https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:33:29 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-13847 bdu:2026-13847 https://cve.radiocsirt.org/vuln/bdu:2026-13847 https://cve.radiocsirt.org/vuln/bell-cve-2026-46211 <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-46211 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0926 certfr-2026-avi-0926 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0926 https://cve.radiocsirt.org/vuln/euvd-2026-327171 EUVD-2026-327171 https://cve.radiocsirt.org/vuln/euvd-2026-327171 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46211 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()</p> <p>msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not.</p> <p>Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy_to_user() call.</p> <p>Add the missing NULL check for kmemdup() and return ret instead of 0.</p> <p>Note that the SET counterpart (msm_ioctl_gem_info_set_metadata) correctly returns ret.</p> <p>Patchwork: https://patchwork.freedesktop.org/patch/714478/</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()</p> <p>msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not.</p> <p>Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy_to_user() call.</p> <p>Add the missing NULL check for kmemdup() and return ret instead of 0.</p> <p>Note that the SET counterpart (msm_ioctl_gem_info_set_metadata) correctly returns ret.</p> <p>Patchwork: https://patchwork.freedesktop.org/patch/714478/</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46211 https://cve.radiocsirt.org/vuln/ghsa-6wcw-jhw2-v4p6 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()</p> <p>msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not.</p> <p>Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy_to_user() call.</p> <p>Add the missing NULL check for kmemdup() and return ret instead of 0.</p> <p>Note that the SET counterpart (msm_ioctl_gem_info_set_metadata) correctly returns ret.</p> <p>Patchwork: https://patchwork.freedesktop.org/patch/714478/</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()</p> <p>msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not.</p> <p>Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy_to_user() call.</p> <p>Add the missing NULL check for kmemdup() and return ret instead of 0.</p> <p>Note that the SET counterpart (msm_ioctl_gem_info_set_metadata) correctly returns ret.</p> <p>Patchwork: https://patchwork.freedesktop.org/patch/714478/</p> https://cve.radiocsirt.org/vuln/ghsa-6wcw-jhw2-v4p6 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10954-1 <p>kernel-devel-7.0.11-1.1 on GA media</p> <p>kernel-devel-7.0.11-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10954-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23066-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23066-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-46211 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 161 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not. Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy_to_user() call. Add the missing NULL check for kmemdup() and return ret instead of 0. Note that the SET counterpart (msm_ioctl_gem_info_set_metadata) correctly returns ret. Patchwork: https://patchwork.freedesktop.org/patch/714478/</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 161 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not. Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy_to_user() call. Add the missing NULL check for kmemdup() and return ret instead of 0. Note that the SET counterpart (msm_ioctl_gem_info_set_metadata) correctly returns ret. Patchwork: https://patchwork.freedesktop.org/patch/714478/</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-46211 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1700 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder andere nicht näher spezifizierte Auswirkungen zu erzielen.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder andere nicht näher spezifizierte Auswirkungen zu erzielen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1700