Tagged “score-dispute”
CVEs tagged score-dispute, newest first.
589 CVEsRSS
CVE-2026-89522Medium· 5.5⚖ disputedkernel: media: staging/ipu7: fix async notifier UAF on probe error path (CVE-2026-89522)
A flaw was found in the Linux kernel's media subsystem, specifically within the ipu7 driver. When an error occurs during the device's initial setup (probe error path), a V4L2 asynchronous notifier is not correctly removed from a global lis…
CVE-2026-89520Medium· 5.5⚖ disputedkernel: sched/core: Make core-sched flips wait for in-flight selections (CVE-2026-89520)
A flaw was found in the Linux kernel's core scheduling component. A race condition can occur when core scheduling flips complete during task selection, leading to incorrect lock handling. This can result in a resource leak and system insta…
CVE-2026-89507Medium· 5.5⚖ disputedkernel: RDMA/ucma: Lock the handler in ucma_write_cm_event() (CVE-2026-89507)
A flaw was found in the Linux kernel's RDMA/ucma component. A race condition exists in the `ucma_write_cm_event()` function where it re-reads a critical file pointer multiple times without proper locking. This allows another function, `ucm…
CVE-2026-89503Medium· 5.5⚖ disputedkernel: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (CVE-2026-89503)
A flaw was found in the Linux kernel's ring-buffer component. A race condition exists in the `ring_buffer_alloc_read_page()` function when it interacts with `ring_buffer_subbuf_order_set`. This can lead to an incorrect memory allocation wh…
CVE-2026-89500High· 7.0⚖ disputedkernel: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (CVE-2026-89500)
A flaw was found in the Linux kernel's ring-buffer component. When a cached reader page is discarded after a concurrent ring buffer resize, the system may use an incorrect buffer size for memory deallocation. This mismatch can lead to a ke…
CVE-2026-89499Medium· 5.5⚖ disputedkernel: ring-buffer: Stop remote reader update when page swap fails (CVE-2026-89499)
A flaw was found in the Linux kernel's ring-buffer component. When a remote reader update fails during a page swap, the system incorrectly proceeds as if the swap succeeded. This can lead to log flooding, potentially causing a denial of se…
CVE-2026-89492Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-dire…
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-dire…
CVE-2026-89486Medium· 5.5⚖ disputedkernel: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() (CVE-2026-89486)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) subsystem. Due to incorrect synchronization during the deallocation of command receiver objects, a use-after-free vulnerability can occur. This allows …
CVE-2026-89472Medium· 5.5⚖ disputedkernel: power: supply: charger-manager: register regulators before exposing sysfs (CVE-2026-89472)
A flaw was found in the Linux kernel's power supply charger-manager component. A race condition exists where the system frees charger regulators before their corresponding sysfs entries are unregistered. A local attacker can exploit this b…
CVE-2026-89459Medium· 5.5⚖ disputedkernel: s390/percpu: Fix MVIY_PERCPU() with older binutils (CVE-2026-89459)
A flaw was found in the Linux kernel's s390/percpu component. This vulnerability arises when the kernel is compiled with older versions of GNU as (prior to binutils 2.39). A parsing error prevents a crucial instruction from being correctly…
CVE-2026-89452Medium· 5.5⚖ disputedkernel: iommu/msm: Unwind probe state on registration failure (CVE-2026-89452)
A flaw was found in the `iommu/msm` component of the Linux kernel. This vulnerability occurs when `msm_iommu_probe()` fails to properly unwind its probe state during registration, leaving a dangling list entry. A local attacker could poten…
CVE-2026-89441Medium· 5.5⚖ disputedkernel: mmc: via-sdmmc: cancel card-detect work on remove (CVE-2026-89441)
A flaw was found in the Linux kernel, specifically within the `mmc: via-sdmmc` driver responsible for managing SD and MultiMediaCard (MMC) devices. This vulnerability occurs during device removal, where a timing issue allows a process to a…
CVE-2026-89436Medium· 5.5⚖ disputedkernel: platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] (CVE-2026-89436)
A flaw was found in the Linux kernel's `panasonic-laptop` driver. This vulnerability involves an out-of-bounds write when processing ACPI SINF packages, where a small amount of data is written beyond the intended memory buffer. This can le…
CVE-2026-81016Medium· 5.5⚖ disputedkernel: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address (CVE-2026-81016)
A flaw was found in the Linux kernel. Specifically, within the AMD Platform Management Controller (PMC) component, the `amd_stb_s2d_init()` function does not properly validate memory addresses returned by System Management Unit (SMU) comma…
CVE-2026-81015High· 7.0⚖ disputedkernel: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails (CVE-2026-81015)
A flaw was found in the Linux kernel's AMD PMC (Power Management Controller) driver. When the `amd_stb_s2d_init()` function fails during the driver's initialization process, it can lead to unreleased resources, specifically the LPS0 s2idle…
CVE-2026-81006Medium· 5.5⚖ disputedkernel: ipmi: Remove all sysfs files on registration failure (CVE-2026-81006)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) component. During the registration of an IPMI system management interface, an error in the cleanup process can leave a system file (sysfs attribute) re…
CVE-2026-89635Medium· 5.5⚖ disputedkernel: ksmbd: only rebind the reopened file's own oplock on durable reconnect (CVE-2026-89635)
A flaw was found in ksmbd, a component of the Linux kernel. An authenticated attacker could exploit a use-after-free vulnerability by manipulating durable handles and oplocks during session reconnection. When two sessions hold durable hand…
CVE-2026-89633High· 7.0⚖ disputedkernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. The `coalesce_t2()` function processes server-supplied `DataOffset` fields without proper validation against buffer boundaries. A remote attacker could exploit this …
CVE-2026-89631High· 8.1⚖ disputedkernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an intege…
CVE-2026-89630High· 7.0⚖ disputedkernel: smb: client: restore the data_offset bound in is_valid_oplock_break() (CVE-2026-89630)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. An incorrect calculation of the `data_offset` bound in the `is_valid_oplock_break()` function can lead to a read overflow. This vulnerability allows a malicious SMB …
CVE-2026-89624High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universal_pidff_probe() starts the device with hid_hw_start() and then, if force-feedback initiali…
In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universal_pidff_probe() starts the device with hid_hw_start() and then, if force-feedback initiali…
CVE-2026-89622High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfe…
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in mcp->rxbuf for the duration of a transfe…
CVE-2026-89614Medium· 5.5⚖ disputedkernel: ntfs: bound the free-cluster bitmap scan to the volume (CVE-2026-89614)
A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because the free-cluster bitmap scan is not properly bounded to the volume size. A specially crafted NTFS image, where the bitmap covers more cluster…
CVE-2026-89613Medium· 5.5⚖ disputedkernel: ntfs: reject invalid empty mapping pairs (CVE-2026-89613)
A flaw was found in the Linux kernel's NTFS filesystem driver. This vulnerability occurs when the driver processes an attribute with empty mapping pairs that have inconsistent highest Virtual Cluster Number (VCN) and size. A local attacker…
CVE-2026-89612Medium· 5.5⚖ disputedkernel: ntfs: reject invalid MFT LCNs from boot sector (CVE-2026-89612)
A flaw was found in the Linux kernel's NTFS filesystem driver. A local attacker could provide a specially crafted NTFS boot sector containing an invalid Master File Table (MFT) Logical Cluster Number (LCN). Due to an integer overflow durin…
CVE-2026-89611Medium· 5.5⚖ disputedkernel: ntfs: validate non-resident attribute offsets (CVE-2026-89611)
A flaw was found in the Linux kernel. The NTFS file system driver does not properly validate non-resident attribute offsets when converting between sparse and non-sparse attributes. A local attacker could craft a malicious Master File Tabl…
CVE-2026-89610Medium· 5.5⚖ disputedkernel: ntfs: verify run length exceeding volume boundary (CVE-2026-89610)
A flaw was found in the Linux kernel's NTFS component. The mapping pairs decoder fails to verify if a run length extends beyond the volume boundary. A local attacker could exploit this by providing a malformed NTFS image with a crafted map…
CVE-2026-89601Medium· 5.5⚖ disputedkernel: ext2: Fix lost inode updates for IS_SYNC inodes (CVE-2026-89601)
A flaw was found in the Linux kernel's ext2 filesystem. This vulnerability occurs in the `ext2_setsize()` and `ext2_xattr_set2()` functions, where inode updates for `IS_SYNC` inodes may be lost. This happens because the `sync_inode_metadat…
CVE-2026-89600Medium· 5.5⚖ disputedkernel: fanotify: fix use-after-free of file range info (CVE-2026-89600)
A flaw was found in the Linux kernel's fanotify subsystem. This use-after-free vulnerability occurs when the system attempts to report file range information after the memory holding that information has been released. A local attacker cou…
CVE-2026-89588Medium· 5.5⚖ disputedkernel: ACPI: APEI: GHES: fix ARM section length accounting after header (CVE-2026-89588)
A flaw was found in the Linux kernel's Advanced Configuration and Power Interface (ACPI) APEI Generic Hardware Error Source (GHES) component. Incorrect length accounting in the `ghes_handle_arm_hw_error()` function can lead to the parser r…