Tagged “score-dispute”
CVEs tagged score-dispute, newest first.
589 CVEsRSS
CVE-2026-89674Medium· 5.5⚖ disputedkernel: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (CVE-2026-89674)
A flaw was found in the `nfsd` component of the Linux kernel. Incorrect calculations in the XDR (External Data Representation) buffer size within the `nfsd4_ff_encode_layoutget()` function can lead to two critical issues. An attacker could…
CVE-2026-89672High· 7.0⚖ disputedkernel: nfsd: gate nfs2 setacl by argp->mask (CVE-2026-89672)
A flaw was found in the Linux kernel's Network File System (NFS) server daemon (`nfsd`). When processing NFSACL version 2 SETACL requests, the system could unintentionally remove a directory's default Access Control List (ACL) or both acce…
CVE-2026-89671High· 7.0⚖ disputedkernel: nfsd: gate nfs3 setacl by argp->mask (CVE-2026-89671)
A flaw was found in the Linux kernel's Network File System version 3 (NFSv3) server daemon (`nfsd`). The `nfsd3_proc_setacl()` function unconditionally processes Access Control List (ACL) update requests, even when the client's request doe…
CVE-2026-89669High· 7.0⚖ disputedkernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669)
A flaw was found in the `nfsd` component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafte…
CVE-2026-89662High· 7.0⚖ disputedkernel: NFSD: Prevent lock owner use-after-free during client teardown (CVE-2026-89662)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). During client teardown, a race condition can occur where a lock owner is freed while still being referenced, leading to a use-after-free vulnerability. This can resu…
CVE-2026-89656High· 7.0⚖ disputedkernel: libceph: reject buckets with mismatched CRUSH ids (CVE-2026-89656)
A flaw was found in libceph within the Linux kernel. This vulnerability allows a local attacker to craft a malformed CRUSH map, which is used for data placement. By doing so, one data bucket can be made to reuse another bucket's memory wor…
CVE-2026-89655High· 7.0⚖ disputedkernel: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (CVE-2026-89655)
A flaw was found in the Linux kernel's Ceph file system component. A race condition exists in the `__kick_flushing_caps()` function during the handling of capability messages. This allows a separate process to free a data structure (`cf en…
CVE-2026-89653High· 8.1⚖ disputedkernel: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode (CVE-2026-89653)
A flaw was found in the Linux kernel's Ceph filesystem. This vulnerability occurs when a malicious or malformed MDSMap export_targets entry, controlled by a monitor, contains a rank value that exceeds the maximum allowed (CEPH_MAX_MDS) dur…
CVE-2026-89652High· 7.0⚖ disputedkernel: ceph: bound copied dentry name length in NFS export get_name (CVE-2026-89652)
A flaw was found in the Linux kernel's Ceph file system. A malicious or compromised Ceph Metadata Server (MDS) can send a specially crafted `LOOKUPNAME` reply that causes a buffer overflow when copying dentry names during an NFS export ope…
CVE-2026-89650High· 7.0⚖ disputedkernel: ceph: bound num_export_targets array for mds info v2/v3 (CVE-2026-89650)
A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph monitor, or an on-path attacker, can send a specially crafted Metadata Server (MDS) map. This map, with an oversized num_export_targets field and a per-MDS…
CVE-2026-89649High· 7.0⚖ disputedkernel: ceph: bound xattr value length in __build_xattrs() (CVE-2026-89649)
A flaw was found in the Linux kernel's Ceph file system (CephFS) component. A malicious or compromised metadata server can manipulate the length of an extended attribute (xattr) value, causing the system to read beyond the intended memory …
CVE-2026-89636High· 7.0⚖ disputedkernel: smb: client: clear ce->tgthint in free_tgts() (CVE-2026-89636)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. When the `free_tgts()` function frees data structures, a pointer (`ce->tgthint`) is not properly reset, leaving it pointing to a memory location that has already bee…
CVE-2026-89634High· 7.0⚖ disputedkernel: smb: client: fix ALIGN() overflow in symlink_data() error context loop (CVE-2026-89634)
A flaw was found in the Server Message Block (SMB) client within the Linux kernel. An integer overflow in the ALIGN() function, specifically within the symlink_data() error context loop, can lead to an out-of-bounds read. This issue allows…
CVE-2026-89617Medium· 5.5⚖ disputedkernel: fs/ntfs3: validate dirty page table on log replay (CVE-2026-89617)
A flaw was found in the Linux kernel's NTFS3 filesystem driver. An attacker with local access could craft a malicious NTFS log file. During log replay, insufficient validation of the `lcns_follow` field in a `DIR_PAGE_ENTRY` could lead to …
CVE-2026-89616Medium· 5.5⚖ disputedkernel: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() (CVE-2026-89616)
A flaw was found in the Linux kernel's NTFS3 filesystem driver. When decompressing LZNT data, the `ni_read_frame()` function may not fully zero out memory after a partial decompression. This can lead to the disclosure of previously used ke…
CVE-2026-89615Medium· 5.5⚖ disputedkernel: fs/ntfs3: bound page_lcns[] index by the log record (CVE-2026-89615)
A flaw was found in the Linux kernel's NTFS3 file system driver. A local attacker could exploit this by providing a specially crafted log record. This crafted record causes a buffer overflow in the page_lcns[] array, leading to memory corr…
CVE-2026-89744Medium· 5.5⚖ disputedkernel: device property: fix infinite loop in fwnode_for_each_child_node() (CVE-2026-89744)
A flaw was found in the Linux kernel's device property handling. When the kernel iterates over child nodes of a firmware node (fwnode) that also has a secondary fwnode, the `fwnode_get_next_child_node()` function can enter an endless loop.…
CVE-2026-89742Medium· 5.5⚖ disputedkernel: rapidio: mport_cdev: fix use-after-free in dma_req_free() (CVE-2026-89742)
A flaw was found in the Linux kernel. A local user could exploit a use-after-free vulnerability in the `dma_req_free()` function within the RapidIO mport character device interface. This flaw occurs when the `dma_req_free()` function attem…
CVE-2026-89736Medium· 5.5⚖ disputedkernel: usb: gadget: u_audio: Fix use-after-free on sound card disconnect (CVE-2026-89736)
A flaw was found in the Linux kernel's USB audio gadget driver (u_audio). This vulnerability occurs during sound card disconnection when Asynchronous Linux Sound Architecture (ALSA) control elements (kctls) remain open in userspace. A loca…
CVE-2026-89733Medium· 5.5⚖ disputedkernel: usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (CVE-2026-89733)
A flaw was found in the Linux kernel's USB Video Class (UVC) gadget driver. This vulnerability occurs in the `uvc_function_bind()` and `uvc_function_unbind()` functions, where pointers to freed memory are not properly cleared. This can lea…
CVE-2026-89725Medium· 5.5⚖ disputedkernel: media: cec: stm32: prevent out-of-bounds write on RX overflow (CVE-2026-89725)
A flaw was found in the Linux kernel's `media: cec: stm32` driver. A remote attacker can exploit an out-of-bounds write vulnerability by sending an overlong Consumer Electronics Control (CEC) message without an end-of-message signal. This …
CVE-2026-89724Medium· 5.5⚖ disputedkernel: media: vicodec: fix out-of-bounds write in FWHT encoder (CVE-2026-89724)
A flaw was found in the Linux kernel's `media: vicodec` component. An out-of-bounds write vulnerability exists in the FWHT encoder due to incorrect buffer sizing during video output format handling. This issue allows an attacker to cause c…
CVE-2026-89723Medium· 5.5⚖ disputedkernel: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation (CVE-2026-89723)
A flaw was found in the nilfs2 file system component of the Linux kernel. When a file is truncated, an intermediate node block is not properly deleted and remains in the B-tree node cache. This can lead to the log writer incorrectly proces…
CVE-2026-89720Medium· 5.5⚖ disputedkernel: ubifs: fix out-of-bounds read in signature length check (CVE-2026-89720)
A flaw was found in the Linux kernel's Unsorted Block Image File System (UBIFS). An incorrect bounds check in the ubifs_sb_verify_signature() function allows a crafted signed UBIFS image to declare a signature length larger than its actual…
CVE-2026-89712High· 7.0⚖ disputedkernel: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (CVE-2026-89712)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD) component. A race condition exists where, during the processing of unmounted source-server mounts, a thread may temporarily release a lock. During this window, anothe…
CVE-2026-89699Medium· 5.5⚖ disputedkernel: nfsd: validate symlink target length in NFSv4 CREATE (CVE-2026-89699)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd) when handling NFSv4 CREATE operations. A remote attacker can exploit this by sending a crafted request with an oversized symbolic link (symlink) target length. This u…
CVE-2026-89697High· 7.0⚖ disputedkernel: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (CVE-2026-89697)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When setting file attributes using `nfsd_proc_setattr()`, a specific code path (`BOTH_TIME_SET` branch) prematurely verifies file handles. This bypasses a critical w…
CVE-2026-89696Medium· 5.5⚖ disputedkernel: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (CVE-2026-89696)
A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd). A remote client can exploit this by sending a specially crafted NFS COMPOUND request. This request, when processed, can lead to a NULL pointer dereference in t…
CVE-2026-89750Medium· 5.5⚖ disputedkernel: tracing/user_events: Clear copied tracing state before fork duplication (CVE-2026-89750)
A flaw was found in the Linux kernel's tracing/user_events component. This vulnerability arises when a child process, created via `fork`, exits and frees memory that the parent process still references. This creates a Use-After-Free (UAF) …
CVE-2026-81010High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: honor task_work cancellation io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originati…
In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: honor task_work cancellation io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originati…