| Published | Title | Version | Author | Status |
|---|---|---|---|---|
| 2026-10-06 11:42 UTC | mptcp: pm: in-kernel: fix C-flag endpoint accounting on family mismatch | 1 | yimingqian591@gmail.com | finished in 4h30m0s |
| 2026-09-28 06:24 UTC | net/smc: hold a reference on net_device returned by pnet_find_base_ndev() | 1 | atharva.a.vartak@gmail.com | finished in 4h1m0s |
| 2026-09-25 12:48 UTC | net/packet: prevent TX_RING byte count overflow | 1 | ilkka.lappetelainen@gmail.com | finished in 3h43m0s |
| 2026-09-22 15:23 UTC | IB/mad: fix UAF and double-free in RMPP receive reassembly | 1 | zhangdairui@gmail.com | finished in 4h11m0s |
| 2026-09-22 11:47 UTC | IB/mad: fix UAF and double-free in RMPP receive reassembly | 1 | zhangdairui@gmail.com | finished in 3h6m0s |
| 2026-09-18 13:39 UTC | net/sched: fix potential stack infoleak in em_text_dump() | 1 | bernard.ladenthin@gmail.com | finished in 1h57m0s |
| 2026-09-12 05:39 UTC | nvmet-tcp: fix a hang on queue teardown with data digest | 2 | kumar.shivam43666@gmail.com | finished in 4h49m0s |
| 2026-09-11 22:13 UTC | KVM: unbounded per-VM kernel memory growth via KVM_SET_MEMORY_ATTRIBUTES | 3 | davimaba.v@proton.me | finished in 3h47m0s |
| 2026-09-11 18:48 UTC | KVM: unbounded per-VM kernel memory growth via KVM_SET_MEMORY_ATTRIBUTES | 1 | davimaba.v@proton.me |
finished
in 3h47m0s
[1 findings] |
| 2026-09-09 12:44 UTC | nitro_enclaves: fix use-after-free on SLOT_ALLOC failure | 1 | graf@amazon.com | skipped |
| 2026-09-04 16:27 UTC | bpf: fix dangling jump table entries for verified indirect jump targets | 1 | saroy@redhat.com | finished in 10m0s |
| 2026-09-04 15:51 UTC | bpf: fix dangling jump table entries for verified indirect jump targets | 1 | saroy@redhat.com | skipped |
| 2026-08-30 07:33 UTC | ublk: clear VM_MAYWRITE on read-only ublk char device mmap | 2 | kpskanna1915@gmail.com | finished in 2h32m0s |
| 2026-08-27 21:32 UTC | sctp: validate chunk length in the inqueue parser | 2 | devnull@kernel.org | finished in 3h49m0s |
| 2026-08-27 01:01 UTC | sctp: validate chunk length in the inqueue parser | 1 | devnull@kernel.org | finished in 3h45m0s |
| 2026-08-11 22:23 UTC | mptcp: restore full join state in syncookie MP_JOIN reconstruction | 2 | harshitvaru666@gmail.com | finished in 2h10m0s |
| 2026-08-11 21:51 UTC | mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction | 1 | harshitvaru666@gmail.com | finished in 2h4m0s |
| 2026-08-07 11:28 UTC | KVM: x86: Use active memslots for the per-vCPU MMIO cache | 1 | kimjw04271234@gmail.com | finished in 4h40m0s |
| 2026-08-01 12:56 UTC | net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers | 1 | jhs@mojatatu.com | finished in 4h13m0s |
| 2026-07-29 09:44 UTC | net/sched: cls_route: fix fastmap use-after-free on filter | 1 | jhs@mojatatu.com | finished in 4h33m0s |
| 2026-07-29 06:19 UTC | net: openvswitch: fix stack exhaustion from unaccounted clone_execute() recursion | 2 | alexyoung0@163.com | finished in 1h58m0s |
| 2026-07-28 19:04 UTC | KVM: PPC: Book3S HV: Hold KVM reference for HPT resize work | 1 | mhun512@gmail.com | finished in 33m0s |
| 2026-07-28 16:42 UTC | RISC-V: KVM: Synchronize hrtimer callback during teardown | 1 | mhun512@gmail.com | finished in 26m0s |
| 2026-07-28 09:33 UTC | KVM: x86: Cancel IOAPIC EOI work before freeing vCPUs | 1 | mhun512@gmail.com | finished in 41m0s |
| 2026-07-28 06:05 UTC | net: openvswitch: fix stack exhaustion from unaccounted clone_execute() recursion | 1 | alexyoung0@163.com | finished in 2h15m0s |
| 2026-07-24 19:24 UTC | net/sched: cls_route: fix fastmap use-after-free and preserve netns teardown ordering | 2 | jhs@mojatatu.com | finished in 5h16m0s |
| 2026-07-23 10:52 UTC | net/sched: cls_route: fix fastmap use-after-free on filter | 1 | jhs@mojatatu.com | finished in 6h4m0s |
| 2026-07-18 19:03 UTC | ufs: use u64 for directory size in ufs_last_byte | 1 | fadouse@pm.me | finished in 2h26m0s |
| 2026-07-17 15:45 UTC | io_uring/bpf-ops: reject re-registration of an already-bound ops | 1 | worapat.kd2@gmail.com | finished in 1h36m0s |
| 2026-07-11 15:05 UTC | net/sched: act_tunnel_key: Defer dst_release to RCU callback | 1 | jhs@mojatatu.com | finished in 5h21m0s |
| 2026-07-05 13:50 UTC | wifi: cfg80211: bound Common-Info-Length in ieee80211_mle_size_ok() | 1 | qwe.aldo@gmail.com | finished in 4h26m0s |
| 2026-07-01 16:19 UTC | net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload | 1 | jhs@mojatatu.com | finished in 4h49m0s |
| 2026-06-30 10:02 UTC | net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF | 4 | jhs@mojatatu.com | finished in 5h0m0s |
| 2026-06-30 07:05 UTC | af_unix: mark MSG_SPLICE_PAGES frags shared | 1 | yimingqian591@gmail.com | finished in 4h43m0s |
| 2026-06-28 11:12 UTC | net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF | 3 | jhs@mojatatu.com | finished in 4h8m0s |
| 2026-06-24 22:40 UTC | net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF | 2 | jhs@mojatatu.com | finished in 2h14m0s |
| 2026-06-23 18:42 UTC | net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF | 1 | jhs@mojatatu.com | finished in 1h52m0s |
| 2026-06-20 13:07 UTC | net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle | 1 | jhs@mojatatu.com | finished in 4h4m0s |
| 2026-06-10 10:18 UTC | net/sched: cls_flow: Dont expose folded kernel pointers | 1 | jhs@mojatatu.com | finished in 4h53m0s |
| 2026-06-10 06:21 UTC | net: skmsg: preserve sg.copy across SG transforms | 2 | yimingqian591@gmail.com | finished in 4h23m0s |
| 2026-06-04 14:46 UTC | net: add pskb_may_pull() to skb_gro_receive_list() | 1 | eilaimemedsnaimel@gmail.com | finished in 4h33m0s |
| 2026-06-04 13:40 UTC | net/tls: preserve sk_msg sg.copy when splitting records | 1 | yimingqian591@gmail.com | finished in 4h7m0s |
| 2026-05-31 16:08 UTC | net/sched: act_api: use RCU with deferred freeing for action lifecycle | 2 | jhs@mojatatu.com | finished in 4h2m0s |
| 2026-05-31 12:32 UTC | net/sched: fix pedit partial COW leading to page cache corruption | 5 | jhs@mojatatu.com | finished in 4h5m0s |
| 2026-05-30 11:55 UTC | net/sched: act_api: use RCU with deferred freeing for action lifecycle | 1 | jhs@mojatatu.com |
finished
in 4h10m0s
[2 findings] |
| 2026-05-30 08:06 UTC | net/sched: fix pedit partial COW leading to page cache corruption | 4 | jhs@mojatatu.com | finished in 4h5m0s |
| 2026-05-27 18:17 UTC | net/sched: fix pedit partial COW leading to page cache corruption | 3 | jhs@mojatatu.com | finished in 4h50m0s |
| 2026-05-26 20:32 UTC | nfc: llcp: fix integer underflow and missing bounds checks in TLV parsing | 2 | doruk@0sec.ai | skipped |
| 2026-05-26 18:37 UTC | mac802154: llsec: add skb_cow_data() before in-place crypto | 2 | doruk@0sec.ai | finished in 4h58m0s |
| 2026-05-26 15:59 UTC | net/sched: fix pedit partial COW leading to page cache corruption | 2 | jhs@mojatatu.com | finished in 4h36m0s |
| 2026-05-26 09:31 UTC | nfc: digital: clamp sensf_res memcpy to NFC_SENSF_RES_MAXSIZE | 1 | doruk@0sec.ai | skipped |
| 2026-05-26 04:12 UTC | net: skbuff: fix missing zerocopy reference in pskb_carve helpers | 2 | minhnguyen.080505@gmail.com | finished in 3h59m0s |
| 2026-05-25 20:24 UTC | nfc: llcp: fix integer underflow and missing bounds checks in TLV parsing | 1 | doruk@0sec.ai | skipped |
| 2026-05-25 20:21 UTC | nfc: llcp: fix integer underflow and missing bounds checks in TLV parsing | 1 | doruk@0sec.ai | skipped |
| 2026-05-25 16:18 UTC | mac802154: llsec: add skb_cow_data() before in-place crypto | 1 | doruk@0sec.ai | finished in 4h58m0s |
| 2026-05-21 16:53 UTC | tls: avoid zc receive for file-backed pages | 1 | iwasbaeyz@gmail.com | finished in 4h39m0s |
| 2026-05-21 12:16 UTC | net: skbuff: fix missing zerocopy reference in pskb_carve helpers | 1 | minhnguyen.080505@gmail.com | finished in 4h44m0s |
| 2026-05-15 10:42 UTC | wifi: cfg80211: validate common_info length in ieee80211_mle_size_ok() | 1 | hossu.alexandru@gmail.com | finished in 5h26m0s |
| 2026-05-12 06:07 UTC | KVM: Reject wrapped offset in kvm_reset_dirty_gfn() | 1 | contact@xchglabs.com | finished in 4h34m0s |
| 2026-05-08 00:14 UTC | sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL | 1 | joycathacker@gmail.com | finished in 4h14m0s |
| 2026-05-07 23:07 UTC | wifi: cfg80211: advance loop vars in cfg80211_merge_profile() | 1 | johnwalker0@gmail.com | finished in 4h33m0s |
| 2026-05-05 13:21 UTC | net/sched: sch_cbs: Call qdisc_reset for child qdisc | 1 | jhs@mojatatu.com | finished in 5h4m0s |
| 2026-05-01 13:51 UTC | mm/bpf_memcontrol.c: fix refcount underflow in bpf_get_root_mem_cgroup | 1 | cnrzdr.dev@gmail.com | finished in 51m0s |
| 2026-04-30 15:29 UTC | Replace direct dequeue call with qdisc_dequeue_peeked | 1 | jhs@mojatatu.com | finished in 5h0m0s |
| 2026-04-30 08:16 UTC | ipv6: flowlabel: enforce per-netns limit for unprivileged callers | 3 | maoyixie.tju@gmail.com | finished in 4h32m0s |
| 2026-04-28 11:07 UTC | ipv6: tunnel changelink: use cached netns pointer | 1 | maoyixie.tju@gmail.com | finished in 4h46m0s |
| 2026-04-26 17:26 UTC | block: fix infinite loop in badblocks_clear() and badblocks_check() | 3 | adhikari.resume@gmail.com | finished in 2h21m0s |
| 2026-04-26 17:25 UTC | bpf: Fix off-by-one boundary validation in arena direct-value access | 2 | graypanda.inzag@gmail.com | finished in 4h21m0s |
| 2026-04-26 17:11 UTC | block: fix infinite loop in badblocks_clear() | 2 | adhikari.resume@gmail.com | finished in 2h14m0s |
| 2026-04-26 15:27 UTC | bpf: Fix off-by-one boundary validation in arena direct-value access | 1 | graypanda.inzag@gmail.com | finished in 4h29m0s |
| 2026-04-26 14:55 UTC | block: fix infinite loop in badblocks_clear() | 1 | adhikari.resume@gmail.com | finished in 2h45m0s |
| 2026-04-18 11:20 UTC | net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() | 1 | patzilla007@gmail.com | finished in 4h9m0s |
| 2026-04-17 13:36 UTC | net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() | 1 | patzilla007@gmail.com | finished in 4h26m0s |
| 2026-04-17 06:07 UTC | net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() | 1 | patzilla007@gmail.com | skipped |
| 2026-04-13 14:03 UTC | jfs: fix missing bounds check in __jfs_setxattr() | 1 | sebasjosue84@gmail.com | finished in 4h50m0s |
| 2026-04-10 11:16 UTC | net/sched: act_ct: Only release RCU read lock after ct_ft | 1 | jhs@mojatatu.com | finished in 4h8m0s |
| 2026-04-07 10:21 UTC | net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo | 1 | kai.aizen.dev@gmail.com | skipped |
| 2026-04-04 10:30 UTC | nfc: nci: fix OOB heap read in nci_core_init_rsp_packet_v1() | 1 | snowwlake@icloud.com | finished in 4h27m0s |
| 2026-03-31 08:00 UTC | net/sched: sch_netem: fix out-of-bounds access in packet corruption | 2 | kanolyc@gmail.com | finished in 4h25m0s |
| 2026-03-31 07:43 UTC | net/x25: Fix overflow and double free | 4 | ms@dev.tdt.de | finished in 4h6m0s |
| 2026-03-31 07:34 UTC | netfilter: ip6t_eui64: validate MAC header before using it | 1 | n05ec@lzu.edu.cn | finished in 2h38m0s |
| 2026-03-30 21:39 UTC | netfilter: ipset: drop logically empty buckets in mtype_del | 1 | yuantan098@gmail.com | finished in 4h20m0s |
| 2026-03-30 08:46 UTC | net: ipv6: flowlabel: defer exclusive option free until RCU teardown | 1 | n05ec@lzu.edu.cn | finished in 4h22m0s |
| 2026-03-30 06:36 UTC | net/x25: Fix overflow when accumulating packets | 3 | ms@dev.tdt.de | finished in 4h1m0s |
| 2026-03-30 04:02 UTC | rxrpc: fix reference count leak in rxrpc_server_keyring() | 1 | n05ec@lzu.edu.cn | finished in 4h42m0s |
| 2026-03-29 09:54 UTC | rxrpc: reject undecryptable rxkad response tickets | 1 | n05ec@lzu.edu.cn | finished in 1h54m0s |
| 2026-03-28 21:14 UTC | net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak | 1 | echelonh@gmail.com | finished in 4h7m0s |
| 2026-03-28 14:51 UTC | netfilter: xt_multiport: reject trailing range markers | 2 | n05ec@lzu.edu.cn | finished in 4h8m0s |
| 2026-03-27 08:49 UTC | net/x25: Fix overflow when accumulating packets | 2 | ms@dev.tdt.de | finished in 24m0s |
| 2026-03-27 08:30 UTC | net/x25: Fix overflow when accumulating packets | 1 | ms@dev.tdt.de | finished in 22m0s |
| 2026-03-26 20:43 UTC | net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() | 3 | xmei5@asu.edu | finished in 4h27m0s |
| 2026-03-26 07:58 UTC | net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() | 2 | xmei5@asu.edu | finished in 4h10m0s |
| 2026-03-26 07:55 UTC | net: bonding: fix use-after-free in bond_xmit_broadcast() | 3 | xmei5@asu.edu | finished in 4h15m0s |
| 2026-03-24 22:49 UTC | net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak | 1 | echelonh@gmail.com | finished in 4h24m0s |
| 2026-03-24 22:46 UTC | wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free | 1 | alex.popov@linux.com | finished in 4h24m0s |
| 2026-03-22 07:59 UTC | ethtool: don't touch the parent device of a net device being unregistered | 1 | alex.popov@linux.com | finished in 4h8m0s |
| 2026-03-19 07:32 UTC | nfnetlink_osf: validate individual option lengths in fingerprints | 1 | bestswngs@gmail.com | finished in 4h13m0s |
| 2026-03-18 23:23 UTC | net: bonding: fix use-after-free in bond_xmit_broadcast() | 1 | xmei5@asu.edu | finished in 4h13m0s |
| 2026-03-18 13:06 UTC | icmp: fix NULL pointer dereference in icmp_tag_validation() | 1 | bestswngs@gmail.com | finished in 4h15m0s |
| 2026-03-18 03:42 UTC | wifi: mac80211: fix NULL deref in mesh_matches_local() | 1 | xmei5@asu.edu | finished in 4h11m0s |