Tagged “score-dispute”
CVEs tagged score-dispute, newest first.
589 CVEsRSS
CVE-2026-89584High· 7.0⚖ disputedkernel: block: validate user space vectors during extraction (CVE-2026-89584)
A flaw was found in the Linux kernel's block layer. This vulnerability arises from insufficient validation of user-space data structures (vectors) against the device's Direct Memory Access (DMA) alignment requirements. A local attacker cou…
CVE-2026-89581High· 7.0⚖ disputedkernel: bpf, x86: Fix per-CPU address resolution into an extended register (CVE-2026-89581)
A flaw was found in the Linux kernel's handling of Berkeley Packet Filter (BPF) programs on x86 architecture. An issue with how per-CPU addresses are resolved into extended registers can lead to incorrect memory access. A local attacker co…
CVE-2026-89574Medium· 5.5⚖ disputedkernel: dm array: validate array block headers on read (CVE-2026-89574)
A flaw was found in the Linux kernel's device mapper (dm) array component. Insufficient validation of array block headers during read operations allows a local attacker to craft a malicious on-disk `nr_entries` value. This can lead to an o…
CVE-2026-89571Medium· 5.5⚖ disputedkernel: cxl/features: bound fwctl command payload to the input buffer (CVE-2026-89571)
A flaw was found in the Linux kernel's CXL (Compute Express Link) features. A local attacker could exploit an out-of-bounds read vulnerability in the `fwctl_cmd_rpc()` and `cxlctl_set_feature()` functions. This occurs when the system attem…
CVE-2026-89570High· 7.0⚖ disputedkernel: cxl/mce: Make the MCE notifier per-region (CVE-2026-89570)
A flaw was found in the Linux kernel's Compute Express Link (CXL) subsystem. Lifetime issues with the CXL Machine Check Exception (MCE) notifier can lead to NULL dereferences and use-after-free vulnerabilities in the MCE handler. This coul…
CVE-2026-89561High· 7.5⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL check when reading idev->cnf.rpl…
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() ipv6_rpl_srh_rcv() dereferences idev from __in6_dev_get() without a NULL check when reading idev->cnf.rpl…
CVE-2026-89558High· 7.0⚖ disputedkernel: md/raid10: fix still_degraded being inverted in raid10_sync_request() (CVE-2026-89558)
A flaw was found in the Linux kernel's md/raid10 (RAID10) driver. This vulnerability occurs when a RAID10 array is in a degraded state and a device is being recovered while another mirror is still missing. Due to an inverted boolean value,…
CVE-2026-89546Medium· 5.3⚖ disputedkernel: Linux Kernel: Resource management flaw in SUNRPC NFS callback service (CVE-2026-89546)
A flaw was found in the Linux kernel's SUNRPC (Sun Remote Procedure Call) Network File System (NFS) callback service. A race condition during the service teardown can lead to system resources not being properly released, causing a resource…
CVE-2026-89544High· 7.5⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a …
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a …
CVE-2026-89537High· 7.0⚖ disputedkernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 (CVE-2026-89537)
A flaw was found in the Linux kernel's SUNRPC implementation, specifically within the `gss_krb5_verify_mic_v2` function. A remote malicious Network File System (NFS) server could provide a specially crafted, short Kerberos Message Integrit…
CVE-2026-89530High· 7.0⚖ disputedkernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530)
A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access (RDMA). A remote attacker can send a specially crafted network reply that is larger than expected. This can cau…
CVE-2026-89692Medium· 5.5⚖ disputedkernel: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue (CVE-2026-89692)
A flaw was found in the Linux kernel's Network File System (NFS) daemon, `nfsd`. This vulnerability occurs when a delegation recall operation fails, leaving a critical internal flag uncleared. This prevents subsequent attempts to break the…
CVE-2026-89689High· 7.0⚖ disputedkernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)
A flaw was found in the Linux kernel's Network File System (NFS) daemon, `nfsd`. A remote attacker could exploit a use-after-free vulnerability in the `nfsd4_sequence()` function. This occurs when the system attempts to reduce the number o…
CVE-2026-89688High· 7.0⚖ disputedkernel: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (CVE-2026-89688)
A flaw was found in the Linux kernel's nfsd component. During a `seqid_op` replay retry, the system incorrectly handles reference counts for stateowners, leading to a reference count underflow and a use-after-free vulnerability. This issue…
CVE-2026-89686High· 7.0⚖ disputedkernel: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (CVE-2026-89686)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd) for NFSv4 layouts. A race condition allows a remote attacker to trigger a kernel panic, leading to a Denial of Service (DoS). This occurs when the `nfsd4_alloc_layout…
CVE-2026-89681High· 7.0⚖ disputedkernel: nfsd: fix layout fence worker double-reference race (CVE-2026-89681)
A flaw was found in the Linux kernel's nfsd component. A race condition in the layout fence worker can cause a double-reference to a layout stateid. This occurs because the workqueue core clears a pending flag prematurely, allowing a new w…
CVE-2026-89680High· 7.0⚖ disputedkernel: nfsd: fix nfsd_file leak on inter-server COPY setup failure (CVE-2026-89680)
A flaw was found in the Linux kernel's nfsd component. This vulnerability occurs when an inter-server COPY operation fails during its setup phase, leading to improper resource cleanup. Consequently, each failed operation results in a memor…
CVE-2026-89677High· 7.0⚖ disputedkernel: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() (CVE-2026-89677)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When creating files, the `dentry_create()` function could return an unexpected directory entry (dentry). This could lead to a previously stored dentry being prematur…
CVE-2026-89676Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids…
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY For an async COPY, nfsd4_copy() called nfs4_init_copy_state() before dup_copy_fields(), so the s2s_cp_stateids…
CVE-2026-89675High· 7.0⚖ disputedkernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675)
A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free (UAF) vulnerability. This allows an async copy object to be fr…
CVE-2026-89668High· 7.0⚖ disputedkernel: nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() (CVE-2026-89668)
A flaw was found in the `nfsd` component of the Linux kernel. The `nfsd_debugfs_init()` function is called before `nfsd4_init_slabs()`. If the slab allocation fails, the `nfsd_debugfs_exit()` cleanup function is bypassed, leaving orphaned …
CVE-2026-89667High· 8.1⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsd_file from the rhashtabl…
In the Linux kernel, the following vulnerability has been resolved: nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsd_file from the rhashtabl…
CVE-2026-89660Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4_client; a stateid reference does not pin it
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4_client; a stateid reference does not pin it. The cli…
CVE-2026-89659Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4_client and does not keep it alive
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4_client and does not keep it alive. The …
CVE-2026-89658High· 7.0⚖ disputedkernel: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (CVE-2026-89658)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). During NFSv4.0 revoked-state cleanup, a race condition can occur where a client's state identifier (stateid) reference does not properly prevent the client from bein…
CVE-2026-89654High· 7.0⚖ disputedkernel: ceph: fix UAF in check_new_map() on session freed during unlock (CVE-2026-89654)
A flaw was found in the Ceph file system component of the Linux kernel. A race condition exists in the `check_new_map()` function during session handling. This allows a local attacker to exploit a use-after-free vulnerability by freeing a …
CVE-2026-89651High· 7.0⚖ disputedkernel: ceph: bound MDSCapAuth path and fs_name decode in handle_session() (CVE-2026-89651)
A flaw was found in the Linux kernel's Ceph client. An out-of-bounds read vulnerability exists in the `handle_session()` function when decoding `MDSCapAuth` records. A malicious or compromised Metadata Server (MDS) can trigger this during …
CVE-2026-89647Medium· 5.5⚖ disputedkernel: ceph: do not repeat ceph_trim_dentries() if no progress possible (CVE-2026-89647)
A flaw was found in the Linux kernel's Ceph file system. The `ceph_trim_dentries()` function, when invoked by `ceph_cap_reclaim_work()`, can enter an infinite loop under specific conditions where no leases need to be reclaimed. This busy l…
CVE-2026-89646Medium· 5.5⚖ disputedkernel: ceph: fix leaked inode reference on writeback abort at umount (CVE-2026-89646)
A flaw was found in the Ceph filesystem component of the Linux kernel. When a writeback operation is aborted during an unmount process, a reference to an inode (a data structure describing a filesystem object) is not properly released. Thi…
CVE-2026-89641High· 7.0⚖ disputedkernel: cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (CVE-2026-89641)
A flaw was found in the Linux kernel's Common Internet File System (CIFS) module. This vulnerability, a use-after-free, occurs in the `cifs_file_set_size()` function. When a file's size is being modified, a critical system resource (tcon o…