Tagged “score-dispute”
CVEs tagged score-dispute, newest first.
589 CVEsRSS
CVE-2026-89478High· 7.0⚖ disputedkernel: sctp: drop a chunk if its transport was removed (CVE-2026-89478)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. An authenticated attacker could exploit a timing window during the removal of an SCTP transport. This could lead to the system attempting to…
CVE-2026-89471Medium· 5.5⚖ disputedkernel: power: supply: cros_usbpd-charger: bound the EC-reported port count (CVE-2026-89471)
A flaw was found in the Linux kernel's `cros_usbpd-charger` driver. A malicious or compromised embedded controller (EC) can report an excessive number of USB Power Delivery (PD) ports. This causes the driver to write beyond the allocated m…
CVE-2026-89470Medium· 5.5⚖ disputedkernel: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (CVE-2026-89470)
A flaw was found in the Linux kernel's `cros_usbpd-charger` driver. This driver, which manages USB power delivery, incorrectly processes port count information from an embedded controller. A malicious embedded controller could provide an e…
CVE-2026-89469Medium· 5.5⚖ disputedkernel: power: supply: lp8727: fix use-after-free in lp8727_release_irq() (CVE-2026-89469)
A flaw was found in the Linux kernel's lp8727 power supply driver. A race condition can occur during the release of an interrupt request (IRQ), where a delayed work item might be re-armed after the associated memory has been freed. This ca…
CVE-2026-89466Medium· 5.5⚖ disputedkernel: power: supply: qcom_battmgr: terminate the strings from firmware (CVE-2026-89466)
A flaw was found in the Linux kernel's `qcom_battmgr` component, responsible for power supply management. This vulnerability occurs due to improper string termination when handling firmware-provided strings. A malicious or malformed firmwa…
CVE-2026-89465Medium· 5.5⚖ disputedkernel: power: supply: rt9455: quiesce delayed work before teardown (CVE-2026-89465)
A flaw was found in the Linux kernel, specifically within the rt9455 power supply driver. This vulnerability occurs due to improper management of delayed tasks when the device is being removed or if its initialization fails. A pending task…
CVE-2026-89448High· 7.0⚖ disputedkernel: iommu/vt-d: Force requesting ACS when tboot is enabled (CVE-2026-89448)
A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) component. When tboot (Trusted Boot) is enabled, the system may fail to correctly request Access Control Services (ACS). This misconfiguration could potenti…
CVE-2026-89442Medium· 5.5⚖ disputedkernel: platform/x86: ISST: Validate socket ID in clos_assoc ioctl (CVE-2026-89442)
A flaw was found in the Linux kernel. The isst_if_clos_assoc ioctl function in the platform/x86: ISST module contains an improper validation of the socket_id. This allows a local attacker to cause an out-of-bounds access or a NULL pointer …
CVE-2026-81012Medium· 5.5⚖ disputedkernel: platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (CVE-2026-81012)
A flaw was found in the Linux kernel's hp-bioscfg component. The `hp_get_string_from_buffer()` function contains an off-by-one write vulnerability. This occurs because the NUL terminator can be written one byte beyond the allocated buffer,…
CVE-2026-89551High· 7.0⚖ disputedkernel: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (CVE-2026-89551)
A flaw was found in the Linux kernel's SUNRPC subsystem, specifically within the `xdr_buf_trim()` function. This vulnerability occurs when `xdr_buf_trim()` attempts to reduce the size of an XDR buffer. If the buffer's length is smaller tha…
CVE-2026-89541High· 7.0⚖ disputedkernel: SUNRPC: harden gss_unwrap_resp_priv length checks (CVE-2026-89541)
A flaw was found in the Linux kernel. Specifically, an integer overflow vulnerability exists in the `gss_unwrap_resp_priv()` function within the SUNRPC component. This flaw occurs when validating the length of RPCSEC_GSS opaque data. A mal…
CVE-2026-89538High· 7.0⚖ disputedkernel: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (CVE-2026-89538)
A flaw was found in the Linux kernel's Server Unix Remote Procedure Call (SUNRPC) component. A remote attacker, with a valid Generic Security Service (GSS) context, could send a specially crafted Kerberos v2 wrap token with an oversized "e…
CVE-2026-89533High· 7.0⚖ disputedkernel: svcrdma: Fix offset arithmetic in read_chunk_range (CVE-2026-89533)
A flaw was found in the `svcrdma` component of the Linux kernel. Incorrect offset arithmetic in the `svc_rdma_read_chunk_range()` function can lead to a `u32` underflow. This underflow can cause the system to attempt to allocate a large am…
CVE-2026-89532High· 7.0⚖ disputedkernel: svcrdma: Fix pcl_for_each_segment for empty chunks (CVE-2026-89532)
A flaw was found in the Linux kernel's svcrdma component. A remote attacker could send a specially crafted network packet that causes an integer underflow in the `pcl_for_each_segment` function when processing a chunk with zero segments. T…
CVE-2026-89524Medium· 5.5⚖ disputedkernel: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (CVE-2026-89524)
A flaw was found in the ath6kl Wi-Fi driver of the Linux kernel. An integer underflow vulnerability occurs when processing Wi-Fi association requests or responses that are shorter than expected. This can cause the system to read beyond the…
CVE-2026-89511Medium· 5.5⚖ disputedkernel: qede: Fix NULL pointer dereference in TPA fragment processing (CVE-2026-89511)
A flaw was found in the qede driver in the Linux kernel. Under specific memory pressure conditions, the driver can encounter a NULL pointer dereference when processing network traffic using TPA (TCP Segmentation Offload) continuation fragm…
CVE-2026-89508Medium· 5.5⚖ disputedkernel: RDMA/ucma: Lock the handler in ucma_set_ib_path() (CVE-2026-89508)
A flaw was found in the Linux kernel's RDMA/ucma component. A race condition exists in the `ucma_set_ib_path()` function when handling events concurrently with `ucma_migrate_id()`. This can allow a local attacker with access to an RDMA dev…
CVE-2026-89504Medium· 5.5⚖ disputedkernel: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (CVE-2026-89504)
A flaw was found in the Linux kernel's regulator subsystem. This vulnerability arises from a programming error where a device tree node pointer is released too early, creating a "dangling pointer"—a reference to memory that is no longer va…
CVE-2026-89495Medium· 5.5⚖ disputedkernel: ocfs2: bound namelen in dlm_migrate_request_handler (CVE-2026-89495)
A flaw was found in ocfs2 in the Linux kernel. A malicious or compromised node within a Distributed Lock Manager (DLM) cluster can send specially crafted messages with unchecked length fields. This can lead to a heap out-of-bounds write, p…
CVE-2026-89493Medium· 5.5⚖ disputedkernel: ocfs2: validate rl_used against rl_count in refcount block validator (CVE-2026-89493)
A flaw was found in the Linux kernel's ocfs2 component. A local attacker with CAP_SYS_ADMIN privileges could exploit this by mounting a crafted or corrupted ocfs2 image, or by performing a raw write to the block device backing an already-m…
CVE-2026-89489Medium· 5.5⚖ disputedkernel: openrisc: fix arbitrary kernel memory access via or1k_atomic syscall (CVE-2026-89489)
A flaw was found in the Linux kernel. The `sys_or1k_atomic()` syscall, specific to the openrisc architecture, does not adequately validate user-provided pointers. An unprivileged process can exploit this by supplying kernel addresses to th…
CVE-2026-89485High· 7.0⚖ disputedkernel: lockd: pin next file across nlm_inspect_file lock-drop (CVE-2026-89485)
A flaw was found in the `lockd` component of the Linux kernel. This use-after-free vulnerability occurs in the `nlm_traverse_files()` function when a file's memory is prematurely released while an iterator still holds a pointer to it. A re…
CVE-2026-89483Medium· 5.5⚖ disputedkernel: nvme: zero the discard fallback page (CVE-2026-89483)
A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) subsystem. Under specific memory pressure conditions, a local user could trigger a scenario where uninitialized kernel memory is used and potentially exposed. This c…
CVE-2026-89605Medium· 5.5⚖ disputedkernel: ecryptfs: release message context on send failure (CVE-2026-89605)
A flaw was found in the `ecryptfs` component of the Linux kernel. When the `ecryptfs_send_miscdev()` function fails to send a message to the userspace daemon, the associated message context is not properly released. This oversight leaves t…
CVE-2026-89599Medium· 5.5⚖ disputedkernel: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (CVE-2026-89599)
A flaw was found in the Linux kernel's `fbdev: omapfb: panel-dsi-cm` component. The `dsicm_probe()` function registers a display before its associated lock (mutex) is properly initialized. This timing issue allows another process to attemp…
CVE-2026-89597Medium· 5.5⚖ disputedkernel: fbdev: uvesafb: unregister connector callback on init failure (CVE-2026-89597)
A flaw was found in the `uvesafb` component of the Linux kernel. During the initialization process, if the platform driver fails to register, a connector callback is not properly unregistered. This oversight can lead to a resource leak, wh…
CVE-2026-89594Medium· 5.5⚖ disputedkernel: hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device (CVE-2026-89594)
A flaw was found in the Linux kernel's OMAP SSI driver. The driver uses a synthetic HSI controller device that does not properly initialize its Direct Memory Access (DMA) mask. This oversight can lead to the driver crashing or triggering w…
CVE-2026-89586Medium· 5.5⚖ disputedkernel: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes (CVE-2026-89586)
A flaw was found in the Linux kernel's `libata-scsi` component. This vulnerability occurs when the system attempts to perform Data Set Management (DSM) TRIM operations on storage devices with logical sector sizes exceeding 2048 bytes. Due …
CVE-2026-89585Medium· 5.5⚖ disputedkernel: auxdisplay: charlcd: cancel backlight work on registration failure (CVE-2026-89585)
A flaw was found in the `auxdisplay: charlcd` component of the Linux kernel. This use-after-free vulnerability occurs when the `charlcd_register()` function fails, leading to the `charlcd` object being freed while a delayed work item still…
CVE-2026-89554Medium· 5.5⚖ disputedkernel: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (CVE-2026-89554)
A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. When reconstructing a Multipath TCP (MPTCP) join request under SYN cookies, the `local_id` field is not properly initialized. An off-path attacker can influence t…