https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 19:09:47 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-99021 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>regulator: of: fill in supply names in of_regulator_bulk_get_all()</p> <p>of_regulator_bulk_get_all() returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name set, because the caller provides it, and the core expects it to be there: regulator_bulk_enable() prints it when a supply fails to enable, so a caller that hands such an array to it dereferences uninitialised memory on that path.</p> <p>Copy each name into the array&#39;s own allocation, right behind the entries, so that it shares the array&#39;s lifetime and callers still have nothing extra to free. That also retires the fixed 64 byte stack buffer the names were assembled in, which is_supply_name() never bounded the copy against.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>regulator: of: fill in supply names in of_regulator_bulk_get_all()</p> <p>of_regulator_bulk_get_all() returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name set, because the caller provides it, and the core expects it to be there: regulator_bulk_enable() prints it when a supply fails to enable, so a caller that hands such an array to it dereferences uninitialised memory on that path.</p> <p>Copy each name into the array&#39;s own allocation, right behind the entries, so that it shares the array&#39;s lifetime and callers still have nothing extra to free. That also retires the fixed 64 byte stack buffer the names were assembled in, which is_supply_name() never bounded the copy against.</p> https://db.gcve.eu/vuln/fkie_cve-2026-99021 https://db.gcve.eu/vuln/ghsa-pp3v-c45m-5x73 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>regulator: of: fill in supply names in of_regulator_bulk_get_all()</p> <p>of_regulator_bulk_get_all() returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name set, because the caller provides it, and the core expects it to be there: regulator_bulk_enable() prints it when a supply fails to enable, so a caller that hands such an array to it dereferences uninitialised memory on that path.</p> <p>Copy each name into the array&#39;s own allocation, right behind the entries, so that it shares the array&#39;s lifetime and callers still have nothing extra to free. That also retires the fixed 64 byte stack buffer the names were assembled in, which is_supply_name() never bounded the copy against.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>regulator: of: fill in supply names in of_regulator_bulk_get_all()</p> <p>of_regulator_bulk_get_all() returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name set, because the caller provides it, and the core expects it to be there: regulator_bulk_enable() prints it when a supply fails to enable, so a caller that hands such an array to it dereferences uninitialised memory on that path.</p> <p>Copy each name into the array&#39;s own allocation, right behind the entries, so that it shares the array&#39;s lifetime and callers still have nothing extra to free. That also retires the fixed 64 byte stack buffer the names were assembled in, which is_supply_name() never bounded the copy against.</p> https://db.gcve.eu/vuln/ghsa-pp3v-c45m-5x73