https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 22:46:45 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-93077 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>cxl/features: Clamp Get Feature output size to the remaining buffer</p> <p>cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out.</p> <p>Use the per-iter size data_to_rd_size, which already tracks the remaining room, as the output capacity.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>cxl/features: Clamp Get Feature output size to the remaining buffer</p> <p>cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out.</p> <p>Use the per-iter size data_to_rd_size, which already tracks the remaining room, as the output capacity.</p> https://db.gcve.eu/vuln/fkie_cve-2026-93077 https://db.gcve.eu/vuln/ghsa-qp96-h2xq-qgj3 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>cxl/features: Clamp Get Feature output size to the remaining buffer</p> <p>cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out.</p> <p>Use the per-iter size data_to_rd_size, which already tracks the remaining room, as the output capacity.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>cxl/features: Clamp Get Feature output size to the remaining buffer</p> <p>cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out.</p> <p>Use the per-iter size data_to_rd_size, which already tracks the remaining room, as the output capacity.</p> https://db.gcve.eu/vuln/ghsa-qp96-h2xq-qgj3 https://db.gcve.eu/vuln/opensuse-su-2026:11893-1 <p>kernel-devel-7.2.8-1.1 on GA media</p> <p>kernel-devel-7.2.8-1.1 on GA media</p> https://db.gcve.eu/vuln/opensuse-su-2026:11893-1 https://db.gcve.eu/vuln/ubuntu-cve-2026-93077 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 120 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: cxl/features: Clamp Get Feature output size to the remaining buffer cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out. Use the per-iter size data_to_rd_size, which already tracks the remaining room, as the output capacity.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 120 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: cxl/features: Clamp Get Feature output size to the remaining buffer cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out. Use the per-iter size data_to_rd_size, which already tracks the remaining room, as the output capacity.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-93077