Filtered by vendor Linux
Subscribe
Total
19806 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-64313 | 1 Linux | 1 Linux Kernel | 2026-10-24 | N/A | 8.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails when r01.m_high is saturated (0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows. The condition (r01.m_high < product.m_high) doesn't handle the case where r01.m_high == product.m_high and an additional carry exists from lower-bit overflow. When commit 3c4b23901a0c ("crypto: ecdh - Add ECDH software support") introduced crypto/ecc.c, it split the muladd() function in the micro-ecc library into separate mul_64_64() and add_128_128() helpers. It seems the check got lost in translation. Add proper handling for this boundary by accounting for the carry from the lower addition. | |||||
| CVE-2026-64439 | 1 Linux | 1 Linux Kernel | 2026-10-24 | N/A | 9.8 CRITICAL |
| In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL completion callback and treat any negative return from crypto_aead_{encrypt,decrypt}() as terminal, falling through to kfree_sensitive(buffer). When the encrypt_name resolves to an async AEAD instance the request returns -EINPROGRESS, the buffer is freed while the backend's worker still holds a pointer, and the worker dereferences the freed slab on completion. KASAN report under UML+SLUB with a synthetic async aead backend bound to krb5->encrypt_name: BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7 The helpers were written synchronously, so filter the async instances out at allocation time instead of plumbing crypto_wait_req() through every call site. Reachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and net/ceph/crypto.c on systems with an async AEAD provider bound to the krb5 enctype name. | |||||
| CVE-2026-49743 | 3 Google, Imaginationtech, Linux | 3 Android, Ddk, Linux Kernel | 2026-10-24 | N/A | 7.8 HIGH |
| Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition. | |||||
| CVE-2026-16280 | 3 Google, Imaginationtech, Linux | 3 Android, Ddk, Linux Kernel | 2026-10-24 | N/A | 9.8 CRITICAL |
| An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in memory corruption or information disclosure. | |||||
| CVE-2026-64304 | 1 Linux | 1 Linux Kernel | 2026-10-24 | N/A | 7.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size DMA buffers (key_sz / 2) and right-aligns each component with: memcpy(dst + half_key_sz - len, src, len) When a CRT component is larger than half_key_sz the subtraction underflows and memcpy writes past the DMA buffer, causing memory corruption. Add a len > half_key_sz check next to the existing !len check for each of the five CRT components so the driver falls back to the non-CRT path instead of writing out of bounds. | |||||
| CVE-2026-17744 | 2 Google, Linux | 2 Chrome, Linux Kernel | 2026-10-24 | N/A | 7.1 HIGH |
| Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-64438 | 1 Linux | 1 Linux Kernel | 2026-10-24 | N/A | 8.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info). Currently, adf_disable_sriov() destroys per-VF mutexes and frees vf_info without stopping new VF2PF work or waiting for in-flight workers to complete. A concurrently scheduled or already queued worker can then dereference freed memory. This manifests as a use-after-free when KASAN is enabled: BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0 Write of size 8 at addr 0000000000000260 by task kworker/24:2/... Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat] Call Trace: kasan_report+0x119/0x140 mutex_lock+0x76/0xe0 adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat] adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat] adf_iov_send_resp+0x8c/0xe0 [intel_qat] process_one_work+0x6ac/0xfd0 worker_thread+0x4dd/0xd30 kthread+0x326/0x410 ret_from_fork+0x33b/0x670 Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker processing, and interrupt re-enabling during teardown. Set this flag atomically with the hardware interrupt mask inside adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE cluster MSI-X interrupt and flush the PF response workqueue before tearing down per-VF locks and state so all in-flight work completes before vf_info is destroyed. Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and unmask all VF2PF interrupts under the same lock when SR-IOV is re-enabled. This ensures the software flag and hardware state transition atomically on both the enable and disable paths. | |||||
| CVE-2026-17877 | 2 Google, Linux | 2 Chrome, Linux Kernel | 2026-10-23 | N/A | 8.4 HIGH |
| Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium) | |||||
| CVE-2026-14973 | 4 Apple, Ibm, Linux and 1 more | 4 Macos, Aspera, Linux Kernel and 1 more | 2026-10-23 | N/A | 9.3 CRITICAL |
| IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination. | |||||
| CVE-2026-14959 | 2 Ibm, Linux | 2 Aspera Faspex, Linux Kernel | 2026-10-23 | N/A | 9.1 CRITICAL |
| IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection. | |||||
| CVE-2026-48333 | 3 Adobe, Linux, Microsoft | 3 Campaign, Linux Kernel, Windows | 2026-10-23 | N/A | 9.8 CRITICAL |
| Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated privileges. Exploitation of this issue does not require user interaction. | |||||
| CVE-2026-14996 | 2 Ibm, Linux | 2 Aspera Faspex, Linux Kernel | 2026-10-23 | N/A | 8.2 HIGH |
| IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management. | |||||
| CVE-2026-14958 | 2 Ibm, Linux | 2 Aspera Faspex, Linux Kernel | 2026-10-23 | N/A | 9.1 CRITICAL |
| IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation. | |||||
| CVE-2026-48399 | 3 Adobe, Linux, Microsoft | 3 Campaign, Linux Kernel, Windows | 2026-10-23 | N/A | 7.5 HIGH |
| Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. | |||||
| CVE-2026-11707 | 3 Ibm, Linux, Microsoft | 7 Aix, I, Tivoli System Automation Application Manager and 4 more | 2026-10-23 | N/A | 9.3 CRITICAL |
| IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page. | |||||
| CVE-2026-11383 | 3 Ibm, Linux, Microsoft | 7 Aix, I, Tivoli System Automation Application Manager and 4 more | 2026-10-23 | N/A | 5.4 MEDIUM |
| IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console. | |||||
| CVE-2026-11980 | 4 Apple, Ibm, Linux and 1 more | 4 Macos, Aspera, Linux Kernel and 1 more | 2026-10-23 | N/A | 7.3 HIGH |
| IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up. | |||||
| CVE-2026-17894 | 2 Google, Linux | 2 Chrome, Linux Kernel | 2026-10-23 | N/A | 8.8 HIGH |
| Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-48448 | 3 Adobe, Linux, Microsoft | 3 Campaign, Linux Kernel, Windows | 2026-10-23 | N/A | 8.6 HIGH |
| Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to gain file system read access. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-48449 | 3 Adobe, Linux, Microsoft | 3 Campaign, Linux Kernel, Windows | 2026-10-23 | N/A | 10.0 CRITICAL |
| Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed. | |||||