Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-24 07:09Z
2024-10-21
2024-10-21 20:15Z
CRIT

CVE-2022-49003 — Linux Linux_kernel: Observed the following panic when making NVMe/RDMA connections with native multipath on the Rocky

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-49003

In the Linux kernel, the following vulnerability has been resolved: nvme: fix SRCU protection of nvme_ns_head list Walking the nvme_ns_head siblings list is protected by the head's srcu in nvme_ns_head_submit_bio() but not nvme_mpath_revalidate_paths(). Removing namespaces from the list also fails to synchronize the srcu. Concurrent scan work can therefore cause use-after-frees. Hold the head's srcu lock in nvme_mpath_revalidate_paths() and synchronize with the srcu, not t CVSSv3.1 9.8 (CRITICAL) · EPSS 14th percentile

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-21
2024-10-21 20:15Z
HIGH

CVE-2022-48991 — Linux Linux_kernel: Secondary MMUs don't hold their own references to pages that are mirrored over, so

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-48991

In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs don't hold their own references to pages that are mirrored over, so failing to notify them can lead to page use-after-free. I'm marking this as addressing an issue CVSSv3.1 8.8 (HIGH) · EPSS 17th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 20:15Z
CRIT

CVE-2022-48985 — Linux Linux_kernel: If the other thread (for example, from busy_poll) sets it to a value >=

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-48985

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix race on per-CQ variable napi work_done After calling napi_complete_done(), the NAPIF_STATE_SCHED bit may be cleared, and another CPU can start napi thread and access per-CQ variable, cq->work_done. If the other thread (for example, from busy_poll) sets it to a value >= budget, this thread will continue to run when it should stop, and cause memory corruption and panic. To fix this issue, save CVSSv3.1 9.8 (CRITICAL) · EPSS 13th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-21
2024-10-21 20:15Z
HIGH

CVE-2022-48967 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Bounds check

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-48967

In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Bounds check struct nfc_target arrays While running under CONFIG_FORTIFY_SOURCE=y, syzkaller reported: memcpy: detected field-spanning write (size 129) of single field "target->sensf_res" at net/nfc/nci/ntf.c:260 (size 18) This appears to be a legitimate lack of bounds checking in nci_add_new_protocol(). Add the missing checks. CVSSv3.1 8.8 (HIGH) · EPSS 15th percentile

CWECWE 129TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 20:15Z
HIGH

CVE-2022-48964 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ravb: Fix potential use-after-free

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-48964

In the Linux kernel, the following vulnerability has been resolved: ravb: Fix potential use-after-free in ravb_rx_gbeth() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free. CVSSv3.1 8.8 (HIGH) · EPSS 13th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 20:15Z
HIGH

CVE-2022-48962 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-48962

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential use-after-free in hisi_femac_rx() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free. CVSSv3.1 8.8 (HIGH) · EPSS 15th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 20:15Z
HIGH

CVE-2022-48960 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-48960

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: Fix potential use-after-free in hix5hd2_rx() The skb is delivered to napi_gro_receive() which may free it, after calling this, dereferencing skb may trigger use-after-free. CVSSv3.1 8.8 (HIGH) · EPSS 15th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-10-21
2024-10-21 20:15Z
HIGH

CVE-2022-48954 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix use-after-free in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-48954

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix use-after-free in hsci KASAN found that addr was dereferenced after br2dev_event_work was freed. ================================================================== BUG: KASAN: use-after-free in qeth_l2_br2dev_worker+0x5ba/0x6b0 Read of size 1 at addr 00000000fdcea440 by task kworker/u760:4/540 CPU: 17 PID: 540 Comm: kworker/u760:4 Tainted: G E 6.1.0-20221128.rc7.git1.5aa3bed4 CVSSv3.1 8.8 (HIGH) · EPSS 15th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 18:15Z
CRIT

CVE-2024-49996 — Debian Debian_linux: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix buffer overflow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49996

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix buffer overflow when parsing NFS reparse points ReparseDataLength is sum of the InodeType size and DataBuffer size. So to get DataBuffer size it is needed to subtract InodeType's size from ReparseDataLength. Function cifs_strndup_from_utf16() is currentlly accessing buf->DataBuffer at position after the end of the buffer because it does not subtract InodeType size from the length. Fix this proble CVSSv3.1 9.4 (CRITICAL) · EPSS 6th percentile

CWECWE 120TYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2024-10-21
2024-10-21 18:15Z
HIGH

CVE-2024-49988 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ksmbd: add refcnt to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49988

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add refcnt to ksmbd_conn struct When sending an oplock break request, opinfo->conn is used, But freed ->conn can be used on multichannel. This patch add a reference count to the ksmbd_conn struct so that it can be freed when it is no longer used. CVSSv3.1 8.8 (HIGH)

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 18:15Z
HIGH

CVE-2024-49982 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49982

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts") makes tx() calling dev_put() instead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs into use-after-free. Then Nicolai Stange found more places in aoe have potential use-after-free problem with tx(). e.g. revalidate(), aoecmd_at CVSSv3.1 8.8 (HIGH)

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 18:15Z
HIGH

CVE-2024-49950 — Debian Debian_linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49950

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2cap_connect [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54 CPU: 0 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-00268-g788220eee30d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 0 CVSSv3.1 8.8 (HIGH) · EPSS 1th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 18:15Z
HIGH

CVE-2024-49939 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: avoid to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49939

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: avoid to add interface to list twice when SER If SER L2 occurs during the WoWLAN resume flow, the add interface flow is triggered by ieee80211_reconfig(). However, due to rtw89_wow_resume() return failure, it will cause the add interface flow to be executed again, resulting in a double add list and causing a kernel panic. Therefore, we have added a check to prevent double adding of the list. l CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 18:15Z
HIGH

CVE-2024-49936 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: prevent UAF in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49936

In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: prevent UAF in xenvif_flush_hash() During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free. Therefore, to solve this, you need to change it to list_for_each_entry_safe. CVSSv3.1 8.8 (HIGH)

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 18:15Z
HIGH

CVE-2024-49930 — Linux Linux_kernel: However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49930

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix array out-of-bound access in SoC stats Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To CVSSv3.1 8.8 (HIGH) · EPSS 1th percentile

CWECWE 129TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 13:15Z
CRIT

CVE-2024-49855 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49855

In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between timeout and normal completion If request timetout is handled by nbd_requeue_cmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free can be triggered. Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime make sure that cmd->lock is grabbed for clearing the flag and the requeue. CVSSv3.1 9.8 (CRITICAL)

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-21
2024-10-21 13:15Z
HIGH

CVE-2024-47724 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: use work

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-47724

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: use work queue to process beacon tx event Commit 3a415daa3e8b ("wifi: ath11k: add P2P IE in beacon template") from Feb 28, 2024 (linux-next), leads to the following Smatch static checker warning: drivers/net/wireless/ath/ath11k/wmi.c:1742 ath11k_wmi_p2p_go_bcn_ie() warn: sleeping in atomic context The reason is that ath11k_bcn_tx_status_event() will directly call might sleep function ath11k_ CVSSv3.1 8.8 (HIGH)

TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 12:15Z
HIGH

CVE-2024-47721 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: remove unused

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-47721

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading The handler of firmware C2H event RTW89_MAC_C2H_FUNC_READ_WOW_CAM isn't implemented, but driver expects number of handlers is NUM_OF_RTW89_MAC_C2H_FUNC_WOW causing out-of-bounds access. Fix it by removing ID. Addresses-Coverity-ID: 1598775 ("Out-of-bounds read") CVSSv3.1 8.8 (HIGH)

CWECWE 125TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-10-21
2024-10-21 12:15Z
HIGH

CVE-2024-47712 — Linux Linux_kernel: Reusing this pointer can lead to unpredictable behavior, including accessing memory that has been

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-47712

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param In the `wilc_parse_join_bss_param` function, the TSF field of the `ies` structure is accessed after the RCU read-side critical section is unlocked. According to RCU usage rules, this is illegal. Reusing this pointer can lead to unpredictable behavior, including accessing memory that has been updated or causing use-after-free is CVSSv3.1 8.3 (HIGH)

CWECWE 476TYPVulnerability
8.3
CVSS v3.1
92
Edit Score
2024-10-21
2024-10-21 12:15Z
CRIT

CVE-2024-47695 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Reset cid to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-47695

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds In the function init_conns(), after the create_con() and create_cm() for loop if something fails. In the cleanup for loop after the destroy tag, we access out of bound memory because cid is set to clt_path->s.con_num. This commits resets the cid to clt_path->s.con_num - 1, to stay in bounds in the cleanup loop later. CVSSv3.1 9.8 (CRITICAL)

CWECWE 787TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-21
2024-10-21 12:15Z
CRIT

CVE-2024-47685 — Debian Debian_linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-47685

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1) Use skb_put_zero() to clear the whole TCP header, as done in nf_reject_ip_tcphdr_put() BUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_reject_ip6_tcphdr_put+0x688/0x6c0 n CVSSv3.1 9.1 (CRITICAL) · EPSS 23th percentile

CWECWE 908TYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2024-10-21
2024-10-21 12:15Z
HIGH

CVE-2024-47682 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix off-by-one

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-47682

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix off-by-one error in sd_read_block_characteristics() Ff the device returns page 0xb1 with length 8 (happens with qemu v2.x, for example), sd_read_block_characteristics() may attempt an out-of-bounds memory access when accessing the zoned field at offset 8. CVSSv3.1 8.6 (HIGH)

CWECWE 193TYPVulnerability
8.6
CVSS v3.1
93
Edit Score
2024-10-21
2024-10-21 12:15Z
CRIT

CVE-2024-47678 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: icmp: change the order

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-47678

In the Linux kernel, the following vulnerability has been resolved: icmp: change the order of rate limits ICMP messages are ratelimited : After the blamed commits, the two rate limiters are applied in this order: 1) host wide ratelimit (icmp_global_allow()) 2) Per destination ratelimit (inetpeer based) In order to avoid side-channels attacks, we need to apply the per destination check first. This patch makes the following change : 1) icmp_global_allow() checks if the CVSSv3.1 9.4 (CRITICAL)

CWECWE 203TYPVulnerability
9.4
CVSS v3.1
97
Edit Score
2024-10-20
2024-10-20 12:15Z
CRIT

CVE-2024-44000 — Litespeedtech Litespeed_cache: Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44000

Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1. CVSSv3.1 9.8 (CRITICAL)

CWECWE 522VNDInsufficientlyVNDLitespeedtechTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-10-20
2024-10-20 10:15Z
HIGH

CVE-2024-49620 — Naudinvladimir Ferma.ru.net: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-49620

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mrcheck116 FERMA.ru.net ferma-ru-net-checkout allows Blind SQL Injection.This issue affects FERMA.ru.net: from n/a through <= 1.3.3. CVSSv3.1 8.5 (HIGH)

CWECWE 89VNDNaudinvladimirTYPVulnerability
8.5
CVSS v3.1
93
Edit Score