| Published | Title | Version | Author | Status |
|---|---|---|---|---|
| 2026-08-11 22:23 UTC | mptcp: restore full join state in syncookie MP_JOIN reconstruction | 2 | harshitvaru666@gmail.com | finished in 2h10m0s |
| 2026-08-11 21:51 UTC | mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction | 1 | harshitvaru666@gmail.com | finished in 2h4m0s |
| 2026-08-07 11:28 UTC | KVM: x86: Use active memslots for the per-vCPU MMIO cache | 1 | kimjw04271234@gmail.com | finished in 4h40m0s |
| 2026-08-01 12:56 UTC | net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers | 1 | jhs@mojatatu.com | finished in 4h13m0s |
| 2026-07-29 09:44 UTC | net/sched: cls_route: fix fastmap use-after-free on filter | 1 | jhs@mojatatu.com | finished in 4h33m0s |
| 2026-07-29 06:19 UTC | net: openvswitch: fix stack exhaustion from unaccounted clone_execute() recursion | 2 | alexyoung0@163.com | finished in 1h58m0s |
| 2026-07-28 19:04 UTC | KVM: PPC: Book3S HV: Hold KVM reference for HPT resize work | 1 | mhun512@gmail.com | finished in 33m0s |
| 2026-07-28 16:42 UTC | RISC-V: KVM: Synchronize hrtimer callback during teardown | 1 | mhun512@gmail.com | finished in 26m0s |
| 2026-07-28 09:33 UTC | KVM: x86: Cancel IOAPIC EOI work before freeing vCPUs | 1 | mhun512@gmail.com | finished in 41m0s |
| 2026-07-28 06:05 UTC | net: openvswitch: fix stack exhaustion from unaccounted clone_execute() recursion | 1 | alexyoung0@163.com | finished in 2h15m0s |
| 2026-07-24 19:24 UTC | net/sched: cls_route: fix fastmap use-after-free and preserve netns teardown ordering | 2 | jhs@mojatatu.com | finished in 5h16m0s |
| 2026-07-23 10:52 UTC | net/sched: cls_route: fix fastmap use-after-free on filter | 1 | jhs@mojatatu.com | finished in 6h4m0s |
| 2026-07-18 19:03 UTC | ufs: use u64 for directory size in ufs_last_byte | 1 | fadouse@pm.me | finished in 2h26m0s |
| 2026-07-17 15:45 UTC | io_uring/bpf-ops: reject re-registration of an already-bound ops | 1 | worapat.kd2@gmail.com | finished in 1h36m0s |
| 2026-07-11 15:05 UTC | net/sched: act_tunnel_key: Defer dst_release to RCU callback | 1 | jhs@mojatatu.com | finished in 5h21m0s |
| 2026-07-05 13:50 UTC | wifi: cfg80211: bound Common-Info-Length in ieee80211_mle_size_ok() | 1 | qwe.aldo@gmail.com | finished in 4h26m0s |
| 2026-07-01 16:19 UTC | net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload | 1 | jhs@mojatatu.com | finished in 4h49m0s |
| 2026-06-30 10:02 UTC | net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF | 4 | jhs@mojatatu.com | finished in 5h0m0s |
| 2026-06-30 07:05 UTC | af_unix: mark MSG_SPLICE_PAGES frags shared | 1 | yimingqian591@gmail.com | finished in 4h43m0s |
| 2026-06-28 11:12 UTC | net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF | 3 | jhs@mojatatu.com | finished in 4h8m0s |
| 2026-06-24 22:40 UTC | net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF | 2 | jhs@mojatatu.com | finished in 2h14m0s |
| 2026-06-23 18:42 UTC | net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF | 1 | jhs@mojatatu.com | finished in 1h52m0s |
| 2026-06-20 13:07 UTC | net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle | 1 | jhs@mojatatu.com | finished in 4h4m0s |
| 2026-06-10 10:18 UTC | net/sched: cls_flow: Dont expose folded kernel pointers | 1 | jhs@mojatatu.com | finished in 4h53m0s |
| 2026-06-10 06:21 UTC | net: skmsg: preserve sg.copy across SG transforms | 2 | yimingqian591@gmail.com | finished in 4h23m0s |
| 2026-06-04 14:46 UTC | net: add pskb_may_pull() to skb_gro_receive_list() | 1 | eilaimemedsnaimel@gmail.com | finished in 4h33m0s |
| 2026-06-04 13:40 UTC | net/tls: preserve sk_msg sg.copy when splitting records | 1 | yimingqian591@gmail.com | finished in 4h7m0s |
| 2026-05-31 16:08 UTC | net/sched: act_api: use RCU with deferred freeing for action lifecycle | 2 | jhs@mojatatu.com | finished in 4h2m0s |
| 2026-05-31 12:32 UTC | net/sched: fix pedit partial COW leading to page cache corruption | 5 | jhs@mojatatu.com | finished in 4h5m0s |
| 2026-05-30 11:55 UTC | net/sched: act_api: use RCU with deferred freeing for action lifecycle | 1 | jhs@mojatatu.com |
finished
in 4h10m0s
[2 findings] |
| 2026-05-30 08:06 UTC | net/sched: fix pedit partial COW leading to page cache corruption | 4 | jhs@mojatatu.com | finished in 4h5m0s |
| 2026-05-27 18:17 UTC | net/sched: fix pedit partial COW leading to page cache corruption | 3 | jhs@mojatatu.com | finished in 4h50m0s |
| 2026-05-26 20:32 UTC | nfc: llcp: fix integer underflow and missing bounds checks in TLV parsing | 2 | doruk@0sec.ai | skipped |
| 2026-05-26 18:37 UTC | mac802154: llsec: add skb_cow_data() before in-place crypto | 2 | doruk@0sec.ai | finished in 4h58m0s |
| 2026-05-26 15:59 UTC | net/sched: fix pedit partial COW leading to page cache corruption | 2 | jhs@mojatatu.com | finished in 4h36m0s |
| 2026-05-26 09:31 UTC | nfc: digital: clamp sensf_res memcpy to NFC_SENSF_RES_MAXSIZE | 1 | doruk@0sec.ai | skipped |
| 2026-05-26 04:12 UTC | net: skbuff: fix missing zerocopy reference in pskb_carve helpers | 2 | minhnguyen.080505@gmail.com | finished in 3h59m0s |
| 2026-05-25 20:24 UTC | nfc: llcp: fix integer underflow and missing bounds checks in TLV parsing | 1 | doruk@0sec.ai | skipped |
| 2026-05-25 20:21 UTC | nfc: llcp: fix integer underflow and missing bounds checks in TLV parsing | 1 | doruk@0sec.ai | skipped |
| 2026-05-25 16:18 UTC | mac802154: llsec: add skb_cow_data() before in-place crypto | 1 | doruk@0sec.ai | finished in 4h58m0s |
| 2026-05-21 16:53 UTC | tls: avoid zc receive for file-backed pages | 1 | iwasbaeyz@gmail.com | finished in 4h39m0s |
| 2026-05-21 12:16 UTC | net: skbuff: fix missing zerocopy reference in pskb_carve helpers | 1 | minhnguyen.080505@gmail.com | finished in 4h44m0s |
| 2026-05-15 10:42 UTC | wifi: cfg80211: validate common_info length in ieee80211_mle_size_ok() | 1 | hossu.alexandru@gmail.com | finished in 5h26m0s |
| 2026-05-12 06:07 UTC | KVM: Reject wrapped offset in kvm_reset_dirty_gfn() | 1 | contact@xchglabs.com | finished in 4h34m0s |
| 2026-05-08 00:14 UTC | sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL | 1 | joycathacker@gmail.com | finished in 4h14m0s |
| 2026-05-07 23:07 UTC | wifi: cfg80211: advance loop vars in cfg80211_merge_profile() | 1 | johnwalker0@gmail.com | finished in 4h33m0s |
| 2026-05-05 13:21 UTC | net/sched: sch_cbs: Call qdisc_reset for child qdisc | 1 | jhs@mojatatu.com | finished in 5h4m0s |
| 2026-05-01 13:51 UTC | mm/bpf_memcontrol.c: fix refcount underflow in bpf_get_root_mem_cgroup | 1 | cnrzdr.dev@gmail.com | finished in 51m0s |
| 2026-04-30 15:29 UTC | Replace direct dequeue call with qdisc_dequeue_peeked | 1 | jhs@mojatatu.com | finished in 5h0m0s |
| 2026-04-30 08:16 UTC | ipv6: flowlabel: enforce per-netns limit for unprivileged callers | 3 | maoyixie.tju@gmail.com | finished in 4h32m0s |
| 2026-04-28 11:07 UTC | ipv6: tunnel changelink: use cached netns pointer | 1 | maoyixie.tju@gmail.com | finished in 4h46m0s |
| 2026-04-26 17:26 UTC | block: fix infinite loop in badblocks_clear() and badblocks_check() | 3 | adhikari.resume@gmail.com | finished in 2h21m0s |
| 2026-04-26 17:25 UTC | bpf: Fix off-by-one boundary validation in arena direct-value access | 2 | graypanda.inzag@gmail.com | finished in 4h21m0s |
| 2026-04-26 17:11 UTC | block: fix infinite loop in badblocks_clear() | 2 | adhikari.resume@gmail.com | finished in 2h14m0s |
| 2026-04-26 15:27 UTC | bpf: Fix off-by-one boundary validation in arena direct-value access | 1 | graypanda.inzag@gmail.com | finished in 4h29m0s |
| 2026-04-26 14:55 UTC | block: fix infinite loop in badblocks_clear() | 1 | adhikari.resume@gmail.com | finished in 2h45m0s |
| 2026-04-18 11:20 UTC | net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() | 1 | patzilla007@gmail.com | finished in 4h9m0s |
| 2026-04-17 13:36 UTC | net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() | 1 | patzilla007@gmail.com | finished in 4h26m0s |
| 2026-04-17 06:07 UTC | net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() | 1 | patzilla007@gmail.com | skipped |
| 2026-04-13 14:03 UTC | jfs: fix missing bounds check in __jfs_setxattr() | 1 | sebasjosue84@gmail.com | finished in 4h50m0s |
| 2026-04-10 11:16 UTC | net/sched: act_ct: Only release RCU read lock after ct_ft | 1 | jhs@mojatatu.com | finished in 4h8m0s |
| 2026-04-07 10:21 UTC | net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo | 1 | kai.aizen.dev@gmail.com | skipped |
| 2026-04-04 10:30 UTC | nfc: nci: fix OOB heap read in nci_core_init_rsp_packet_v1() | 1 | snowwlake@icloud.com | finished in 4h27m0s |
| 2026-03-31 08:00 UTC | net/sched: sch_netem: fix out-of-bounds access in packet corruption | 2 | kanolyc@gmail.com | finished in 4h25m0s |
| 2026-03-31 07:43 UTC | net/x25: Fix overflow and double free | 4 | ms@dev.tdt.de | finished in 4h6m0s |
| 2026-03-31 07:34 UTC | netfilter: ip6t_eui64: validate MAC header before using it | 1 | n05ec@lzu.edu.cn | finished in 2h38m0s |
| 2026-03-30 21:39 UTC | netfilter: ipset: drop logically empty buckets in mtype_del | 1 | yuantan098@gmail.com | finished in 4h20m0s |
| 2026-03-30 08:46 UTC | net: ipv6: flowlabel: defer exclusive option free until RCU teardown | 1 | n05ec@lzu.edu.cn | finished in 4h22m0s |
| 2026-03-30 06:36 UTC | net/x25: Fix overflow when accumulating packets | 3 | ms@dev.tdt.de | finished in 4h1m0s |
| 2026-03-30 04:02 UTC | rxrpc: fix reference count leak in rxrpc_server_keyring() | 1 | n05ec@lzu.edu.cn | finished in 4h42m0s |
| 2026-03-29 09:54 UTC | rxrpc: reject undecryptable rxkad response tickets | 1 | n05ec@lzu.edu.cn | finished in 1h54m0s |
| 2026-03-28 21:14 UTC | net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak | 1 | echelonh@gmail.com | finished in 4h7m0s |
| 2026-03-28 14:51 UTC | netfilter: xt_multiport: reject trailing range markers | 2 | n05ec@lzu.edu.cn | finished in 4h8m0s |
| 2026-03-27 08:49 UTC | net/x25: Fix overflow when accumulating packets | 2 | ms@dev.tdt.de | finished in 24m0s |
| 2026-03-27 08:30 UTC | net/x25: Fix overflow when accumulating packets | 1 | ms@dev.tdt.de | finished in 22m0s |
| 2026-03-26 20:43 UTC | net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() | 3 | xmei5@asu.edu | finished in 4h27m0s |
| 2026-03-26 07:58 UTC | net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() | 2 | xmei5@asu.edu | finished in 4h10m0s |
| 2026-03-26 07:55 UTC | net: bonding: fix use-after-free in bond_xmit_broadcast() | 3 | xmei5@asu.edu | finished in 4h15m0s |
| 2026-03-24 22:49 UTC | net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak | 1 | echelonh@gmail.com | finished in 4h24m0s |
| 2026-03-24 22:46 UTC | wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free | 1 | alex.popov@linux.com | finished in 4h24m0s |
| 2026-03-22 07:59 UTC | ethtool: don't touch the parent device of a net device being unregistered | 1 | alex.popov@linux.com | finished in 4h8m0s |
| 2026-03-19 07:32 UTC | nfnetlink_osf: validate individual option lengths in fingerprints | 1 | bestswngs@gmail.com | finished in 4h13m0s |
| 2026-03-18 23:23 UTC | net: bonding: fix use-after-free in bond_xmit_broadcast() | 1 | xmei5@asu.edu | finished in 4h13m0s |
| 2026-03-18 13:06 UTC | icmp: fix NULL pointer dereference in icmp_tag_validation() | 1 | bestswngs@gmail.com | finished in 4h15m0s |
| 2026-03-18 03:42 UTC | wifi: mac80211: fix NULL deref in mesh_matches_local() | 1 | xmei5@asu.edu | finished in 4h11m0s |
| 2026-03-15 15:54 UTC | net/sched: teql: Fix double-free in teql_master_xmit | 1 | jhs@mojatatu.com | finished in 4h15m0s |
| 2026-03-09 15:44 UTC | io_uring/register.c: fix NULL pointer dereference in io_register_resize_rings | 2 | naup96721@gmail.com | finished in 4h17m0s |
| 2026-03-09 06:27 UTC | io_uring/register.c: fix NULL pointer dereference in io_register_resize_rings | 1 | naup96721@gmail.com | finished in 56m0s |
| 2026-03-07 21:20 UTC | net/sched: Mark qdisc for deletion if graft cannot delete | 1 | jhs@mojatatu.com | finished in 4h11m0s |
| 2026-03-06 16:01 UTC | net: add xmit recursion limit to tunnel xmit functions | 4 | bestswngs@gmail.com | finished in 4h11m0s |
| 2026-03-05 18:18 UTC | net: add xmit recursion limit to tunnel xmit functions | 3 | bestswngs@gmail.com | finished in 4h13m0s |
| 2026-03-04 04:42 UTC | net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit | 1 | bestswngs@gmail.com | finished in 1h47m0s |
| 2026-03-03 16:43 UTC | net: add xmit recursion limit to tunnel drivers | 2 | bestswngs@gmail.com | finished in 4h16m0s |
| 2026-03-03 02:29 UTC | net/core: add xmit recursion limit to qdisc transmit path | 1 | bestswngs@gmail.com | finished in 4h47m0s |
| 2026-01-31 13:21 UTC | perf/core: Fix refcount bug and potential UAF in perf_mmap | 1 | 3230100410@zju.edu.cn | finished in 3h56m0s |
| 2026-01-14 22:03 UTC | rxrpc: Fix recvmsg() unconditional requeue | 2 | dhowells@redhat.com | finished in 4h6m0s |
| 2026-01-14 16:02 UTC | net/sched: teql: Enforce hierarchy placement | 1 | jhs@mojatatu.com | finished in 4h3m0s |
| 2026-01-13 17:41 UTC | rxrpc: Fix recvmsg() unconditional requeue | 1 | dhowells@redhat.com | finished in 4h2m0s |
| 2026-01-06 03:41 UTC | net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset | 3 | xmei5@asu.edu | finished in 3h57m0s |
| 2026-01-02 01:31 UTC | net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset | 2 | xmei5@asu.edu | finished in 3h52m0s |