Количество 13
Количество 13
GHSA-wg7x-4p3f-2w22
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`.
CVE-2026-68350
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`.
CVE-2026-68350
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`.
CVE-2026-68350
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`.
CVE-2026-68350
wifi: carl9170: fix OOB read from off-by-two in TX status handler
CVE-2026-68350
In the Linux kernel, the following vulnerability has been resolved: w ...
ELSA-2026-500377
ELSA-2026-500377: Unbreakable Enterprise kernel security update (IMPORTANT)
ELSA-2026-500249
ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT)
SUSE-SU-2026:4254-1
Security update for the Linux Kernel
SUSE-SU-2026:4120-1
Security update for the Linux Kernel
openSUSE-SU-2026:21910-1
Security update for the Linux Kernel
ELSA-2026-500248
ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT)
ELSA-2026-500374
ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-wg7x-4p3f-2w22 In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`. | 0% Низкий | 2 месяца назад | |
 | CVE-2026-68350 In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`. | 0% Низкий | 2 месяца назад | |
 | CVE-2026-68350 In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`. | CVSS3: 6.1 | 0% Низкий | 2 месяца назад |
 | CVE-2026-68350 In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`. | 0% Низкий | 2 месяца назад | |
 | CVE-2026-68350 wifi: carl9170: fix OOB read from off-by-two in TX status handler | CVSS3: 7.1 | 0% Низкий | 2 месяца назад |
| CVE-2026-68350 In the Linux kernel, the following vulnerability has been resolved: w ... | 0% Низкий | 2 месяца назад | |
| ELSA-2026-500377 ELSA-2026-500377: Unbreakable Enterprise kernel security update (IMPORTANT) | 6 дней назад | ||
| ELSA-2026-500249 ELSA-2026-500249: Unbreakable Enterprise kernel security update (IMPORTANT) | около 1 месяца назад | ||
 | SUSE-SU-2026:4254-1 Security update for the Linux Kernel | 25 дней назад | ||
| SUSE-SU-2026:4120-1 Security update for the Linux Kernel | около 1 месяца назад | ||
| openSUSE-SU-2026:21910-1 Security update for the Linux Kernel | 21 день назад | ||
| ELSA-2026-500248 ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT) | около 1 месяца назад | ||
| ELSA-2026-500374 ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT) | 6 дней назад |
Уязвимостей на страницу