← All tracked CVEs
Updated 15:01
972 in progress
| CVE | Status | Severity | Summary | Distribution |
|---|---|---|---|---|
| In progress | High | mlxsw spectrum_ptp GC workqueue calls napi_gro_receive outside NAPI, corrupting GRO list, causing kernel panic | secure-packages-25.11 | |
| In progress | Medium | bcmasp tx_spb_ring_full() reinitializes index, checks same slot repeatedly, failing consecutive slots check | secure-packages-26.05 | |
| In progress | Medium | Linux bcmasp tx_spb_ring_full() reinitializes next_index, checks same descriptor slot repeatedly | secure-packages-25.11 | |
| In progress | High | bcmasp: Stale txcb->last flag leads to premature SKB free on descriptor reuse | secure-packages-26.05 | |
| In progress | High | Linux kernel bcmasp driver reuses descriptors with stale last flag, freeing SKB mid-transmit | secure-packages-25.11 | |
| In progress | Medium | ASoC Intel AVS out-of-bounds access from config_ids indexing init_configs array | secure-packages-26.05 | |
| In progress | Medium | Out-of-bounds access in ASoC Intel avs init_configs due to mismatched config_ids indexing | secure-packages-25.11 | |
| In progress | Medium | Linux kernel Intel ASoC avs module refcount leak when strace_open fails after try_module_get | secure-packages-26.05 | |
| In progress | Medium | Unbalanced module refcount on strace_open() failure in ASoC Intel AVS driver | secure-packages-25.11 | |
| In progress | Medium | BPF tp_btf trusts siginfo pointer in signal tracepoints; 0/1 cause kernel panic | secure-packages-25.11 | |
| In progress | Medium | Linux BPF tp_btf signal tracepoints allow dereferencing 0/1 siginfo values, causing kernel panic | secure-packages-26.05 | |
| In progress | Medium | Linux IPVS sync reverses hton_seq args, leaving unwritten bytes, leaking heap, corrupting sequence | secure-packages-26.05 | |
| In progress | Medium | ipvs: reversed hton_seq parameters leak stale heap data, corrupt connection sequence state | secure-packages-25.11 | |
| In progress | Medium | Btrfs qgroup snapshot accounting triggers relocation backref corruption, kernel warning, read-only remount | secure-packages-26.05 | |
| In progress | Medium | Btrfs qgroup_account_snapshot forces reloc root, causing metadata extent backref corruption and RO filesystem | secure-packages-25.11 | |
| In progress | Medium | Btrfs bioc_list memory leak on error/IOERR in ordered extents | secure-packages-26.05 | |
| In progress | Medium | btrfs bioc_list memory leak when btrfs_insert_raid_extent errors or ordered extent IOERR | secure-packages-25.11 | |
| In progress | High | btrfs: premature transaction end causes use-after-free after RAID stripe extent allocation failure | secure-packages-26.05 | |
| In progress | High | btrfs_insert_one_raid_extent() prematurely ends transaction, causing use-after-free on error | secure-packages-25.11 | |
| In progress | Medium | Bluetooth hci_core race: power_on runs before MSFT init, locking uninitialized mutex during device registration | secure-packages-25.11 | |
| In progress | Medium | Bluetooth hci_core race: power_on runs before MSFT init, locking uninitialized mutex | secure-packages-26.05 | |
| In progress | High | ksmbd multichannel logoff race: session freed before channels drain; locks and cancels mishandled | secure-packages-25.11 | |
| In progress | High | ksmbd logoff teardown race across SMB3 multichannel; pending operations and locks not properly cancelled | secure-packages-26.05 | |
| In progress | High | ksmbd teardown races: undrained multichannel sessions, stuck byte-range locks, and duplicate cancellations | secure-packages-rolling | |
| In progress | Medium | stmmac TSO transmit path leaks DMA mappings on skb fragment mapping failure | secure-packages-rolling | |
| In progress | Medium | stmmac_tso_xmit fails to unmap previous DMA mappings on fragment map failure | secure-packages-26.05 | |
| In progress | Medium | stmmac TSO transmit path leaks DMA mappings when skb fragment DMA mapping fails | secure-packages-25.11 | |
| In progress | Medium | BPF verifier downgrades half-dead scalar zero spills to STACK_ZERO, breaking precision propagation | secure-packages-26.05 | |
| In progress | Medium | eBPF verifier downgrades partial zero spill to STACK_ZERO, breaking precision propagation | secure-packages-25.11 | |
| In progress | Medium | ntfs_set_ea error path clears HasEA, hiding existing EAs until inode eviction | secure-packages-26.05 | |
| In progress | Medium | Linux NTFS setxattr failure clears HasEA, hiding on-disk EAs until inode eviction | secure-packages-25.11 | |
| In progress | Medium | BPF verifier misinfers non-null pointers in comparisons, leading null dereference vulnerability | secure-packages-rolling | |
| In progress | Medium | Linux BPF verifier misinfers non-null in pointer comparisons, allowing null dereference | secure-packages-26.05 | |
| In progress | Medium | BPF verifier misinterprets PTR_MAYBE_NULL, causing null pointer dereference after pointer comparison | secure-packages-25.11 | |
| In progress | Medium | NTFS accepts non-power-of-two sectors_per_cluster, leading to undefined shift (UBSAN) | secure-packages-26.05 | |
| In progress | Medium | NTFS boot sector validation allows zero/non-power-of-two sectors_per_cluster, causing undefined shift | secure-packages-25.11 | |
| In progress | High | NTFS $AttrDef table walk reads out-of-bounds due to improper entry size bounds | secure-packages-26.05 | |
| In progress | High | NTFS $AttrDef table walk causes out-of-bounds read when table smaller than entry | secure-packages-25.11 | |
| In progress | Medium | Linux kernel NTFS fallocate ignored zeroout failures, exposing stale data | secure-packages-26.05 | |
| In progress | Medium | Linux NTFS: nonzero dio zero-range return ignored, fallocate may expose stale on-disk data | secure-packages-25.11 | |
| In progress | Medium | NTFS sync_fs clears dirty bit despite errors, marking volumes clean and bypassing recovery | secure-packages-26.05 | |
| In progress | Medium | Linux NTFS sync_fs clears dirty bit despite errors, marking volumes clean and skipping recovery | secure-packages-25.11 | |
| In progress | Medium | NTFS overcounts freed clusters after bitmap clear failures, corrupting statfs and allocator free-space gate | secure-packages-26.05 | |
| In progress | Medium | NTFS: Counting failed bitmap clears inflates free_clusters, corrupting statfs and allocation gating | secure-packages-25.11 | |
| In progress | Medium | nvmet-rdma leaks queue and IB resources when connection backlog limit is exceeded | secure-packages-25.11 | |
| In progress | Medium | nvmet-rdma leaks queue and IB resources when connect backlog is exceeded | secure-packages-26.05 | |
| In progress | Medium | rtl8723bs: HalData vzalloc buffer freed with kfree in rtw_sdio_if1_init error path causing memory corruption risk | secure-packages-25.11 | |
| In progress | Medium | Linux rtl8723bs: HalData vzalloc buffer freed with kfree in rtw_sdio_if1_init error path risking memory corruption | secure-packages-26.05 | |
| In progress | Medium | nvdimm pmem: data writes proceed after failed REQ_PREFLUSH; error overwritten by REQ_FUA | secure-packages-25.11 | |
| In progress | Medium | pmem_submit_bio allows writes after failed REQ_PREFLUSH, error masked by later REQ_FUA | secure-packages-26.05 |