termios reset race [ Upstream
2026-10-19 9:11 UTC
[CVE-2026-98603][MODERATE 7.0] ovpn: replace bind when clearing stale local source [ Upstream
2026-10-19 9:09 UTC
[CVE-2026-98632][IMPORTANT] Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel [ Upstream
2026-10-19 9:05 UTC
[CVE-2026-98439][MODERATE 7.0] smb/server: cancel async requests when closing connection [ Upstream
2026-10-19 9:01 UTC
[CVE-2026-98840][MODERATE 7.0] vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF [ Upstream
2026-10-19 8:58 UTC
[CVE-2026-98768][MODERATE 7.0] usb: typec: anx7411 - stop the IRQ before destroying the workqueue
2026-10-19 8:55 UTC
page: next (older) | prev (newer) | latest
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox