Tagged “csaf”
CVEs tagged csaf, newest first.
7670 CVEsRSS
CVE-2026-98576Medium· 5.3kernel: nfc: llcp: fix slab-out-of-bounds reads when logging service names (CVE-2026-98576)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. When processing certain service names and requests, the kernel attempts to log strings that lack null-termination using an unbounded format specifier. A local…
CVE-2026-98575Medium· 6.2kernel: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (CVE-2026-98575)
A flaw was found in the Linux kernel's PN533 NFC (Near Field Communication) driver. An attacker capable of connecting a malicious or malfunctioning USB device can supply a crafted response frame with an arbitrary data length value. Because…
CVE-2026-98580Medium· 5.5kernel: nfc: llcp: Fix race condition in accept_queue lifecycle (CVE-2026-98580)
A flaw was found in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. A race condition occurs during concurrent socket release and connection accept operations due to improper lock synch…
CVE-2026-98578Medium· 6.5kernel: nfc: st21nfca: validate ISO15693 inventory length (CVE-2026-98578)
A flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC) driver. This vulnerability allows a Denial of Service (DoS) when the system encounters malformed wireless NFC responses. A nearby attacker with a crafted NFC de…
CVE-2026-98584Low· 3.3kernel: net/sched: fix potential stack infoleak in em_text_dump() (CVE-2026-98584)
A flaw was found in the Linux kernel's network traffic control subsystem. A local user can exploit this vulnerability to cause an information disclosure of kernel stack data. When dumping text search filter configurations, the kernel fails…
CVE-2026-98582Medium· 6.5kernel: nfc: st21nfca: validate received frame size (CVE-2026-98582)
A flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC) driver. The driver fails to properly validate the length of received frames when processing escape sequences. An attacker capable of sending crafted NFC frames …
CVE-2026-98581Medium· 4.7kernel: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (CVE-2026-98581)
A flaw was found in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. When handling specific disconnection packets, the kernel fails to properly lock and unlink sockets before updating t…
CVE-2026-98588Medium· 4.1kernel: bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc (CVE-2026-98588)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. When allocating a socket map with an excessively large entry count, a signed integer overflow occurs during cleanup when the map is released. A local user with …
CVE-2026-98586Medium· 5.9kernel: sctp: hold asoc or transport before mod_timer() in timer handlers (CVE-2026-98586)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) subsystem. This vulnerability can lead to a Denial of Service (DoS) through a kernel crash. A race condition occurs between timer rearming and cleanup opera…
CVE-2026-98583Medium· 4.4kernel: nfc: nfcmrvl: validate helper command length before pull (CVE-2026-98583)
A flaw was found in the Linux kernel's Marvell NFC (Near Field Communication) driver. During firmware download operations, the driver removes packet headers and reads command data before verifying that the received packet length is valid. …
CVE-2026-98587Medium· 4.7kernel: firewire: cdev: fix back-transition for iso_resource_auto client resource (CVE-2026-98587)
A flaw was found in the Linux kernel's FireWire subsystem. A local user can trigger a race condition by concurrently releasing a device file descriptor while an asynchronous resource management task is running. This flaw allows a resource …
CVE-2026-98585Medium· 4.4kernel: eth: fbnic: Avoid rounding zero ring sizes (CVE-2026-98585)
A flaw was found in the Linux kernel's fbnic network driver. A local user with administrative privileges could trigger a denial of service (DoS) and crash the system by configuring a network ring buffer size of zero. Because the driver fai…
CVE-2026-98591Medium· 6.7kernel: bpf: Fix bounds check for skb-backed dynptrs (CVE-2026-98591)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. An integer underflow in the bounds-checking logic for network packet buffer pointers allows validation checks to pass incorrectly. A local user capable of runni…
CVE-2026-98590Medium· 6.7kernel: bpf: Fix bpf_sock context code generation (CVE-2026-98590)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. An error in context code generation incorrectly sign-extends register values when reading socket queue mappings, causing runtime register values to exceed bound…
CVE-2026-98589Medium· 6.7kernel: bpf: Reject pkt arguments in mutating subprogs (CVE-2026-98589)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) verifier. When packet pointers are passed into subprograms that mutate packet data, the verifier incorrectly assumes the underlying memory remains valid across calls, fail…
CVE-2026-98592Medium· 4.7kernel: net: spacemit: clear TX descriptor on fragment mapping failure (CVE-2026-98592)
A flaw was found in the Linux kernel's SpacemiT Ethernet driver. During network packet transmission, a failure to map packet fragments causes the driver to release memory buffers without properly clearing the corresponding hardware descrip…
CVE-2026-98600Medium· 6.5kernel: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (CVE-2026-98600)
A flaw was found in the Linux kernel's Bluetooth RFCOMM (Radio Frequency Communication) subsystem. This vulnerability allows an adjacent attacker within Bluetooth range to cause a Denial of Service (DoS) by transmitting a specially crafted…
CVE-2026-98594Low· 1.9kernel: tg3: clean up PHYLIB resources on probe failure (CVE-2026-98594)
A flaw was found in the Linux kernel's Broadcom Tigon3 (tg3) ethernet driver. When the driver encounters an error during device initialization, it fails to properly release and unregister associated networking hardware resources. A local u…
CVE-2026-98593Medium· 4.1kernel: s390/debug: Fix NULL pointer dereference in debug_info_copy() (CVE-2026-98593)
A flaw was found in the Linux kernel's s390 debug subsystem. This vulnerability allows a local user to cause a Denial of Service (DoS) through a kernel crash. When static debug registration encounters an error, internal memory pointers are…
CVE-2026-98603Low· 2.5kernel: kernel: Denial of service via race condition in ovpn (CVE-2026-98603)
A flaw was found in the Linux kernel's OpenVPN (ovpn) module. A local user can cause a Denial of Service (DoS) or network disruption during concurrent network traffic when an outdated local source address is cleared. Because the address is…
CVE-2026-98595Low· 3.3kernel: udp: remove a disconnected socket from the 4-tuple hash table (CVE-2026-98595)
A flaw was found in the Linux kernel's UDP networking subsystem. When a connected User Datagram Protocol (UDP) socket bound to a specific address is disconnected, the kernel fails to remove the socket entry from its internal connection loo…
CVE-2026-98597Medium· 6.5kernel: net: usb: sr9700: include receive overhead in the length check (CVE-2026-98597)
A flaw was found in the Linux kernel's sr9700 USB Ethernet driver. When processing incoming packets, the driver fails to properly account for packet header overhead during buffer length validation. An attacker capable of sending crafted pa…
CVE-2026-98596Medium· 5.5kernel: ipv6: Fix dst leak for uncached routes (CVE-2026-98596)
A flaw was found in the Linux kernel's IPv6 networking subsystem. A race condition during network device unregistration can lead to improper reference counting of uncached routes. A local attacker could exploit this flaw to cause an intern…
CVE-2026-98598Medium· 4.7kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info (CVE-2026-98598)
A flaw was found in the Linux kernel's IPv6 networking subsystem. A local attacker or network traffic triggering route exceptions while an IPv6 route is being removed can cause a circular reference leak. This failure to release resources p…
CVE-2026-98599Medium· 6.7kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() (CVE-2026-98599)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. A local attacker can exploit this flaw to cause kernel memory corruption and potentially achieve privilege escalation or a denial of service (system crash). This…
CVE-2026-98612Medium· 6.8kernel: net: usb: catc: bound the RX packet length in catc_rx_done() (CVE-2026-98612)
A flaw was found in the Linux kernel's CATC USB Ethernet driver. The driver fails to properly validate packet length boundaries when processing incoming multi-packet network transfers. An attacker could exploit this flaw by providing craft…
CVE-2026-98610Medium· 5.5kernel: net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget (CVE-2026-98610)
A flaw was found in the Linux kernel's Hierarchical Fair Service Curve (HFSC) network packet scheduler. A local user with network administration privileges, such as within a user namespace, can exploit this flaw to cause a Denial of Servic…
CVE-2026-98611Medium· 4.4kernel: bpf: Check params size before reading reserved fields (CVE-2026-98611)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The bpf_crypto_ctx_create() function attempts to read reserved fields from a parameter structure prior to verifying that the supplied buffer is sufficiently lar…
CVE-2026-98617Medium· 4.1kernel: eth: fbnic: use the Rx queue napi pointer to find the napi vector (CVE-2026-98617)
A flaw was found in the Linux kernel's Meta Host Network Interface (fbnic) driver. The driver incorrectly associates receive queues with network processing vectors and fails to verify whether the datapath is active before allocating queue …
CVE-2026-98614High· 7.5kernel: sctp: avoid livelock while updating retransmit path (CVE-2026-98614)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) subsystem. An attacker could exploit this vulnerability to cause a Denial of Service (DoS) by triggering an infinite loop during retransmission path selecti…