https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 08:31:22 +0000 https://vulnerability.circl.lu/vuln/cve-2026-53329 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amd/display: Use krealloc_array() in dal_vector_reserve()</p> <p>[Why &amp; How] dal_vector_reserve() computes the allocation size as &#34;capacity * vector-&gt;struct_size&#34; using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overflows on subsequent vector appends.</p> <p>Replace krealloc() with krealloc_array() which performs an internal overflow check and returns NULL on wrap, preventing the issue.</p> <p>(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amd/display: Use krealloc_array() in dal_vector_reserve()</p> <p>[Why &amp; How] dal_vector_reserve() computes the allocation size as &#34;capacity * vector-&gt;struct_size&#34; using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overflows on subsequent vector appends.</p> <p>Replace krealloc() with krealloc_array() which performs an internal overflow check and returns NULL on wrap, preventing the issue.</p> <p>(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)</p> https://vulnerability.circl.lu/vuln/cve-2026-53329