p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости linux-nvidia-bos · Страница 196

За последние 30 дней в linux-nvidia-bos опубликовано уязвимостей: 834; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 6090

  1. CVE-2026-72285

    Высокий · CVSS 7.8EPSS 0,17%Есть исправление

    KVM: TDX: Reject concurrent change to CPUID entry count

    In the Linux kernel, the following vulnerability has been resolved: KVM: TDX: Reject concurrent change to CPUID entry count Reject KVM_TDX_INIT_VM if userspace changes cpuid.nent between the initial read and the subsequent copy of the initialization data. tdx_td_init() first reads user_data->cpuid.nent to size the flexible kvm_tdx_init_vm copy. The copied structure also contains cpuid.nent, and that field can differ from the value used to size the allocation if userspace modifies the input concurrently. setup_tdparams_cpuids() later passes init_vm->cpuid.nent to kvm_find_cpuid_entry2(), which uses it as the array bound for the copied ent

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  2. CVE-2026-72284

    Высокий · CVSS 7.1EPSS 0,19%Есть исправление

    KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e. if pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables PV EOIs. kernel BUG at arch/x86/kvm/lapic.c:3338! Oops: invalid opcode: 0000 [#1] SMP CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT Hardware name: QEMU Standard P

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  3. CVE-2026-72283

    Высокий · CVSS 8.8EPSS 0,18%Есть исправление

    KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails Nullify irqfd->producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM's routing, but the producer is freed separately. E.g. for VFIO PCI, the producer is embedded in struct "vfio_pci_irq_ctx" and freed when the vector is disabled, which can happen independent of routing updates. [sean: drop PPC change, massage changelog]

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  4. CVE-2026-72282

    Высокий · CVSS 7.8EPSS 0,18%Есть исправление

    KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers

    In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers kvm_io_bus_get_dev() returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, as by the time the caller can introspect the object, it might be gone (the srcu lock having been dropped). Given that there is only a single user of this helper, the simplest option is to move the locking responsibility to the caller, which can keep the srcu lock held for as long as it wants. Note that this aligns with other kvm_io_bus*

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  5. CVE-2026-72280

    Высокий · CVSS 7.1EPSS 0,19%Есть исправление

    KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 It is entirely possible for a guest to write to the ZCR_EL2 sysreg alias while in a nested context, as it is expected if FEAT_NV2 is advertised to the L1 hypervisor. Get rid of the bogus WARN which, since the hyp vectors were installed at this point, has the effect of a hyp_panic...

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  6. CVE-2026-72279

    Критический · CVSS 9EPSS 0,19%Есть исправление

    KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backing PFN is read-only (e.g. RO memslot), meaning that the L1 VNCR should use at most a read-only mapping. Cache the writability of the PFN in the VNCR TLB and use it to constrain the resulting fixmap permissions. Promote VNCR permission faults to an SEA in the case where the guest attempts to write to a read-only endpoint. Conveniently, this also plu

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  7. CVE-2026-72278

    Критический · CVSS 9.3EPSS 0,19%Есть исправление

    KVM: arm64: nv: Re-translate VNCR before injecting abort

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the guest reads from the VNCR before writing to it, in which case the PFN could only be read-only. Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR abort, allowing the host mapping to be faulted in for write the second time around. Interestingly enough, this also satisfies the ordering requirements of FEAT_ETS2/3 between descriptor

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  8. CVE-2026-72277

    Критический · CVSS 9.3EPSS 0,19%Есть исправление

    KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the endpoint doesn't support cacheable memory attributes, potentially throwing an SError on writeback... While KVM does permit cacheable memory attributes on certain PFNMAP VMAs, kvm_translate_vncr() isn't currently grabbing the VMA. So do the simpler thing for now and just reject everything that isn't memory.

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  9. CVE-2026-72276

    Без оценкиEPSS 0,21%Есть исправление

    fbdev: metronomefb: fix potential memory leak in metronomefb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: metronomefb: fix potential memory leak in metronomefb_probe() The memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. Fix it by calling fb_deferred_io_cleanup().

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  10. CVE-2026-72275

    Без оценкиEPSS 0,21%Есть исправление

    fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() The memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. Fix it by calling fb_deferred_io_cleanup().

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  11. CVE-2026-72274

    Без оценкиEPSS 0,21%Есть исправление

    fbdev: hecubafb: fix potential memory leak in hecubafb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: hecubafb: fix potential memory leak in hecubafb_probe() The memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. Fix it by calling fb_deferred_io_cleanup().

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  12. CVE-2026-72273

    Без оценкиEPSS 0,21%Есть исправление

    fbdev: efifb: fix memory leak in efifb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: efifb: fix memory leak in efifb_probe() Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership") the string returned from fb_get_options() is expected to be freed by the caller, but the string is not freed in efifb_probe(). Fix that by freeing the option string after setup.

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  13. CVE-2026-72272

    Без оценкиEPSS 0,22%Есть исправление

    fbdev: radeon: fix potential memory leak in radeonfb_pci_register()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: radeon: fix potential memory leak in radeonfb_pci_register() The function radeonfb_pci_register() allocates memory for modelist (by calling radeon_check_modes() which calls fb_add_videomode()). The memory is appended to info->modelist, but is not freed in subsequent error paths. Fix this by calling fb_destroy_modelist().

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  14. CVE-2026-72271

    Без оценкиEPSS 0,22%Есть исправление

    fbdev: i740fb: fix potential memory leak in i740fb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: i740fb: fix potential memory leak in i740fb_probe() In i740fb_probe(), the memory allocated in fb_videomode_to_modelist() for modelist is not freed in the error paths. Fix that by calling fb_destroy_modelist().

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  15. CVE-2026-72270

    Без оценкиEPSS 0,22%Есть исправление

    fbdev: s3fb: fix potential memory leak in s3_pci_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: s3fb: fix potential memory leak in s3_pci_probe() In s3_pci_probe(), the memory allocated for modelist using fb_videomode_to_modelist() is not freed in subsequent error paths. Fix that by calling fb_destroy_modelist()

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  16. CVE-2026-72269

    Без оценкиEPSS 0,22%Есть исправление

    fbdev: uvesafb: fix potential memory leak in uvesafb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: fix potential memory leak in uvesafb_probe() Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafb_vbe_init() is not freed in some error paths. Fix this by updating the goto label.

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  17. CVE-2026-72268

    Без оценкиEPSS 0,22%Есть исправление

    fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() In tdfxfb_probe(), the memory allocated for modelist using fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined, is not freed in the subsequent error paths. Fix that by calling fb_destroy_modelist().

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  18. CVE-2026-72267

    Без оценкиEPSS 0,22%Есть исправление

    fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() The memory allocated for modelist in fb_videomode_to_modelist() is not freed in the subsequent error path. Fix that by calling fb_destroy_modelist()

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  19. CVE-2026-72266

    Без оценкиEPSS 0,21%Есть исправление

    fbdev: vesafb: fix memory leak in vesafb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: vesafb: fix memory leak in vesafb_probe() Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership") the string returned from fb_get_options() is expected to be freed by the caller. But the string is not freed in vesafb_probe(). Fix that by freeing the option string after setup.

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  20. CVE-2026-72265

    Без оценкиEPSS 0,22%Есть исправление

    fbdev: nvidia: fix potential memory leak in nvidiafb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: nvidia: fix potential memory leak in nvidiafb_probe() In nvidiafb_probe(), the memory allocated for modelist in nvidia_set_fbinfo() is not freed in the subsequent error paths. Fix that by calling fb_destroy_modelist().

    linux-nvidia-bosОперационные системы
    • Обновитесь до 7.0.0-2022.23
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →