| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
| url |
VCID-brte-gqy3-r3ax |
| vulnerability_id |
VCID-brte-gqy3-r3ax |
| summary |
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix OOB write in QUERY_INFO for compound requests When a compound request such as READ + QUERY_INFO(Security) is received, and the first command (READ) consumes most of the response buffer, ksmbd could write beyond the allocated buffer while building a security descriptor. The root cause was that smb2_get_info_sec() checked buffer space using ppntsd_size from xattr, while build_sec_desc() often synthesized a significantly larger descriptor from POSIX ACLs. This patch introduces smb_acl_sec_desc_scratch_len() to accurately compute the final descriptor size beforehand, performs proper buffer checking with smb2_calc_max_out_buf_len(), and uses exact-sized allocation + iov pinning. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-31432
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-brte-gqy3-r3ax |
|
| 6 |
|
| 7 |
| url |
VCID-dq8r-defv-hbg6 |
| vulnerability_id |
VCID-dq8r-defv-hbg6 |
| summary |
kernel: nvme: memory corruption via unprivileged user passthrough |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2023-6238 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.03058 |
| published_at |
2026-04-24T12:55:00Z |
|
| 1 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.02981 |
| published_at |
2026-04-02T12:55:00Z |
|
| 2 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.02742 |
| published_at |
2026-04-16T12:55:00Z |
|
| 3 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.02754 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.03063 |
| published_at |
2026-04-21T12:55:00Z |
|
| 5 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.02996 |
| published_at |
2026-04-04T12:55:00Z |
|
| 6 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.02785 |
| published_at |
2026-04-07T12:55:00Z |
|
| 7 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.02789 |
| published_at |
2026-04-08T12:55:00Z |
|
| 8 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.02809 |
| published_at |
2026-04-09T12:55:00Z |
|
| 9 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.0278 |
| published_at |
2026-04-11T12:55:00Z |
|
| 10 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.02761 |
| published_at |
2026-04-12T12:55:00Z |
|
| 11 |
| value |
0.00015 |
| scoring_system |
epss |
| scoring_elements |
0.02757 |
| published_at |
2026-04-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2023-6238 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
|
| aliases |
CVE-2023-6238
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
6.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dq8r-defv-hbg6 |
|
| 8 |
|
| 9 |
|
| 10 |
| url |
VCID-n59e-jkf6-13bf |
| vulnerability_id |
VCID-n59e-jkf6-13bf |
| summary |
kernel: ntfs3 local privledge escalation if NTFS character set and remount and umount called simultaneously |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-3238 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.23708 |
| published_at |
2026-04-02T12:55:00Z |
|
| 1 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.23364 |
| published_at |
2026-04-24T12:55:00Z |
|
| 2 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.23577 |
| published_at |
2026-04-16T12:55:00Z |
|
| 3 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.23567 |
| published_at |
2026-04-18T12:55:00Z |
|
| 4 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.23547 |
| published_at |
2026-04-21T12:55:00Z |
|
| 5 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.23751 |
| published_at |
2026-04-04T12:55:00Z |
|
| 6 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.23531 |
| published_at |
2026-04-07T12:55:00Z |
|
| 7 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.23602 |
| published_at |
2026-04-08T12:55:00Z |
|
| 8 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.23648 |
| published_at |
2026-04-09T12:55:00Z |
|
| 9 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.23664 |
| published_at |
2026-04-11T12:55:00Z |
|
| 10 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.23622 |
| published_at |
2026-04-12T12:55:00Z |
|
| 11 |
| value |
0.0008 |
| scoring_system |
epss |
| scoring_elements |
0.23565 |
| published_at |
2026-04-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-3238 |
|
| 2 |
|
| 3 |
|
|
| fixed_packages |
|
| aliases |
CVE-2022-3238
|
| risk_score |
3.5 |
| exploitability |
0.5 |
| weighted_severity |
7.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-n59e-jkf6-13bf |
|
| 11 |
| url |
VCID-p3vt-v7gj-gqbc |
| vulnerability_id |
VCID-p3vt-v7gj-gqbc |
| summary |
kernel: io_uring: check if iowq is killed before queuing |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2024-56709 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00032 |
| scoring_system |
epss |
| scoring_elements |
0.09479 |
| published_at |
2026-04-24T12:55:00Z |
|
| 1 |
| value |
0.00032 |
| scoring_system |
epss |
| scoring_elements |
0.09275 |
| published_at |
2026-04-18T12:55:00Z |
|
| 2 |
| value |
0.00032 |
| scoring_system |
epss |
| scoring_elements |
0.09424 |
| published_at |
2026-04-21T12:55:00Z |
|
| 3 |
| value |
0.00037 |
| scoring_system |
epss |
| scoring_elements |
0.11039 |
| published_at |
2026-04-04T12:55:00Z |
|
| 4 |
| value |
0.00037 |
| scoring_system |
epss |
| scoring_elements |
0.10939 |
| published_at |
2026-04-13T12:55:00Z |
|
| 5 |
| value |
0.00037 |
| scoring_system |
epss |
| scoring_elements |
0.10993 |
| published_at |
2026-04-09T12:55:00Z |
|
| 6 |
| value |
0.00037 |
| scoring_system |
epss |
| scoring_elements |
0.10994 |
| published_at |
2026-04-11T12:55:00Z |
|
| 7 |
| value |
0.00037 |
| scoring_system |
epss |
| scoring_elements |
0.10962 |
| published_at |
2026-04-12T12:55:00Z |
|
| 8 |
| value |
0.00037 |
| scoring_system |
epss |
| scoring_elements |
0.10803 |
| published_at |
2026-04-16T12:55:00Z |
|
| 9 |
| value |
0.00037 |
| scoring_system |
epss |
| scoring_elements |
0.10863 |
| published_at |
2026-04-07T12:55:00Z |
|
| 10 |
| value |
0.00037 |
| scoring_system |
epss |
| scoring_elements |
0.10977 |
| published_at |
2026-04-02T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2024-56709 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
|
| fixed_packages |
|
| aliases |
CVE-2024-56709
|
| risk_score |
2.0 |
| exploitability |
0.5 |
| weighted_severity |
4.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-p3vt-v7gj-gqbc |
|
| 12 |
|
| 13 |
| url |
VCID-pmn9-t8by-myhb |
| vulnerability_id |
VCID-pmn9-t8by-myhb |
| summary |
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-31431
|
| risk_score |
2.5 |
| exploitability |
0.5 |
| weighted_severity |
5.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pmn9-t8by-myhb |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|