Tagged “score-dispute”
CVEs tagged score-dispute, newest first.
1507 CVEsRSS
CVE-2026-89466High· 7.7⚖ disputedpower: supply: qcom_battmgr: terminate the strings from firmware
In the Linux kernel, the following vulnerability has been resolved: power: supply: qcom_battmgr: terminate the strings from firmware The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise …
CVE-2026-89465High· 8.4⚖ disputedpower: supply: rt9455: quiesce delayed work before teardown
In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwr_rdy_work, max_charging_time_work and batt_presence_work. pwr_rdy_wo…
CVE-2026-89448Critical· 9.3⚖ disputediommu/vt-d: Force requesting ACS when tboot is enabled
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detect_intel_iommu() don't include tboot, leading to a possible mi…
CVE-2026-89442High· 7.8⚖ disputedplatform/x86: ISST: Validate socket ID in clos_assoc ioctl
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in clos_assoc ioctl isst_if_clos_assoc() validates the user-supplied socket_id with 'socket_id > topology_max_packages()', but i…
CVE-2026-81012High· 8.4⚖ disputedplatform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() hp_get_string_from_buffer() clamps the converted string length against the destination bu…
CVE-2026-89551Critical· 9.8⚖ disputedSUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by walking the tail, pages, and head iovecs. Each…
CVE-2026-89541Medium· 6.5⚖ disputedkernel: SUNRPC: harden gss_unwrap_resp_priv length checks (CVE-2026-89541)
A flaw was found in the Linux kernel. Specifically, an integer overflow vulnerability exists in the `gss_unwrap_resp_priv()` function within the SUNRPC component. This flaw occurs when validating the length of RPCSEC_GSS opaque data. A mal…
CVE-2026-89538Critical· 9.8⚖ disputedSUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gss_krb5_unwrap_v2() sets buf->len to a logical length, which can be much smaller than head[0].iov_len (the …
CVE-2026-89533Critical· 9.8⚖ disputedsvcrdma: Fix offset arithmetic in read_chunk_range
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix offset arithmetic in read_chunk_range svc_rdma_read_chunk_range() walks a Read chunk's segment list to build a sub-range starting at byte offset and spann…
CVE-2026-89532Critical· 9.1⚖ disputedsvcrdma: Fix pcl_for_each_segment for empty chunks
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pcl_for_each_segment for empty chunks When a parsed chunk list contains a chunk whose ch_segcount is zero, pcl_for_each_segment computes its inclusive upp…
CVE-2026-89524High· 8.1⚖ disputedwifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6kl_cfg80211_connect_event() subtracts fixed IE offsets from assoc_req_len (-= 4) a…
CVE-2026-89511High· 7.5⚖ disputedqede: Fix NULL pointer dereference in TPA fragment processing
In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuat…
CVE-2026-89508High· 7.8⚖ disputedRDMA/ucma: Lock the handler in ucma_set_ib_path()
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucma_set_ib_path() ucma_set_ib_path() calls ucma_event_handler() straight from the write() path, without the handler lock that keeps ctx…
CVE-2026-89504High· 8.4⚖ disputedregulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
In the Linux kernel, the following vulnerability has been resolved: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer In as3722_get_regulator_dt_data(), of_get_child_by_name() acquires …
CVE-2026-89495Critical· 9.8⚖ disputedocfs2: bound namelen in dlm_migrate_request_handler
In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm_migrate_request_handler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length a…
CVE-2026-89494Critical· 9.8⚖ disputedocfs2: validate lengths in dlm_mig_lockres_handler
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm_mig_lockres_handler A node receiving a DLM_MIG_LOCKRES message trusts several fields of the peer-supplied dlm_migratable_lockres without…
CVE-2026-89493High· 8.8⚖ disputedocfs2: validate rl_used against rl_count in refcount block validator
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rl_used against rl_count in refcount block validator ocfs2_find_refcount_rec_in_rl() walks the on-disk refcount record array with: for (; i < le16_to…
CVE-2026-89489High· 7.8⚖ disputedopenrisc: fix arbitrary kernel memory access via or1k_atomic syscall
In the Linux kernel, the following vulnerability has been resolved: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user pointers, v1 and v2, and swaps th…
CVE-2026-89485Critical· 9.8⚖ disputedlockd: pin next file across nlm_inspect_file lock-drop
In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but noth…
CVE-2026-89483High· 7.5⚖ disputednvme: zero the discard fallback page
In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvme_setup_discard() always maps sizeof(struct nvme_dsm_range) * NVME_DSM_MAX_RANGES = 4096 bytes as the DSM payload however many …
CVE-2026-89605High· 7.8⚖ disputedecryptfs: release message context on send failure
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: release message context on send failure ecryptfs_send_message_locked() moves a message context from the free list to the allocated list before sending the re…
CVE-2026-89599High· 8.4⚖ disputedfbdev: omapfb: panel-dsi-cm: initialize lock before registering display
In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicm_probe() registers the display before initializing ddata->lock. Once omapdss_register_disp…
CVE-2026-89597High· 7.8⚖ disputedfbdev: uvesafb: unregister connector callback on init failure
In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: unregister connector callback on init failure uvesafb_init() registers the v86d connector callback before registering the platform driver. If platform_…
CVE-2026-89594High· 7.8⚖ disputedhsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
In the Linux kernel, the following vulnerability has been resolved: hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device The OMAP SSI driver uses a synthetic HSI controller device allocated via hsi_alloc_controller(…
CVE-2026-89586High· 8.2⚖ disputedata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the UNMAP bit set into an A…
CVE-2026-89585High· 7.8⚖ disputedauxdisplay: charlcd: cancel backlight work on registration failure
In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before charlcd_register() calls misc_…
CVE-2026-89573High· 7.8⚖ disputeddm array: reject an array block whose value size is not the caller's
In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and m…
CVE-2026-89554High· 8.2⚖ disputedmptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce, backup, join_id, token a…
CVE-2026-89553High· 7.8⚖ disputednouveau/gem: reserve the bo in the info ioctl around the vma lookup
In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem cl…
CVE-2026-89674Critical· 9.8⚖ disputednfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has multiple errors that can result in eit…