Tagged “score-dispute”
CVEs tagged score-dispute, newest first.
589 CVEsRSS
CVE-2026-89639Medium· 5.5⚖ disputedkernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (CVE-2026-89639)
A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. When a file is truncated, the `cifs_do_truncate()` function does not properly invalidate the file system cache (fscache). This oversight can lead to …
CVE-2026-89771Medium· 5.5⚖ disputedkernel: ring-buffer: Fix subbuf resize race with ring buffer readers (CVE-2026-89771)
A flaw was found in the Linux kernel. A race condition exists in the ring buffer resizing mechanism, where `trace_buffer subbuf_size` can be read without proper locking while it is being simultaneously resized. This could allow a local att…
CVE-2026-89767Medium· 5.5⚖ disputedkernel: ovl: fix double end_creating() on the casefold-mismatch path (CVE-2026-89767)
A flaw was found in the Linux kernel's overlay file system (overlayfs). An unprivileged local user can trigger a specific error condition during the creation of a new directory. This error causes the system to incorrectly release a lock on…
CVE-2026-89764Medium· 5.5⚖ disputedkernel: rust: devres: fix race between concurrent revokers (CVE-2026-89764)
A flaw was found in the Linux kernel's `rust: devres` component. A race condition exists when two processes attempt to revoke a `Devres` resource concurrently. This can lead to a use-after-free vulnerability, where one process might free r…
CVE-2026-89763High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key_type…
CVE-2026-89762Medium· 5.5⚖ disputedkernel: apparmor: fix cred UAF caused by begin_current_label_crit_section() (CVE-2026-89762)
A flaw was found in the Linux kernel's AppArmor security module. The begin_current_label_crit_section() function, used in various Linux Security Module (LSM) hooks, attempts to replace user credentials when a security label becomes stale. …
CVE-2026-89761Medium· 5.5⚖ disputedkernel: apparmor: fix out-of-bounds write when null terminating a label vec (CVE-2026-89761)
A flaw was found in the Linux kernel's AppArmor security module. An out-of-bounds write vulnerability exists when null terminating a label vector due to improper memory allocation. An unprivileged local attacker can exploit this by writing…
CVE-2026-89760High· 7.0⚖ disputedkernel: mm, swap: don't free a hibernation slot that is in the swap cache (CVE-2026-89760)
A flaw was found in the Linux kernel's memory management (mm) and swap subsystem. This vulnerability occurs when the swap_free_hibernation_slot() function incorrectly frees a hibernation slot while a memory page (folio) is still present in…
CVE-2026-89758High· 7.0⚖ disputedkernel: mm/mempolicy: skip non-present PMDs when queueing folios (CVE-2026-89758)
A flaw was found in the Linux kernel's memory management subsystem. When an HMM-based Graphics Processing Unit (GPU) driver migrates a Transparent Huge Page (THP) to device memory, it can leave a device-private Page Middle Directory (PMD) …
CVE-2026-89747High· 7.0⚖ disputedkernel: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (CVE-2026-89747)
A flaw was found in the Linux kernel's tracing component. A local attacker could exploit a use-after-free vulnerability, a type of memory corruption, by manipulating the `trace_pipe` functionality. This occurs when the system attempts to r…
CVE-2026-89738Medium· 5.5⚖ disputedkernel: usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed (CVE-2026-89738)
A flaw was found in the Linux kernel's `at91_udc` USB gadget driver. In polled-VBUS mode, a timing issue during driver unbinding or probe failure can lead to a use-after-free vulnerability. A local attacker could exploit this by triggering…
CVE-2026-89713High· 7.0⚖ disputedkernel: NFSD: check truncate permission under inode lock (CVE-2026-89713)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). A remote attacker, by sending a crafted file attribute modification request (SETATTR) while a file is being concurrently appended, could exploit a time-of-check to t…
CVE-2026-89709High· 7.0⚖ disputedkernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch (CVE-2026-89709)
A flaw was found in the Linux kernel's lockd and nfsd components. An unguarded dereference of nlmsvc_ops after the nfsd module is removed can lead to a NULL pointer dereference or a use-after-free condition. This vulnerability could allow …
CVE-2026-89708Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY_SESSION the per-session teardown path can free a session while rpciod still h…
In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown After a DESTROY_SESSION the per-session teardown path can free a session while rpciod still h…
CVE-2026-89703High· 7.0⚖ disputedkernel: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (CVE-2026-89703)
A flaw was found in the `nfsd` component of the Linux kernel. The `nfsd4_drop_revoked_stid()` function, which handles admin-revoked delegations, fails to correctly set a status flag before releasing a lock. This oversight can lead to a use…
CVE-2026-89702High· 7.0⚖ disputedkernel: nfsd: size fh_verify server sockaddr slot by xpt_locallen (CVE-2026-89702)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When processing NFSv2/v3-over-UDP requests, the `nfsd_fh_verify` and `nfsd_fh_verify_err` tracepoints incorrectly size a memory buffer. This can lead to an out-of-bo…
CVE-2026-89695High· 7.0⚖ disputedkernel: nfsd: cap decoded POSIX ACL count to bound sort cost (CVE-2026-89695)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). The `nfsd4_decode_posixacl()` function, responsible for decoding POSIX Access Control Lists (ACLs), does not properly cap the entry count received from a client. A r…
CVE-2026-80932Medium· 5.5⚖ disputedkernel: vsock/virtio: flush works in dependency order (CVE-2026-80932)
A flaw was found in the Linux kernel, specifically within the `vsock/virtio` component. An incorrect order of flushing work items during the removal of a `virtio_vsock` object can lead to a use-after-free condition. This vulnerability allo…
CVE-2026-80976High· 7.0⚖ disputedkernel: seg6: reset IP6CB after IPv6 decapsulation (CVE-2026-80976)
A flaw was found in the Linux kernel's IPv6 Segment Routing (seg6) implementation. An unprivileged user can exploit this vulnerability by injecting a specially crafted IPv6 packet. This can lead to an out-of-bounds read, potentially causin…
CVE-2026-80967Medium· 5.5⚖ disputedkernel: ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (CVE-2026-80967)
A flaw was found in the ALSA pcxhr driver within the Linux kernel. The `pcxhr_probe()` function requests a threaded interrupt before properly initializing a critical mutex (`mgr->lock`). This oversight could allow an early interrupt to ope…
CVE-2026-80935Medium· 5.5⚖ disputedkernel: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy (CVE-2026-80935)
A flaw was found in the Linux kernel's Wi-Fi driver for MediaTek MT7996 devices. A malicious or malfunctioning Wi-Fi device can exploit improper validation of an EEPROM (Electrically Erasable Programmable Read-Only Memory) address during a…
CVE-2026-80933Medium· 5.5⚖ disputedkernel: wifi: mt76: mt7996: validate default EEPROM firmware size (CVE-2026-80933)
A flaw was found in the Linux kernel's mt76: mt7996 Wi-Fi driver. This vulnerability occurs because the driver does not properly validate the size of the default EEPROM (Electrically Erasable Programmable Read-Only Memory) firmware. A spec…
CVE-2026-80931Medium· 5.5⚖ disputedkernel: w1: ds28e17: reject an oversize length on an I2C block read (CVE-2026-80931)
A flaw was found in the Linux kernel's w1: ds28e17 1-Wire to I2C bridge driver. A malicious I2C slave device can provide an oversized length during an I2C block read operation. This causes the driver to read beyond the allocated buffer, le…
CVE-2026-80928Medium· 5.5⚖ disputedkernel: smack: fix cred UAF in smack_file_send_sigiotask() (CVE-2026-80928)
A flaw was found in the Linux kernel's SMACK (Simplified Mandatory Access Control Kernel) security module. Incorrect handling of task credentials within the smack_file_send_sigiotask() function can lead to a Use-After-Free (UAF) vulnerabil…
CVE-2026-81017Medium· 5.5⚖ disputedkernel: platform/chrome: sensorhub: Bound the EC-reported sensor number (CVE-2026-81017)
A flaw was found in the Linux kernel's `sensorhub` component. A local attacker could provide a maliciously crafted sensor number in an EC FIFO event. This unchecked sensor number could lead to an out-of-bounds read and write in the `batch_…
CVE-2026-81002High· 7.0⚖ disputedkernel: xdp: fix zero-copy frame layout (CVE-2026-81002)
A flaw was found in the Linux kernel's XDP (eXpress Data Path) component. Incorrect handling of zero-copy frame layout in the `xdp_convert_zc_to_xdp_frame()` function can allow an AF_XDP zero-copy packet, when redirected through `cpumap`, …
CVE-2026-80992Medium· 5.5⚖ disputedkernel: net: ravb: avoid dereferencing an invalid PTP clock (CVE-2026-80992)
A flaw was found in the `net: ravb` component of the Linux kernel. This vulnerability allows for a NULL pointer dereference when the Precision Time Protocol (PTP) clock's index is queried before it is properly initialized or if its registr…
CVE-2026-80987Medium· 5.5⚖ disputedkernel: NTB: ntb_transport: Reject oversized TX buffers (CVE-2026-80987)
A flaw was found in the Linux kernel's Non-Transparent Bridge (NTB) transport module. When processing oversized transmit (TX) buffers, the system fails to properly free the allocated memory, leading to a memory leak. This continuous leakag…
CVE-2026-89482High· 7.0⚖ disputedkernel: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (CVE-2026-89482)
A flaw was found in the nvme-tcp module of the Linux kernel. This vulnerability arises from improper handling of C2HData for REQ_OP_WRITE_ZEROES commands, where the system fails to adequately validate the data length. A remote attacker cou…
CVE-2026-89479High· 7.0⚖ disputedkernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted series of SCTP packets, leading to a use-after-free vulnerability. This occurs when the ker…