| 2026-11-04 12:53 UTC |
usb: gadget: f_uac1_legacy: fix copy_buf lifetime on queue handoff and free |
4 |
tristmd@gmail.com |
-
|
| 2026-11-04 11:45 UTC |
usb: gadget: f_uac1_legacy: cancel playback work and drain buffers on free |
3 |
tristmd@gmail.com |
in progress
|
| 2026-11-04 11:04 UTC |
wifi: wfx: validate num_tx_confs in rx_helper before use |
2 |
tristmd@gmail.com |
skipped
|
| 2026-11-04 01:42 UTC |
media: v4l2-mem2mem: cancel job_work in v4l2_m2m_release |
2 |
tristmd@gmail.com |
finished
in 5h23m0s
|
| 2026-11-04 01:28 UTC |
usb: gadget: f_uac1_legacy: cancel playback_work and drain buffers on free |
2 |
tristmd@gmail.com |
finished
in 3h10m0s
|
| 2026-11-04 00:02 UTC |
usb: gadget: f_uac1_legacy: cancel playback_work before freeing audio |
1 |
tristmd@gmail.com |
finished
in 2h48m0s
|
| 2026-11-03 23:26 UTC |
wifi: wfx: validate num_tx_confs against message length |
1 |
tristmd@gmail.com |
skipped
|
| 2026-11-03 22:54 UTC |
tipc: fix division by zero in perc() |
1 |
tristmd@gmail.com |
finished
in 4h24m0s
|
| 2026-11-02 22:16 UTC |
wifi: libertas_tf: use timer_delete_sync() in lbtf_remove_card() |
1 |
tristmd@gmail.com |
finished
in 1h55m0s
|
| 2026-11-02 22:15 UTC |
wifi: mwifiex: zero-pad SDIO TX buffer to block-aligned transfer length |
1 |
tristmd@gmail.com |
skipped
|
| 2026-11-02 19:17 UTC |
wifi: mwifiex: cancel DFS delayed works before destroying workqueues |
1 |
tristmd@gmail.com |
finished
in 2h24m0s
|
| 2026-11-02 19:17 UTC |
wifi: mt76: mt7615: cancel coredump delayed work on device unregister |
1 |
tristmd@gmail.com |
finished
in 2h23m0s
|
| 2026-11-02 18:18 UTC |
platform/x86: toshiba_acpi: validate ACPI object type in tci_raw() |
1 |
tristmd@gmail.com |
skipped
|
| 2026-11-02 16:53 UTC |
ASoC: cancel pending delayed works on codec removal |
6 |
tristmd@gmail.com |
skipped
|
| 2026-11-02 15:53 UTC |
padata: fix lockdep warning in padata_find_next() |
1 |
tristmd@gmail.com |
finished
in 3h29m0s
|
| 2026-11-02 15:53 UTC |
can: j1939: fix skb refcount underflow in session teardown paths |
1 |
tristmd@gmail.com |
finished
in 4h31m0s
|
| 2026-11-02 15:45 UTC |
media: dvbdev: fix dangling minor pointer in dvb_register_device() error paths |
1 |
tristmd@gmail.com |
finished
in 4h59m0s
|
| 2026-11-02 13:59 UTC |
wifi: mwifiex: validate firmware response sizes |
1 |
tristmd@gmail.com |
finished
in 1h52m0s
|
| 2026-11-02 13:46 UTC |
platform/x86: acer-wmi: validate ACPI object type in acer_gsensor_event() |
1 |
tristmd@gmail.com |
skipped
|
| 2026-11-02 12:48 UTC |
wifi: nxpwifi: validate firmware response sizes |
1 |
tristmd@gmail.com |
skipped
|
| 2026-11-02 12:23 UTC |
wifi: zero-pad SDIO writes to avoid leaking heap data |
1 |
tristmd@gmail.com |
skipped
|
| 2026-11-01 21:51 UTC |
wifi: mwifiex: firmware response validation fixes (WMM + sta_list) |
1 |
tristmd@gmail.com |
finished
in 2h5m0s
|
| 2026-11-01 20:58 UTC |
wifi: mwifiex: firmware response validation fixes |
1 |
tristmd@gmail.com |
finished
in 1h23m0s
|
| 2026-11-01 20:47 UTC |
Bluetooth: hci_bcm4377: validate completion ring entry data length |
1 |
tristmd@gmail.com |
skipped
|
| 2026-11-01 20:38 UTC |
wifi: wilc1000: add bounds checking for firmware-supplied fields |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-30 19:32 UTC |
RDMA/rxe: copy send WQE to kernel buffer (TOCTOU hardening) |
10 |
tristmd@gmail.com |
finished
in 4h28m0s
|
| 2026-10-30 18:34 UTC |
RDMA/rxe: copy send WQE to kernel buffer (TOCTOU hardening) |
9 |
tristmd@gmail.com |
finished
in 4h16m0s
|
| 2026-10-30 17:48 UTC |
ASoC: cancel pending delayed works on codec removal |
5 |
tristmd@gmail.com |
skipped
|
| 2026-10-30 17:04 UTC |
ASoC: cancel pending delayed works on codec removal |
4 |
tristmd@gmail.com |
skipped
|
| 2026-10-30 16:50 UTC |
RDMA/rxe: copy send WQE to kernel buffer before processing |
8 |
tristmd@gmail.com |
finished
in 4h1m0s
|
| 2026-10-30 15:41 UTC |
ASoC: cancel pending delayed works on codec removal |
3 |
tristmd@gmail.com |
skipped
|
| 2026-10-30 14:52 UTC |
xfrm: check state validity under lock in xfrm_state_find() |
2 |
tristmd@gmail.com |
finished
in 4h44m0s
|
| 2026-10-30 11:20 UTC |
can: peak_usb: fix use-after-free on PCAN-USB disconnect |
3 |
tristmd@gmail.com |
finished
in 4h8m0s
|
| 2026-10-29 21:25 UTC |
ASoC: cancel pending delayed works on codec removal |
2 |
tristmd@gmail.com |
skipped
|
| 2026-10-29 17:08 UTC |
drm/radeon: validate ATRM return buffer type and length |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-29 16:24 UTC |
nfc: llcp: use disable_work_sync and timer_shutdown_sync in local_cleanup |
2 |
tristmd@gmail.com |
finished
in 4h40m0s
|
| 2026-10-29 14:10 UTC |
HID: intel-thc-hid: validate ACPI buffer lengths |
3 |
tristmd@gmail.com |
skipped
|
| 2026-10-29 10:57 UTC |
ASoC: wm8994: drain delayed works on remove and probe error |
10 |
tristmd@gmail.com |
skipped
|
| 2026-10-29 10:25 UTC |
ASoC: wm8994: drain delayed works on remove and probe error |
9 |
tristmd@gmail.com |
skipped
|
| 2026-10-29 00:55 UTC |
ASoC: rt5659: cancel jack_detect_work on component remove |
9 |
tristmd@gmail.com |
skipped
|
| 2026-10-28 17:09 UTC |
media: saa7164: cancel workcmd after disabling IRQ in saa7164_finidev |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-28 01:26 UTC |
wifi: nxpwifi: validate scan response TLV sizes before indexed access |
2 |
tristmd@gmail.com |
skipped
|
| 2026-10-27 00:29 UTC |
Input: applespi - validate ACPI property buffer length |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-26 23:09 UTC |
iio: adc: pac1934: validate ACPI _DSM return type and bounds |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-26 23:01 UTC |
nfsd: pin client reference across async copy reaper cleanup |
1 |
tristmd@gmail.com |
finished
in 3h53m0s
|
| 2026-10-26 14:20 UTC |
iio: validate ACPI object types before package access |
2 |
tristmd@gmail.com |
skipped
|
| 2026-10-26 11:22 UTC |
ASoC: cancel pending delayed works on component remove |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-26 11:21 UTC |
wifi: carl9170: fix IE parsing loop bounds check |
1 |
tristmd@gmail.com |
finished
in 1h58m0s
|
| 2026-10-25 21:40 UTC |
HID: intel-thc-hid: validate ACPI buffer length before memcpy |
3 |
tristmd@gmail.com |
skipped
|
| 2026-10-25 21:02 UTC |
can: peak_usb: fix use-after-free on PCAN-USB disconnect and init failure |
2 |
tristmd@gmail.com |
finished
in 4h5m0s
|
| 2026-10-25 18:19 UTC |
wifi: wilc1000: zero-pad SDIO write buffer to block-aligned length |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-25 18:15 UTC |
wifi: nxpwifi: validate scan response TLV sizes before indexed access |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-25 18:11 UTC |
wifi: mwifiex: validate scan response TLV sizes before indexed access |
1 |
tristmd@gmail.com |
finished
in 2h0m0s
|
| 2026-10-25 18:07 UTC |
wifi: rsi: shut down roc_timer before freeing mac80211 hardware |
1 |
tristmd@gmail.com |
finished
in 1h46m0s
|
| 2026-10-25 18:03 UTC |
iio: light: cm32181: validate ACPI object type in cm32181_acpi_get_cpm() |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-25 15:47 UTC |
HID: intel-thc-hid: validate ACPI buffer length before memcpy |
2 |
tristmd@gmail.com |
skipped
|
| 2026-10-24 20:59 UTC |
Bluetooth: btintel: validate PPAG table element types |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-24 20:58 UTC |
HID: intel-thc-hid: validate ACPI buffer length before use |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-24 20:57 UTC |
drm/nouveau/disp/r535: validate ACPI backlight DSM return type |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-24 20:57 UTC |
media: v4l2-mem2mem: cancel job_work in v4l2_m2m_release |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-24 20:55 UTC |
platform/x86: hp-wmi: validate WMI return buffer length |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-23 19:59 UTC |
platform/x86: acer-wmi: validate ACPI object type in acer_gsensor_event() |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-23 19:59 UTC |
media: dvbdev: fix dangling minor pointer in dvb_register_device() error paths |
1 |
tristmd@gmail.com |
finished
in 4h10m0s
|
| 2026-10-23 19:54 UTC |
nfc: llcp: use timer_shutdown_sync to prevent timer rearm |
1 |
tristmd@gmail.com |
finished
in 57m0s
|
| 2026-10-23 19:54 UTC |
can: peak_usb: add missing dev_free callback to cancel restart_timer |
1 |
tristmd@gmail.com |
finished
in 4h30m0s
|
| 2026-10-23 19:53 UTC |
xfrm: fix output state cache TOCTOU in xfrm_state_find() |
1 |
tristmd@gmail.com |
finished
in 4h30m0s
|
| 2026-10-23 19:53 UTC |
ppp: fix stale pointer access after pskb_may_pull in ppp_ccp_peek |
1 |
tristmd@gmail.com |
finished
in 4h39m0s
|
| 2026-10-23 19:52 UTC |
seg6: fix tun_src RCU lifetime on namespace teardown |
1 |
tristmd@gmail.com |
finished
in 4h0m0s
|
| 2026-10-20 15:41 UTC |
extcon: cancel wq_detcable delayed work on driver unbind |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-19 22:56 UTC |
s390/tape: cancel delayed work on device removal |
2 |
tristmd@gmail.com |
skipped
|
| 2026-10-19 22:26 UTC |
cpufreq: intel_pstate: cancel HWP notify work in driver cleanup |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-19 20:34 UTC |
s390/tape: cancel delayed work before freeing device |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-19 19:33 UTC |
scsi: ppa: cancel delayed work before freeing on detach |
2 |
tristmd@gmail.com |
skipped
|
| 2026-10-19 16:38 UTC |
scsi: ppa: cancel delayed work before freeing on detach |
1 |
tristmd@gmail.com |
skipped
|
| 2026-10-19 10:38 UTC |
USB: serial: sierra: validate URB length in instat callback |
2 |
tristmd@gmail.com |
finished
in 4h1m0s
|
| 2026-10-18 22:54 UTC |
media: USB: validate transfer lengths in URB callbacks |
1 |
tristmd@gmail.com |
finished
in 1h58m0s
|
| 2026-10-18 22:33 UTC |
USB: serial: sierra: validate URB length in instat callback |
1 |
tristmd@gmail.com |
finished
in 4h29m0s
|
| 2026-10-13 23:43 UTC |
netfilter: pin file with get_file_rcu() before reading f_cred |
1 |
tristmd@gmail.com |
finished
in 5h1m0s
[7 findings]
|
| 2026-10-08 09:37 UTC |
RDMA/rxe: fix send-path TOCTOU races on shared WQEs |
5 |
tristmd@gmail.com |
finished
in 4h1m0s
|
| 2026-10-07 21:27 UTC |
RDMA/rxe: Fix TOCTOU races on mmap'd send queue |
3 |
tristmd@gmail.com |
finished
in 4h9m0s
|
| 2026-10-07 16:28 UTC |
HID: core: fix device cleanup on allocation failure |
2 |
tristmd@gmail.com |
finished
in 1h15m0s
|
| 2026-10-07 16:17 UTC |
wifi: rtw89: fix IE length passed to cfg80211_find_ie() |
2 |
tristmd@gmail.com |
skipped
|
| 2026-09-04 08:49 UTC |
wifi: rtlwifi: fix OOB reads in IE parsing functions |
1 |
tristmd@gmail.com |
skipped
|
| 2026-09-04 08:05 UTC |
HID: core: fix device cleanup on allocation failure |
1 |
tristmd@gmail.com |
finished
in 1h18m0s
|
| 2026-09-02 12:30 UTC |
net: reduce XMIT_RECURSION_LIMIT under KASAN |
4 |
tristmd@gmail.com |
skipped
|
| 2026-08-30 14:31 UTC |
wifi: rtw89: fix OOB read in rtw89_core_cancel_6ghz_probe_tx() |
1 |
tristmd@gmail.com |
finished
in 1h40m0s
|
| 2026-08-30 14:23 UTC |
net: devmem: add missing permission check for bind-tx |
1 |
tristmd@gmail.com |
finished
in 2h49m0s
|
| 2026-08-16 13:55 UTC |
ice: fix metadata_dst refcount handling on representor teardown |
1 |
tristmd@gmail.com |
skipped
|
| 2026-08-15 13:52 UTC |
wifi: mwifiex: validate scan response extents |
2 |
pengpeng@iscas.ac.cn |
finished
in 46m0s
|
| 2026-07-27 20:04 UTC |
net: reduce XMIT_RECURSION_LIMIT under KASAN |
3 |
tristmd@gmail.com |
skipped
|
| 2026-07-11 20:47 UTC |
net: reduce XMIT_RECURSION_LIMIT under KASAN |
2 |
tristmd@gmail.com |
finished
in 4h59m0s
|
| 2026-07-11 13:47 UTC |
ipvlan: add xmit recursion protection |
1 |
tristmd@gmail.com |
finished
in 5h34m0s
|
| 2026-07-02 00:50 UTC |
wifi: ath6kl: fix OOB access from firmware ADDBA window size |
5 |
tristmd@gmail.com |
finished
in 1h41m0s
|
| 2026-06-26 00:04 UTC |
wifi: ath6kl: fix OOB access from firmware ADDBA window size |
4 |
tristmd@gmail.com |
finished
in 55m0s
|
| 2026-06-22 23:01 UTC |
Fix stale register bounds on LSM retval context load |
3 |
tristmd@gmail.com |
finished
in 4h7m0s
|
| 2026-06-19 12:00 UTC |
fuse: check fi is not NULL before calling fuse_passthrough_release() |
1 |
tristmd@gmail.com |
finished
in 4h25m0s
|
| 2026-06-19 11:02 UTC |
bpf: Reset register bounds before narrowing retval range in check_mem_access() |
2 |
tristmd@gmail.com |
finished
in 4h2m0s
|
| 2026-06-17 12:08 UTC |
bpf: Reset register bounds before narrowing retval range in check_mem_access() |
1 |
tristmd@gmail.com |
finished
in 5h2m0s
|
| 2026-06-02 17:16 UTC |
xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state() |
2 |
tristmd@gmail.com |
finished
in 1h47m0s
|
| 2026-05-28 16:08 UTC |
net: shaper: use kfree_rcu() in net_shaper_flush() |
1 |
tristmd@gmail.com |
finished
in 4h38m0s
|