Tagged “vex”
CVEs tagged vex, newest first.
2956 CVEsRSS
CVE-2026-89481High· 7.0kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) over TCP (nvme-tcp) component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer (R2T) command for a read request. The host s…
CVE-2026-89480High· 7.0kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)
A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user applic…
CVE-2026-89479High· 7.0⚖ disputedkernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted series of SCTP packets, leading to a use-after-free vulnerability. This occurs when the ker…
CVE-2026-89478High· 7.0⚖ disputedkernel: sctp: drop a chunk if its transport was removed (CVE-2026-89478)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. An authenticated attacker could exploit a timing window during the removal of an SCTP transport. This could lead to the system attempting to…
CVE-2026-89477High· 7.0kernel: sctp: fix NULL deref on untransmitted RECONF completion (CVE-2026-89477)
A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. This vulnerability occurs when the kernel attempts to complete a stream reconfiguration request that has not been fully transmitted…
CVE-2026-89476High· 7.0kernel: sctp: fix stream->outcnt underflow on duplicate RECONF responses (CVE-2026-89476)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could exploit this by sending specially crafted duplicate RECONF responses. This action can cause an underflow in the `str…
CVE-2026-89475Medium· 5.5kernel: power: supply: bq24257: fix use-after-free on remove (CVE-2026-89475)
A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the `bq24257` power supply driver. This issue occurs when the STAT-pin interrupt handler attempts to reschedule work and access memory that has already been fre…
CVE-2026-89474Medium· 5.5kernel: power: supply: bq256xx: drain usb_work before freeing the charger (CVE-2026-89474)
A flaw was found in the Linux kernel's power supply subsystem, specifically within the bq256xx driver. This vulnerability occurs when a USB work item attempts to access a charger object after it has been freed. This timing issue can lead t…
CVE-2026-89473Medium· 5.5kernel: power: supply: bq25890: Fix power_supply reference leak (CVE-2026-89473)
A flaw was found in the Linux kernel's bq25890 power supply driver. The bq25890_fw_probe() function acquires a reference to a secondary charger but fails to release it on subsequent probe failures or driver detach. This reference leak can …
CVE-2026-89471Medium· 5.5⚖ disputedkernel: power: supply: cros_usbpd-charger: bound the EC-reported port count (CVE-2026-89471)
A flaw was found in the Linux kernel's `cros_usbpd-charger` driver. A malicious or compromised embedded controller (EC) can report an excessive number of USB Power Delivery (PD) ports. This causes the driver to write beyond the allocated m…
CVE-2026-89470Medium· 5.5⚖ disputedkernel: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (CVE-2026-89470)
A flaw was found in the Linux kernel's `cros_usbpd-charger` driver. This driver, which manages USB power delivery, incorrectly processes port count information from an embedded controller. A malicious embedded controller could provide an e…
CVE-2026-89469Medium· 5.5⚖ disputedkernel: power: supply: lp8727: fix use-after-free in lp8727_release_irq() (CVE-2026-89469)
A flaw was found in the Linux kernel's lp8727 power supply driver. A race condition can occur during the release of an interrupt request (IRQ), where a delayed work item might be re-armed after the associated memory has been freed. This ca…
CVE-2026-89466Medium· 5.5⚖ disputedkernel: power: supply: qcom_battmgr: terminate the strings from firmware (CVE-2026-89466)
A flaw was found in the Linux kernel's `qcom_battmgr` component, responsible for power supply management. This vulnerability occurs due to improper string termination when handling firmware-provided strings. A malicious or malformed firmwa…
CVE-2026-89465Medium· 5.5⚖ disputedkernel: power: supply: rt9455: quiesce delayed work before teardown (CVE-2026-89465)
A flaw was found in the Linux kernel, specifically within the rt9455 power supply driver. This vulnerability occurs due to improper management of delayed tasks when the device is being removed or if its initialization fails. A pending task…
CVE-2026-89464Medium· 5.5kernel: power: supply: twl4030_charger: cancel workers via devm (CVE-2026-89464)
A flaw was found in the Linux kernel's `twl4030_charger` driver. When the driver's remove function is called, it fails to properly cancel pending worker tasks. This oversight allows a worker to attempt to access memory that has already bee…
CVE-2026-89463Medium· 5.5kernel: power: supply: ucs1002: fix use-after-free on remove (CVE-2026-89463)
A flaw was found in the Linux kernel's `ucs1002` power supply driver. The driver does not properly cancel a delayed work item during device removal, leading to a use-after-free vulnerability. This issue allows the system to attempt to acce…
CVE-2026-89461Medium· 5.5kernel: power: supply: max17040: synchronize work cancellation on suspend (CVE-2026-89461)
A flaw was found in the Linux kernel's `max17040` power supply driver. A timing issue, known as a race condition, can occur during system suspend. This allows a background process (polling callback) to continue accessing the fuel gauge and…
CVE-2026-89460Medium· 4.4kernel: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (CVE-2026-89460)
A flaw was found in the Linux kernel. A local user can trigger a kernel panic by running the `perf stat` command while CPUs are being hotplugged. This occurs because the system fails to properly allocate CPU event structures for newly onli…
CVE-2026-89458High· 7.0kernel: s390/dasd: Do not complete a failed ESE read as successful (CVE-2026-89458)
A flaw was found in the Linux kernel's s390/dasd component. The `dasd_int_handler()` function incorrectly marks failed Extended Sense Data (ESE) read operations as successful when processing unallocated ESE tracks. This leads to the block …
CVE-2026-89457Medium· 5.5kernel: s390/dasd: Guard sysfs discipline callbacks against unallocated private data (CVE-2026-89457)
A flaw was found in the s390/dasd component of the Linux kernel. An unprivileged local user can trigger a null pointer dereference by reading specific world-readable sysfs attributes while the device is being brought online. This can lead …
CVE-2026-89456High· 7.0kernel: s390/dasd: Propagate partial completion length across ERP recovery (CVE-2026-89456)
A flaw was found in the Linux kernel. Specifically, within the s390/dasd component, an issue exists during error recovery for disk read operations. When a request is partially completed and then recovered, the system fails to correctly pro…
CVE-2026-89448High· 7.0⚖ disputedkernel: iommu/vt-d: Force requesting ACS when tboot is enabled (CVE-2026-89448)
A flaw was found in the Linux kernel's IOMMU (Input/Output Memory Management Unit) component. When tboot (Trusted Boot) is enabled, the system may fail to correctly request Access Control Services (ACS). This misconfiguration could potenti…
CVE-2026-89444High· 7.0kernel: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (CVE-2026-89444)
A flaw was found in the Linux kernel. The `dell-wmi-sysman` driver, responsible for managing Dell WMI (Windows Management Instrumentation) system attributes, incorrectly logs sensitive information. Specifically, when setting a BIOS attribu…
CVE-2026-89443Medium· 5.5kernel: platform/x86: ISST: Validate level in perf mask ioctls (CVE-2026-89443)
A flaw was found in the Linux kernel's platform/x86 ISST module. The `isst_if_get_perf_level_mask()` and `isst_if_get_base_freq_mask()` functions fail to validate a user-provided 'level' parameter. A local attacker could exploit this by pr…
CVE-2026-89442Medium· 5.5⚖ disputedkernel: platform/x86: ISST: Validate socket ID in clos_assoc ioctl (CVE-2026-89442)
A flaw was found in the Linux kernel. The isst_if_clos_assoc ioctl function in the platform/x86: ISST module contains an improper validation of the socket_id. This allows a local attacker to cause an out-of-bounds access or a NULL pointer …
CVE-2026-81012Medium· 5.5⚖ disputedkernel: platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (CVE-2026-81012)
A flaw was found in the Linux kernel's hp-bioscfg component. The `hp_get_string_from_buffer()` function contains an off-by-one write vulnerability. This occurs because the NUL terminator can be written one byte beyond the allocated buffer,…
CVE-2026-89551High· 7.0⚖ disputedkernel: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (CVE-2026-89551)
A flaw was found in the Linux kernel's SUNRPC subsystem, specifically within the `xdr_buf_trim()` function. This vulnerability occurs when `xdr_buf_trim()` attempts to reduce the size of an XDR buffer. If the buffer's length is smaller tha…
CVE-2026-89548High· 7.0kernel: SUNRPC: always drain cache_cleaner before destroying a cache_detail (CVE-2026-89548)
A flaw was found in the Linux kernel's SUNRPC component. When `sunrpc_destroy_cache_detail()` is called, it may not properly drain the `cache_cleaner` before freeing a `cache_detail` object. This oversight can lead to a use-after-free vuln…
CVE-2026-89547High· 7.0kernel: SUNRPC: Check svc pool percpu counter allocation (CVE-2026-89547)
A flaw was found in the Linux kernel's SUNRPC component. A local administrator, under specific conditions of memory pressure or fault injection during RPC server startup, can trigger a failure in per-CPU counter allocation. This failure le…
CVE-2026-89541High· 7.0⚖ disputedkernel: SUNRPC: harden gss_unwrap_resp_priv length checks (CVE-2026-89541)
A flaw was found in the Linux kernel. Specifically, an integer overflow vulnerability exists in the `gss_unwrap_resp_priv()` function within the SUNRPC component. This flaw occurs when validating the length of RPCSEC_GSS opaque data. A mal…