| Published | Title | Version | Author | Status |
|---|---|---|---|---|
| 2026-10-09 13:33 UTC | HID: multitouch: fix use-after-free of haptic data on delayed input release | 4 | qwe.aldo@gmail.com | finished in 3h49m0s |
| 2026-10-09 11:05 UTC | HID: multitouch: use kzalloc for haptic data to fix use-after-free | 3 | qwe.aldo@gmail.com | finished in 4h12m0s |
| 2026-10-09 03:26 UTC | HID: haptic: fix use-after-free of devm haptic data in hid_haptic_destroy() | 2 | qwe.aldo@gmail.com | finished in 4h27m0s |
| 2026-10-09 03:12 UTC | HID: haptic: fix use-after-free of devm haptic data in hid_haptic_destroy() | 1 | qwe.aldo@gmail.com | finished in 4h8m0s |
| 2026-10-07 21:20 UTC | drm/vmwgfx: fix surface reference ioctl error handling and TOCTOU | 2 | qwe.aldo@gmail.com | finished in 3h1m0s |
| 2026-09-28 03:57 UTC | nfc: llcp: prevent resource leak on repeated connect after DM | 3 | qwe.aldo@gmail.com | finished in 3h53m0s |
| 2026-09-26 21:21 UTC | Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() | 4 | qwe.aldo@gmail.com | finished in 4h10m0s |
| 2026-09-26 21:20 UTC | nfc: llcp: clear device pointer on disconnect | 1 | qwe.aldo@gmail.com | finished in 4h6m0s |
| 2026-09-26 19:58 UTC | debugfs: fix UAF and double-free in debugfs_str read/write | 4 | qwe.aldo@gmail.com | finished in 4h15m0s |
| 2026-09-25 18:48 UTC | nfc: llcp: prevent resource leak on repeated connect after DM | 2 | qwe.aldo@gmail.com |
finished
in 4h7m0s
[2 findings] |
| 2026-09-25 17:58 UTC | crypto: nx - validate 'ignore' before subtracting in decompress | 1 | qwe.aldo@gmail.com | skipped |
| 2026-09-25 17:58 UTC | debugfs: fix UAF and double-free in debugfs_str read/write | 1 | qwe.aldo@gmail.com | finished in 3h47m0s |
| 2026-09-25 17:58 UTC | drm/nouveau: cancel irq_work before freeing connector | 1 | qwe.aldo@gmail.com | skipped |
| 2026-09-25 17:58 UTC | nfc: nxp-nci: fix IRQ use-after-free in i2c remove | 1 | qwe.aldo@gmail.com | skipped |
| 2026-09-25 02:35 UTC | nfc: llcp: prevent resource leak on repeated connect after DM | 1 | qwe.aldo@gmail.com | finished in 4h5m0s |
| 2026-09-25 02:35 UTC | nfc: llcp: check socket state after locking in nfc_llcp_recv_dm() | 1 | qwe.aldo@gmail.com | finished in 3h57m0s |
| 2026-09-23 20:37 UTC | net: fec: reject oversized fragments before bounce-buffer memcpy | 2 | qwe.aldo@gmail.com | skipped |
| 2026-09-23 16:28 UTC | drm/amdgpu: fix ATOM parameter space index bounds check | 2 | qwe.aldo@gmail.com | finished in 1h5m0s |
| 2026-09-23 16:23 UTC | net: stmmac: guard FCS stripping against runt frames | 1 | qwe.aldo@gmail.com | skipped |
| 2026-09-23 16:12 UTC | drm/amdgpu: fix ATOM parameter space index bounds check | 1 | qwe.aldo@gmail.com | skipped |
| 2026-09-23 15:43 UTC | drm/amdgpu: prevent parameter-space underflow in nested ATOM table calls | 3 | qwe.aldo@gmail.com | finished in 1h28m0s |
| 2026-09-23 15:29 UTC | drm/qxl: use correct offset when stamping drawable mm_time | 2 | qwe.aldo@gmail.com | finished in 3h42m0s |
| 2026-09-23 15:29 UTC | drm/amdgpu: prevent parameter-space underflow in nested ATOM table calls | 2 | qwe.aldo@gmail.com | finished in 1h11m0s |
| 2026-09-23 14:50 UTC | drm/qxl: use correct offset when stamping drawable mm_time | 1 | qwe.aldo@gmail.com | finished in 4h6m0s |
| 2026-09-23 14:50 UTC | drm/amdgpu: prevent parameter-space underflow in nested ATOM table calls | 1 | qwe.aldo@gmail.com | finished in 47m0s |
| 2026-09-23 14:11 UTC | net: fec: reject oversized fragments before bounce-buffer memcpy | 1 | qwe.aldo@gmail.com | skipped |
| 2026-09-23 13:53 UTC | dmaengine: fsldma: kill the channel tasklet on remove | 1 | qwe.aldo@gmail.com | skipped |
| 2026-09-23 13:50 UTC | dmaengine: fsldma: kill the channel tasklet on remove | 1 | qwe.aldo@gmail.com | skipped |
| 2026-09-23 13:50 UTC | drm/vmwgfx: close TOCTOU on guest_memory_bo in surface reference ioctl | 1 | qwe.aldo@gmail.com | finished in 3h42m0s |
| 2026-09-23 13:49 UTC | drm/qxl: remove double page-size scaling in kmap fallback paths | 1 | qwe.aldo@gmail.com | finished in 3h23m0s |
| 2026-09-23 13:33 UTC | nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() | 1 | qwe.aldo@gmail.com | finished in 4h12m0s |
| 2026-09-23 12:26 UTC | drm/vmwgfx: do not hand the embedded sg_table to the PRIME core | 1 | qwe.aldo@gmail.com | finished in 4h1m0s |
| 2026-09-23 12:20 UTC | Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata() | 3 | qwe.aldo@gmail.com | finished in 4h5m0s |
| 2026-09-23 11:58 UTC | HID: multitouch: stop the release timer from being rearmed on remove | 1 | qwe.aldo@gmail.com | finished in 1h3m0s |
| 2026-09-23 11:58 UTC | drm/vmwgfx: return an error when a shared GB surface has no backup buffer | 2 | qwe.aldo@gmail.com | skipped |
| 2026-09-23 11:57 UTC | xfs: bound da-node entry count against the correct geometry | 2 | qwe.aldo@gmail.com | finished in 4h8m0s |
| 2026-09-23 11:57 UTC | xfs: bound inode fork length against the fork size during log recovery | 2 | qwe.aldo@gmail.com | finished in 4h5m0s |
| 2026-09-21 15:19 UTC | nilfs2: fix checkpoint root lifetime on sysfs errors | 4 | qwe.aldo@gmail.com | finished in 5h49m0s |
| 2026-09-16 23:50 UTC | nilfs2: fix checkpoint root lifetime on sysfs errors | 3 | qwe.aldo@gmail.com | skipped |
| 2026-09-15 19:57 UTC | nilfs2: validate file block counts during recovery | 2 | qwe.aldo@gmail.com | finished in 4h9m0s |
| 2026-09-15 19:52 UTC | nilfs2: validate segment number in nilfs_sufile_get_suinfo() | 2 | qwe.aldo@gmail.com | finished in 4h37m0s |
| 2026-09-15 19:49 UTC | nilfs2: fix checkpoint root lifetime on sysfs errors | 2 | qwe.aldo@gmail.com | finished in 4h18m0s |
| 2026-09-15 17:39 UTC | nfsd: use xdr_encode_opaque_fixed for all GETXATTR fragments | 1 | qwe.aldo@gmail.com | finished in 1h36m0s |
| 2026-09-15 17:30 UTC | vsock: ignore empty child namespace mode writes | 3 | qwe.aldo@gmail.com | finished in 4h14m0s |
| 2026-09-15 16:04 UTC | Bluetooth: hci_conn: fix CIS hold ownership on reuse | 1 | qwe.aldo@gmail.com | finished in 4h6m0s |
| 2026-09-15 16:03 UTC | Bluetooth: hci_sock: reject out-of-range OCF values | 1 | qwe.aldo@gmail.com | finished in 4h52m0s |
| 2026-09-15 16:03 UTC | Bluetooth: ISO: balance the parent hold in hci_bind_bis() | 1 | qwe.aldo@gmail.com | finished in 4h27m0s |
| 2026-09-15 16:03 UTC | Bluetooth: hci_sock: validate event length before filtering | 1 | qwe.aldo@gmail.com | finished in 4h39m0s |
| 2026-09-15 16:02 UTC | Bluetooth: L2CAP: validate frame length before control and FCS access | 1 | qwe.aldo@gmail.com | finished in 4h42m0s |
| 2026-09-15 16:01 UTC | nfsd: clear XDR padding in GETXATTR replies | 1 | qwe.aldo@gmail.com | finished in 2h59m0s |
| 2026-09-15 16:00 UTC | nfsd: zero NFSv4 COMPOUND tag padding | 1 | qwe.aldo@gmail.com | finished in 2h16m0s |
| 2026-09-15 16:00 UTC | NFSD: copy SETXATTR data from all XDR buffer segments | 1 | qwe.aldo@gmail.com | finished in 3h8m0s |
| 2026-09-15 15:59 UTC | Bluetooth: mgmt: fix race in read_unconf_index_list() | 2 | qwe.aldo@gmail.com | finished in 4h37m0s |
| 2026-09-15 14:15 UTC | vsock: ignore empty child namespace mode writes | 2 | qwe.aldo@gmail.com | finished in 5h3m0s |
| 2026-09-15 12:56 UTC | usb: gadget: f_printer: use the active RX list in soft reset | 1 | qwe.aldo@gmail.com | finished in 4h19m0s |
| 2026-09-15 12:56 UTC | nfsd: propagate SETXATTR value decode errors | 1 | qwe.aldo@gmail.com | finished in 1h58m0s |
| 2026-09-15 11:14 UTC | HID: wacom: avoid overflows in sequence number tracking | 1 | qwe.aldo@gmail.com | finished in 4h34m0s |
| 2026-09-15 11:14 UTC | vsock: preserve child namespace mode on an empty write | 1 | qwe.aldo@gmail.com | finished in 4h30m0s |
| 2026-09-15 11:13 UTC | nilfs2: validate file block counts during recovery | 1 | qwe.aldo@gmail.com | finished in 4h8m0s |
| 2026-09-15 11:13 UTC | nilfs2: validate segment number in nilfs_sufile_get_suinfo() | 1 | qwe.aldo@gmail.com | finished in 4h38m0s |
| 2026-09-15 04:12 UTC | HID: wacom: validate battery range before scaling | 1 | qwe.aldo@gmail.com | finished in 4h8m0s |
| 2026-09-15 04:12 UTC | HID: core: avoid signed overflow in multiplier calculation | 1 | qwe.aldo@gmail.com | finished in 4h50m0s |
| 2026-09-15 04:12 UTC | nilfs2: fix checkpoint root lifetime on sysfs errors | 1 | qwe.aldo@gmail.com | finished in 4h9m0s |
| 2026-09-15 04:11 UTC | usb: gadget: ncm: validate NDP length against the NTB | 1 | qwe.aldo@gmail.com | finished in 4h37m0s |
| 2026-09-15 04:11 UTC | usb: gadget: ncm: validate the NDP chain before parsing | 1 | qwe.aldo@gmail.com | finished in 4h15m0s |
| 2026-09-15 04:09 UTC | usb: gadget: composite: pass the validated interface index | 1 | qwe.aldo@gmail.com | finished in 4h39m0s |
| 2026-09-15 04:07 UTC | usb: gadget: configfs: zero-terminate Unicode property data | 1 | qwe.aldo@gmail.com | finished in 5h37m0s |
| 2026-09-13 22:29 UTC | drm/qxl: fix multiple missing bounds checks in execbuffer relocations | 2 | qwe.aldo@gmail.com | finished in 3h36m0s |
| 2026-08-13 02:21 UTC | net: mctp: hold a reference to the route device in mctp_route_lookup() | 1 | qwe.aldo@gmail.com | finished in 4h4m0s |
| 2026-07-16 23:26 UTC | nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() | 1 | qwe.aldo@gmail.com | finished in 5h22m0s |
| 2026-07-16 15:43 UTC | net: qrtr: restrict socket creation to the initial network namespace | 1 | qwe.aldo@gmail.com | finished in 4h58m0s |
| 2026-07-15 11:41 UTC | net/sched: serialize qdisc_rtab_list against concurrent get/put | 2 | qwe.aldo@gmail.com | finished in 4h39m0s |
| 2026-07-08 02:43 UTC | rds: drop incoming messages that cross network namespace boundaries | 1 | achender@kernel.org | finished in 4h0m0s |
| 2026-07-05 13:50 UTC | wifi: cfg80211: bound Common-Info-Length in ieee80211_mle_size_ok() | 1 | qwe.aldo@gmail.com | finished in 4h26m0s |