Tagged “vex”
CVEs tagged vex, newest first.
7401 CVEsRSS
CVE-2026-98764Medium· 4.4usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC When user space sets up FunctionFS with only full-speed descriptors (e.g., flags = FUNCTION…
CVE-2026-98770Medium· 4.4kernel: usb: gadget: midi2: Fix the jack descriptor array sizes (CVE-2026-98770)
A flaw was found in the Linux kernel's USB gadget MIDI 2.0 driver. Under-sized descriptor arrays allow a local user to trigger an out-of-bounds memory access when setting up a large number of MIDI jacks through the configuration filesystem…
CVE-2026-98769High· 8.4usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd generic_set_cmd() and generic_get_cmd() use the low nibble of ctrl->bRequest as an index i…
CVE-2026-98774Low· 3.3kernel: rust_binder: cancel deferred work items in thread exit (CVE-2026-98774)
A flaw was found in the Linux kernel's Rust Binder driver. When a thread terminates while handling an active outgoing transaction, deferred work items on the thread's task list are not properly cleaned up during thread release. A local att…
CVE-2026-98772Medium· 4.7USB: serial: fix port tear down use-after-free
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down use-after-free Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach()…
CVE-2026-98771Low· 3.3usb: storage: sierra_ms: reject short SWoC info transfers
In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierra_ms: reject short SWoC info transfers sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes from the device via usb_control_msg(), bu…
CVE-2026-98776Medium· 4.7kernel: kernel: Privilege escalation via binderfs use-after-free (CVE-2026-98776)
A flaw was found in the Linux kernel's Android Binder filesystem (binderfs). A local user can exploit a race condition during concurrent device creation and deletion to trigger a use-after-free (UAF) condition, which occurs when freed memo…
CVE-2026-98775Medium· 5.5nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
In the Linux kernel, the following vulnerability has been resolved: nitro_enclaves: fix use-after-free on SLOT_ALLOC failure When ne_create_vm_ioctl() fails the SLOT_ALLOC request after anon_inode_getfile() has succeeded, the error pat…
CVE-2026-98773Medium· 4.7USB: cdc-acm: skip URB restart in port_shutdown if disconnected
In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in port_shutdown if disconnected acm_port_shutdown() is called from the tty-port machinery whenever the last user closes the port. acm_…
CVE-2026-98779Low· 1.9drm/amdgpu: fix ACP MFD device leak on init failure
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acp_hw_init() registers ACP child devices with mfd_add_devices() before attaching them to the ACP power domain and …
CVE-2026-98778Medium· 5.5binder: fix is_failure flag for superseded transaction cleanup
In the Linux kernel, the following vulnerability has been resolved: binder: fix is_failure flag for superseded transaction cleanup When a TF_UPDATE_TXN transaction supersedes a pending async transaction, binder_release_entire_buffer() …
CVE-2026-98777Low· 3.3binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TF_UPDATE_TXN supersede When a TF_UPDATE_TXN transaction supersedes a pending async transaction in a frozen process, the outdated trans…
CVE-2026-98782Low· 2.3kernel: drm/mediatek: Fix ovl adaptor platform device leak (CVE-2026-98782)
A flaw was found in the Linux kernel's MediaTek DRM (Direct Rendering Manager) driver. When device initialization fails or during driver removal, the driver fails to unregister an allocated overlay adaptor platform device. A local user cou…
CVE-2026-98781Low· 2.3kernel: drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (CVE-2026-98781)
A flaw was found in the Linux kernel's MediaTek DRM (Direct Rendering Manager) driver. When binding non-master display devices, the driver fails to release a device reference acquired during initialization. A local user could exploit this …
CVE-2026-98780Low· 1.9drm/amdgpu: fix IP instance memory leak on kobject add failure
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpu_discovery_sysfs_ips() allocates ip_hw_instance with kzalloc_flex() and initializes its embedded k…
CVE-2026-98785Medium· 4.7drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend dc_state_create_copy() can return NULL on allocation failure. dm_suspend() only conditionally skip…
CVE-2026-98784Low· 2.3drm/amdgpu/gfx6: fix firmware leak on teardown
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfx_v6_0_init_microcode() is not released when the GFX block is torn down, leaking the firmwar…
CVE-2026-98783Medium· 4.1kernel: drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (CVE-2026-98783)
A flaw was found in the Linux kernel's MediaTek DRM (Direct Rendering Manager) driver. The driver fails to verify whether the display overlay adaptor platform device is successfully registered during initialization. If the registration fai…
CVE-2026-98789Medium· 4.4kernel: bpf: Fix objects stuck in free_by_rcu_ttrace (CVE-2026-98789)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) memory allocator. When releasing memory, objects queued while a delayed cleanup cycle is already in progress can fail to be reclaimed. A local user can exploit this vulner…
CVE-2026-98786Medium· 4.7kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation (CVE-2026-98786)
A flaw was found in the Linux kernel's AMD GPU display driver. During DisplayPort Multi-Stream Transport (MST) display disconnection, a race condition can cause the driver to access display data structures without verifying that they remai…
CVE-2026-98790Medium· 4.7perf: Fix race between perf_event_exit_task() and perf_pending_task()
In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perf_event_exit_task() and perf_pending_task() A race condition exists between perf_event_exit_task() and perf_pending_task() during begin_new_e…
CVE-2026-98787Medium· 4.1kernel: bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch() (CVE-2026-98787)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. Missing CPU migration protection during batch lookup and delete operations on hash tables allows a task to migrate between processors while freeing memory. A lo…
CVE-2026-98794Medium· 6.5ipvs: filter some flags received in the backup server
In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that ca…
CVE-2026-98792Medium· 5.9kernel: netfilter: flowtable: generalize pending status bit (CVE-2026-98792)
A flaw was found in the Linux kernel's netfilter flowtable component. This flaw allows an attacker to cause a denial of service (DoS) by crashing the operating system. A race condition exists between the connection cleanup worker and hardw…
CVE-2026-98791Medium· 4.4kernel: net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference (CVE-2026-98791)
A flaw was found in the Linux kernel's Mellanox network driver (mlx5e). A local user can exploit this vulnerability to cause a denial of service (DoS) through a system crash. During the teardown of an AF_XDP (eXpress Data Path) transmit qu…
CVE-2026-98796Medium· 4.1kernel: net: ethernet: mtk_eth_soc: allocate dummy netdev sooner (CVE-2026-98796)
A flaw was found in the Linux kernel's MediaTek Ethernet driver. This vulnerability allows a local user with network administration privileges to cause a Denial of Service (DoS) through a kernel crash. Due to an ordering issue during devic…
CVE-2026-98795Medium· 4.4kernel: net: sparx5: skip ptp deinit if init was skipped (CVE-2026-98795)
A flaw was found in the Linux kernel's Microchip Sparx5 network driver. When operating on devices where Precision Time Protocol (PTP) initialization is skipped, the driver does not check if PTP was initialized before executing its deinitia…
CVE-2026-98793Medium· 4.4netfilter: bpf: reject invalid NAT manipulation types
In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpf_ct_set_nat_info() is not validating the NAT manipulation type a wrong value can be passed directly to nf_n…
CVE-2026-98799Medium· 4.4kernel: bpf: Skip detached progs in trampoline images that are still in use (CVE-2026-98799)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When a BPF program attached to a trampoline is detached while another task is paused in an active routine, the kernel can prematurely release the detached progr…
CVE-2026-98798Medium· 4.4net: bcmgenet: fix NULL dereference in set_coalesce before first open
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in set_coalesce before first open The Rx ring priv and index are only set in bcmgenet_init_rx_ring(), which runs at open. Setting t…