Количество 34
Количество 34
CVE-2026-23243
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80
CVE-2026-23243
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80
CVE-2026-23243
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80
CVE-2026-23243
RDMA/umad: Reject negative data_len in ib_umad_write
CVE-2026-23243
In the Linux kernel, the following vulnerability has been resolved: R ...
GHSA-85rq-57vx-88q2
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80
SUSE-SU-2026:1777-1
Security update for the Linux Kernel
SUSE-SU-2026:2178-1
Security update for the Linux Kernel (Live Patch 70 for SUSE Linux Enterprise 12 SP5)
SUSE-SU-2026:2168-1
Security update for the Linux Kernel (Live Patch 76 for SUSE Linux Enterprise 12 SP5)
SUSE-SU-2026:2153-1
Security update for the Linux Kernel (Live Patch 72 for SUSE Linux Enterprise 12 SP5)
SUSE-SU-2026:2148-1
Security update for the Linux Kernel (Live Patch 75 for SUSE Linux Enterprise 12 SP5)
SUSE-SU-2026:2137-1
Security update for the Linux Kernel (Live Patch 68 for SUSE Linux Enterprise 12 SP5)
SUSE-SU-2026:2189-1
Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:2158-1
Security update for the Linux Kernel (Live Patch 46 for SUSE Linux Enterprise 15 SP4)
SUSE-SU-2026:2141-1
Security update for the Linux Kernel (Live Patch 40 for SUSE Linux Enterprise 15 SP4)
SUSE-SU-2026:2131-1
Security update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:2199-1
Security update for the Linux Kernel (Live Patch 17 for SUSE Linux Enterprise 15 SP6)
SUSE-SU-2026:2181-1
Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:2176-1
Security update for the Linux Kernel (Live Patch 1 for SUSE Linux Enterprise 15 SP7)
SUSE-SU-2026:2172-1
Security update for the Linux Kernel (Live Patch 20 for SUSE Linux Enterprise 15 SP6)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-23243 In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 | CVSS3: 7.8 | 0% Низкий | 3 месяца назад |
 | CVE-2026-23243 In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 | CVSS3: 7.3 | 0% Низкий | 3 месяца назад |
 | CVE-2026-23243 In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 | CVSS3: 7.8 | 0% Низкий | 3 месяца назад |
 | CVE-2026-23243 RDMA/umad: Reject negative data_len in ib_umad_write | CVSS3: 7.8 | 0% Низкий | 3 месяца назад |
| CVE-2026-23243 In the Linux kernel, the following vulnerability has been resolved: R ... | CVSS3: 7.8 | 0% Низкий | 3 месяца назад |
| GHSA-85rq-57vx-88q2 In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 | CVSS3: 7.8 | 0% Низкий | 3 месяца назад |
 | SUSE-SU-2026:1777-1 Security update for the Linux Kernel | около 1 месяца назад | ||
| SUSE-SU-2026:2178-1 Security update for the Linux Kernel (Live Patch 70 for SUSE Linux Enterprise 12 SP5) | 21 день назад | ||
| SUSE-SU-2026:2168-1 Security update for the Linux Kernel (Live Patch 76 for SUSE Linux Enterprise 12 SP5) | 21 день назад | ||
| SUSE-SU-2026:2153-1 Security update for the Linux Kernel (Live Patch 72 for SUSE Linux Enterprise 12 SP5) | 22 дня назад | ||
| SUSE-SU-2026:2148-1 Security update for the Linux Kernel (Live Patch 75 for SUSE Linux Enterprise 12 SP5) | 22 дня назад | ||
| SUSE-SU-2026:2137-1 Security update for the Linux Kernel (Live Patch 68 for SUSE Linux Enterprise 12 SP5) | 22 дня назад | ||
| SUSE-SU-2026:2189-1 Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 15 SP7) | 21 день назад | ||
| SUSE-SU-2026:2158-1 Security update for the Linux Kernel (Live Patch 46 for SUSE Linux Enterprise 15 SP4) | 21 день назад | ||
| SUSE-SU-2026:2141-1 Security update for the Linux Kernel (Live Patch 40 for SUSE Linux Enterprise 15 SP4) | 22 дня назад | ||
| SUSE-SU-2026:2131-1 Security update for the Linux Kernel RT (Live Patch 10 for SUSE Linux Enterprise 15 SP7) | 23 дня назад | ||
| SUSE-SU-2026:2199-1 Security update for the Linux Kernel (Live Patch 17 for SUSE Linux Enterprise 15 SP6) | 20 дней назад | ||
| SUSE-SU-2026:2181-1 Security update for the Linux Kernel (Live Patch 8 for SUSE Linux Enterprise 15 SP7) | 21 день назад | ||
| SUSE-SU-2026:2176-1 Security update for the Linux Kernel (Live Patch 1 for SUSE Linux Enterprise 15 SP7) | 21 день назад | ||
| SUSE-SU-2026:2172-1 Security update for the Linux Kernel (Live Patch 20 for SUSE Linux Enterprise 15 SP6) | 21 день назад |
Уязвимостей на страницу