Web This site Trusted
27 result(s) for “if can favor site code web de site can kernel org site does ball so com site:cdn.kernel.org” · 1326 ms
Scope: Nishi’s own index (our crawl + Common Crawl) — not the whole live web. Some sites block all automated crawlers (anti-bot walls), so their pages may be absent here even though we never filter lawful content.
Freshness: no result on this page carries a fetch time yet (indexed before the fetch epoch was stored beside the doc)
As a result, every failing socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) call leaks one tcp_sock, so an unprivileged task able to attach a deny-all BPF_CGROUP_INET_SOCK_CREATE program to its own cgroup can grow kernel memory unboundedly
from the top result below
https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.6
, branch mode, scripting, annotations), the sum of added options can theoretically exceed 16 (potentially reaching up to ~19)
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.151
org/drm/xe/kernel/-/work_items/8412 Tested-by: Alexander Kaplan Cc: Signed-off-by: Kai Vehmanen Link: https://patch
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.44
org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman commit 10be509fa8fd95d1e47d40d1f68b0b26dfe9d572 Author: Oliver Hartkopp Date: Fri Aug 7 09:52:11 2026 +0200 can: isotp: fix timer drain order, wakeup handling and tx_gen ordering commit 050f010f920da17c1044a4f174766ad553e770b6 upstream
https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.8
This can lead to incorrect flip_pending detection used by vblank event delivery
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.152
Unpopulated elements are NULL but if we have populated every element then this code will read one element beyond the end of the array
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.157
Setting hwc->config should be safe even if there is an error so use this opportunity to simplify the code
https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.5
smb2_read_pipe() allocates only the payload size, so the alignment padding can expose up to seven bytes of uninitialized kernel heap memory
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.104
A malicious or malformed Thunderbolt device can set dual_link_port_nr beyond the allocated sw->ports[] (max_port_number + 1 entries), producing an out-of-bounds tb_port pointer that is stored and later dereferenced
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.101
Contrary to what was stated on d36349ea73d8 ("Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK") the PA_LINK does in fact needs to run bis_cleanup in order to terminate the PA Sync, since that is bond to the listening socket which is the entity that controls the lifetime of PA Sync, so if it is
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.45
A malicious or malformed Thunderbolt device can set dual_link_port_nr beyond the allocated sw->ports[] (max_port_number + 1 entries), producing an out-of-bounds tb_port pointer that is stored and later dereferenced
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.46
arm), so this can cause make oldconfig to loop indefinitely when CONFIG_SMP=n: $ make ARCH=arm allmodconfig $ sed -i "/CONFIG_SMP=y/d
https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.6
This missed the case where background I/O holds the final reference after userspace close() returns, and required explicit maintenance at each close-path site
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.42
If the work is already running, mark it cancelled and let the worker own the cleanup; otherwise tcm_disable() can cancel the queued work and clean up immediately
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.266
However, there exists a race window where this check can be bypassed: ring_buffer_lock_reserve cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a rb_reserve_next_event rb_start_commit // inc committing if (unlikely(READ_ONCE(cpu_buffer->buffer)
https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.9
A malicious or malformed Thunderbolt device can set dual_link_port_nr beyond the allocated sw->ports[] (max_port_number + 1 entries), producing an out-of-bounds tb_port pointer that is stored and later dereferenced
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.148
org Tested-by: Florian Fainelli Tested-by: Peter Schneider Tested-by: Miguel Ojeda Tested-by: Brett A C Sheffield Tested-by: Shuah Khan Tested-by: Pavel Machek (CIP) Tested-by: Wentao Guan Tested-by: Mark Brown Tested-by: Ron Economos Signed-off-by: Greg Kroah-Hartman commit 60283726f2845bd78b95efbd0e50b93944780477
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.51
smb2_read_pipe() allocates only the payload size, so the alignment padding can expose up to seven bytes of uninitialized kernel heap memory
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.265
org Fixes: ef67959c4253 ("hwmon: (adt7470) Convert to use regmap") Signed-off-by: Luiz Angelo Daros de Luca Link: https://lore
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.216
A malicious or malformed Thunderbolt device can set dual_link_port_nr beyond the allocated sw->ports[] (max_port_number + 1 entries), producing an out-of-bounds tb_port pointer that is stored and later dereferenced
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.50
com Fixes: 5d2146a3354f ("selftests/mm: skip mlock tests if nobody user can't read it") Signed-off-by: Injae Ryou Cc: Brendan Jackman Cc: B
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.183
A malicious or malformed Thunderbolt device can set dual_link_port_nr beyond the allocated sw->ports[] (max_port_number + 1 entries), producing an out-of-bounds tb_port pointer that is stored and later dereferenced
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.156
After a disconnect the usbfs reference can be the last one, in which case usb_put_dev() frees the device and the subsequent loop reads offset 80 of freed memory and uses the result as a struct usb_hcd *, which hcd_buffer_free_pages() then dereferences
https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.1.13
After a disconnect the usbfs reference can be the last one, in which case usb_put_dev() frees the device and the subsequent loop reads offset 80 of freed memory and uses the result as a struct usb_hcd *, which hcd_buffer_free_pages() then dereferences
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.153
However, there exists a race window where this check can be bypassed: ring_buffer_lock_reserve cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a rb_reserve_next_event rb_start_commit // inc committing if (unlikely(READ_ONCE(cpu_buffer->buffer)
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.184
However, there exists a race window where this check can be bypassed: ring_buffer_lock_reserve cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a rb_reserve_next_event rb_start_commit // inc committing if (unlikely(READ_ONCE(cpu_buffer->buffer)
https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.2.2
A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.155
A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off