Tagged “score-dispute”
CVEs tagged score-dispute, newest first.
1507 CVEsRSS
CVE-2026-89763High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key_type…
CVE-2026-89762High· 7.8⚖ disputedapparmor: fix cred UAF caused by begin_current_label_crit_section()
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begin_current_label_crit_section() AppArmor's begin_current_label_crit_section() is a scary function called from lots of LSM hooks (in…
CVE-2026-89761High· 7.8⚖ disputedapparmor: fix out-of-bounds write when null terminating a label vec
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE is passed. If the componen…
CVE-2026-89755High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() reads the folio mapping before calling folio_free_swap()
In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap…
CVE-2026-89748High· 7.8⚖ disputedtracing: Fix retry exhaustion in simple ring buffer reader swap
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_reader_page() starts with retry set to 8 and post-decrements it only after a fa…
CVE-2026-89743High· 7.7⚖ disputedmisc: nsm: bound the device-reported response length
In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsm_sendrecv_msg_locked() stores the virtqueue used-ring length reported by the NSM device into msg->resp.len with…
CVE-2026-89738High· 7.8⚖ disputedusb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed In polled-VBUS mode (board.vbus_pin && board.vbus_polled), probe arms a self-restarting cycle: …
CVE-2026-89713Critical· 9.1⚖ disputedNFSD: check truncate permission under inode lock
In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd_setattr() checks whether a size update needs NFSD_MAY_TRUNC before it takes inode_lock(). The comparison uses the…
CVE-2026-89709High· 8.1⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferen…
In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferen…
CVE-2026-89708Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY_SESSION the per-session teardown path can free a session while rpciod still h…
In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY_SESSION the per-session teardown path can free a session while rpciod still h…
CVE-2026-89703Critical· 9.8⚖ disputednfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked delegations but does not set SC_S…
CVE-2026-89702Critical· 9.8⚖ disputednfsd: size fh_verify server sockaddr slot by xpt_locallen
In the Linux kernel, the following vulnerability has been resolved: nfsd: size fh_verify server sockaddr slot by xpt_locallen The nfsd_fh_verify and nfsd_fh_verify_err tracepoints declare the server sockaddr slot sized by xpt_remotelen…
CVE-2026-89687High· 7.5⚖ disputednfsd: ensure nfsd_file_do_acquire() does not use a non-opened file
In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file ->atomic_open is permitted to return success without actually opening the file. It indicates this b…
CVE-2026-80932High· 8.4⚖ disputedvsock/virtio: flush works in dependency order
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtio_vsock_remove() stops the virtqueues and then flushes each work item before freeing the enclosing virtio_vsock. Th…
CVE-2026-80976Critical· 9.8⚖ disputedseg6: reset IP6CB after IPv6 decapsulation
In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decap_and_validate() pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block …
CVE-2026-80967High· 8.4⚖ disputedALSA: pcxhr: initialize mutexes before requesting threaded IRQ
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcxhr: initialize mutexes before requesting threaded IRQ pcxhr_probe() requests pcxhr_threaded_irq() before initializing mgr->lock, even though the threaded hand…
CVE-2026-80935High· 8.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address …
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address …
CVE-2026-80933High· 7.8⚖ disputedwifi: mt76: mt7996: validate default EEPROM firmware size
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated fi…
CVE-2026-80931High· 7.8⚖ disputedw1: ds28e17: reject an oversize length on an I2C block read
In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire to I2C bridge. On an I2C_M_RECV_LEN …
CVE-2026-80928High· 7.8⚖ disputedsmack: fix cred UAF in smack_file_send_sigiotask()
In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smack_file_send_sigiotask() When inspecting the credentials of another task, objective credentials (->real_cred, accessed with __task_cred()) mu…
CVE-2026-81017High· 8.4⚖ disputedplatform/chrome: sensorhub: Bound the EC-reported sensor number
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number (in->sensor_num). cros_ec_sensorhub_ring_handler() va…
CVE-2026-81002Critical· 9.8⚖ disputedxdp: fix zero-copy frame layout
In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size. It allows the copi…
CVE-2026-80992High· 7.8⚖ disputednet: ravb: avoid dereferencing an invalid PTP clock
In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registrat…
CVE-2026-80987High· 7.5⚖ disputedNTB: ntb_transport: Reject oversized TX buffers
In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_transport: Reject oversized TX buffers ntb_process_tx() handles an oversized buffer by calling tx_handler() with a NULL data pointer and returning success. nt…
CVE-2026-89482High· 8.8⚖ disputedkernel: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (CVE-2026-89482)
A flaw was found in the nvme-tcp module of the Linux kernel. This vulnerability arises from improper handling of C2HData for REQ_OP_WRITE_ZEROES commands, where the system fails to adequately validate the data length. A remote attacker cou…
CVE-2026-89479High· 7.0⚖ disputedkernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted series of SCTP packets, leading to a use-after-free vulnerability. This occurs when the ker…
CVE-2026-89478Critical· 9.8⚖ disputedsctp: drop a chunk if its transport was removed
In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp_rcv() resolves the transport once per packet and leaves it in chunk->transport. The lookup reference, or the one s…
CVE-2026-89471High· 8.4⚖ disputedpower: supply: cros_usbpd-charger: bound the EC-reported port count
In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd-charger: bound the EC-reported port count cros_usbpd_charger_probe() reads two port counts from the EC and uses one of them, num_charger_port…
CVE-2026-89470High· 8.4⚖ disputedpower: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS Currently the cros_usbpd-charger driver probe iterates based on raw charger port count returned by …
CVE-2026-89469High· 8.4⚖ disputedpower: supply: lp8727: fix use-after-free in lp8727_release_irq()
In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727_release_irq() lp8727_isr_func(), the threaded IRQ handler, is the only caller that arms pchg->work via schedule_del…