[CVE-2026-45855][MODERATE REGULAR] ata: libata-scsi: avoid Non-NCQ command starvation [ Upstream
2026-05-27 13:12 UTC
[CVE-2026-45857][MODERATE REGULAR] scsi: csiostor: Fix dereference of null pointer rn [ Upstream
2026-05-27 13:09 UTC
[CVE-2026-45949][MODERATE REGULAR] hwrng: core - use RCU and work_struct to fix race condition [ Upstream
2026-05-27 13:05 UTC
[CVE-2026-45974][MODERATE REGULAR] btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found [ Upstream
2026-05-27 13:02 UTC
[CVE-2026-45981][MODERATE REGULAR] s390/cio: Fix device lifecycle handling in css_alloc_subchannel() [ Upstream
2026-05-27 12:58 UTC
[CVE-2026-45873][LOW] netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets [ Upstream
2026-05-27 12:51 UTC
[CVE-2026-45840][MODERATE 7.0] openvswitch: cap upcall PID array size and pre-size vport replies [ Upstream
2026-05-27 12:30 UTC
[CVE-2026-45845][MODERATE REGULAR] net/sched: taprio: fix NULL pointer dereference in class dump [ Upstream
2026-05-27 12:22 UTC
[CVE-2026-45846][MODERATE REGULAR] bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() [ Upstream
2026-05-27 10:15 UTC
[CVE-2026-45842][MODERATE REGULAR] slip: reject VJ receive packets on instances with no rstate array [ Upstream
2026-05-27 10:12 UTC
[CVE-2026-45838][MODERATE REGULAR] bpf: fix end-of-list detection in cgroup_storage_get_next_key() [ Upstream
2026-05-27 10:09 UTC
[CVE-2026-45843][MODERATE REGULAR] slip: bound decode() reads against the compressed packet length [ Upstream
2026-05-27 10:05 UTC
[CVE-2026-45837][IMPORTANT] bpf: Fix use-after-free in arena_vm_close on fork
2026-05-27 10:02 UTC
[CVE-2026-45844][MODERATE REGULAR] netfilter: arp_tables: fix IEEE1394 ARP payload parsing [ Upstream
2026-05-27 9:55 UTC
[CVE-2026-45841][MODERATE REGULAR] netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO [ Upstream
2026-05-27 9:51 UTC
[CVE-2026-45836][MODERATE 7.0] Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()
2026-05-26 16:59 UTC
[CVE-2026-45834][MODERATE 7.0] Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
2026-05-26 16:55 UTC
[CVE-2026-45835][MODERATE 7.0] Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
2026-05-26 16:52 UTC
[CVE-2026-46300][IMPORTANT] net: skbuff: propagate shared-frag marker through frag-transfer helpers
2026-05-23 12:52 UTC
[CVE-2026-31402][IMPORTANT] nfsd: fix heap overflow in NFSv4.0 LOCK replay cache [ Upstream
2026-05-21 20:57 UTC
[CVE-2025-68741][IMPORTANT] scsi: qla2xxx: Fix improper freeing of purex item [ Upstream
2026-05-21 20:44 UTC
[CVE-2026-31772][IMPORTANT] Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
2026-05-21 20:33 UTC
[CVE-2026-31787][MODERATE 7.0] xen/privcmd: fix double free via VMA splitting
2026-05-21 20:23 UTC
[CVE-2026-43502][MODERATE REGULAR] net/rds: handle zerocopy send cleanup before the message is queued
2026-05-21 15:09 UTC
[CVE-2026-43494][IMPORTANT] net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user(). Fixes: 0cebacc ("rds: zerocopy Tx support.") Signed-off-by: Allison Henderson <[email protected]> Reviewed-by: Simon Horman <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
2026-05-21 14:52 UTC
[CVE-2026-43496][LOW] net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked
2026-05-21 12:57 UTC
[CVE-2026-43501][IMPORTANT] ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
2026-05-21 12:52 UTC
[CVE-2026-43330][MODERATE REGULAR] crypto: caam - fix overflow on long hmac keys [ Upstream
2026-05-21 11:25 UTC
[CVE-2026-43023][IMPORTANT] Bluetooth: SCO: fix race conditions in sco_sock_connect() [ Upstream
2026-05-21 4:38 UTC
[CVE-2026-43037][IMPORTANT] ip6_tunnel: clear skb2->cb[] in ip4ip6_err() [ Upstream
2026-05-21 4:28 UTC
[CVE-2024-39503][MODERATE 7.0] netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type [ Upstream
2026-05-21 3:35 UTC
[CVE-2026-43038][IMPORTANT] ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() [ Upstream
2026-05-21 2:42 UTC
[CVE-2022-50835][LOW] jbd2: add miss release buffer head in fc_do_one_pass()
2026-05-21 2:38 UTC
[CVE-2026-31431][IMPORTANT] crypto: algif_aead - Revert to operating out-of-place [ Upstream
2026-05-21 2:22 UTC
[CVE-2026-43500][IMPORTANT] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
2026-05-21 1:43 UTC
[CVE-2026-43304][IMPORTANT] libceph: define and enforce CEPH_MAX_KEY_LEN [ Upstream
2026-05-20 23:59 UTC
[CVE-2026-43208][MODERATE 7.0] net: do not pass flow_id to set_rps_cpu() [ Upstream
2026-05-20 21:36 UTC
page: | prev (newer) | latest
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox