Microsoft Security Response Center

media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com

PDO::quote() may return unquoted string

drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()

media: pwc: Return queued buffers on start_streaming() failure

drm/amdgpu: Fix kernel panic during driver load failure

Redis - Heap Out-of-Bounds Read in Cluster Bus PING Message Handler

ClamAV GPT File Format Processing Memory Corruption Vulnerability

staging: vme_user: fix location monitor leak in tsi148 bridge

libceph: remove debugfs files before client teardown

KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug

mptcp: pm: userspace: fix use-after-free in get_local_id

Bluetooth: btusb: validate Realtek vendor event length

drm/i915/hdcp: check streams[] bounds before overflow

hwmon: occ: validate poll response sensor blocks

drm/amd/display: set new_stream to NULL after release

media: vivid: check for vb2_is_busy() when toggling caps

drm/amdgpu/vcn4: avoid rereading IB param length

mm/damon/core: disallow overlapping input ranges for damon_set_regions()

phonet: pep: fix use-after-free in pep_get_sb()

ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()

mm/khugepaged: write all dirty file folios when collapsing

geneve: require CAP_NET_ADMIN in the device netns for changelink

media: cx23885: add ioremap return check and cleanup

drm/amdgpu/vce: fix integer overflow in image size

usb: gadget: function: rndis: add length check to response query

media: ti: vpe: unwind v4l2 device registration on probe error

drm/amdkfd: Check bounds in allocate_event_notification_slot

media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()

vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

net/sched: serialize qdisc_rtab_list against concurrent get/put

libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

HID: wacom: stop hardware after post-start probe failures

media: radio-si476x: Unregister v4l2_device on probe failure

wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses

ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

wifi: ath6kl: fix use-after-free in aggr_reset_state()

userfaultfd: prevent registration of special VMAs

Bluetooth: hci_qca: Clear memdump state on invalid dump size

media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe

wifi: brcmfmac: initialize SDIO data work before cleanup

drop_monitor: fix size calculations for 64-bit attributes

audit: fix recursive locking deadlock in audit_dupe_exe()

LoongArch: Move jump_label_init() before parse_early_param()

net/packet: avoid fanout hook re-registration after unregister

wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()

sctp: close UDP tunnel sockets during netns teardown

Uncontrolled Memory Allocation in GNU cpio

gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

dpaa2-switch: put MAC endpoint device on disconnect

drop_monitor: perform u64_stats updates under IRQ-disabled section

amt: re-read skb header pointers after every pull

Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

USB: serial: io_edgeport: cap received transmit credits

wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()

ASoC: tas2781: bound firmware description string parsing

mei: bus: access mei_device under device_lock on cleanup

tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates

drm/i915/gem: Do not leak siblings[] on proto context error

ila: reload IPv6 header after pskb_may_pull in checksum adjust

bpf: Fix UAF in sock clone early bailouts

media: stm32: dcmi: unregister notifier on probe failure

drm/amdgpu: invoke pm_genpd_remove() before freeing genpd

ksmbd: bound DACL dedup walk to copied ACEs

GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

Kata Containers: Config Path Annotation Arbitrary File Loading

x86/bugs: Make Safe-RET robust against interrupt injection

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services

xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message

ksmbd: validate compound request size before reading StructureSize2

iio: adc: spear: Initialize completion before requesting IRQ

KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

smb: client: fix double-free in SMB2_close() replay

Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()

HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read

rhashtable: clear stale iter->p on table restart

HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets

Bluetooth: qca: fix NVM tag length underflow in TLV parser

wifi: mac80211: tear down new links on vif update error path

ClamAV PDF File Format Processing Memory Corruption Vulnerability

ClamAV ZIP File Format Processing Memory Corruption Vulnerability

ClamAV Mach-O File Format Processing Memory Corruption Vulnerability

ClamAV ZIP File Format Processing Memory Corruption Vulnerability

ClamAV PESpin File Format Processing Integer Overflow Vulnerability

drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU

wifi: brcmfmac: fix 802.1X-SHA256 call trace warning

GitHub CLI: Terminal escape sequence injection in multiple `gh` commands

drm/vc4: Shut down BO cache timer before teardown

usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback

wifi: wilc1000: validate assoc response length before subtracting header

Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled

iommu/amd: Bound the early ACPI HID map

drm/amdgpu: fix aperture mapping leak

ClamAV XAR File Format Processing Memory Corruption Vulnerability

media: sun4i-csi: Return queued buffers on start_streaming() failure