| # | Tier | Score | Cat | Function | File | Variable | Sink | Guard | LLM |
|---|
| 1 | Critical | 360 | C | rds_cong_set_bit | net/rds/cong.c | i | subscript | no | BUG:oob_write |
| 2 | Critical | 360 | B | sctp_association_init | net/sctp/associola.c | ntohs(ep->auth_hmacs_list->param_hdr.len | memcpy() | no | BUG:oob_write |
| 3 | Critical | 360 | B | sctp_association_init | net/sctp/associola.c | ntohs(ep->auth_chunk_list->param_hdr.len | memcpy() | no | BUG:oob_write |
| 4 | Critical | 360 | C | xfrm_replay_advance_bmp | net/xfrm/xfrm_replay.c | nr | subscript | no | BUG:oob_write |
| 5 | Critical | 360 | C | xfrm_replay_advance_esn | net/xfrm/xfrm_replay.c | nr | subscript | no | BUG:oob_write |
| 6 | Critical | 350 | E | __regdb_query_wmm | net/wireless/reg.c | coll | coll->n_rules | no | BUG:oob_read |
| 7 | Critical | 350 | E | __regdb_query_wmm | net/wireless/reg.c | coll | coll->len | no | BUG:oob_read |
| 8 | Critical | 350 | E | __regdb_query_wmm | net/wireless/reg.c | rule | rule->len | no | BUG:oob_read |
| 9 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | coll | coll->n_rules | no | BUG:oob_read |
| 10 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | coll | coll->n_rules | no | BUG:oob_read |
| 11 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | coll | coll->dfs_region | no | BUG:oob_read |
| 12 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | coll | coll->len | no | BUG:oob_read |
| 13 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | rule | rule->start | no | BUG:oob_read |
| 14 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | rule | rule->end | no | BUG:oob_read |
| 15 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | rule | rule->max_bw | no | BUG:oob_read |
| 16 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | rule | rule->max_eirp | no | BUG:oob_read |
| 17 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | rule | rule->flags | no | BUG:oob_read |
| 18 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | rule | rule->flags | no | BUG:oob_read |
| 19 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | rule | rule->flags | no | BUG:oob_read |
| 20 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | rule | rule->flags | no | BUG:oob_read |
| 21 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | rule | rule->flags | no | BUG:oob_read |
| 22 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | rule | rule->len | no | BUG:oob_read |
| 23 | Critical | 350 | E | regdb_query_country | net/wireless/reg.c | rule | rule->len | no | BUG:oob_read |
| 24 | Critical | 350 | E | sctp_process_asconf_ack | net/sctp/sm_make_chunk.c | asconf_param | asconf_param->? | no | BUG:oob_read |
| 25 | Critical | 350 | E | sctp_process_asconf_ack | net/sctp/sm_make_chunk.c | asconf_param | asconf_param->? | no | BUG:oob_read |
| 26 | Critical | 350 | E | sctp_process_asconf_ack | net/sctp/sm_make_chunk.c | asconf_param | asconf_param->param_hdr | no | BUG:oob_read |
| 27 | Critical | 350 | E | sctp_process_asconf_ack | net/sctp/sm_make_chunk.c | asconf_param | asconf_param->param_hdr | no | BUG:oob_read |
| 28 | Critical | 350 | E | set_wmm_rule | net/wireless/reg.c | wmm | wmm->client | no | BUG:oob_read |
| 29 | Critical | 350 | E | set_wmm_rule | net/wireless/reg.c | wmm | wmm->client | no | BUG:oob_read |
| 30 | Critical | 350 | E | set_wmm_rule | net/wireless/reg.c | wmm | wmm->client | no | BUG:oob_read |
| 31 | Critical | 350 | E | set_wmm_rule | net/wireless/reg.c | wmm | wmm->client | no | BUG:oob_read |
| 32 | Critical | 350 | E | set_wmm_rule | net/wireless/reg.c | wmm | wmm->ap | no | BUG:oob_read |
| 33 | Critical | 350 | E | set_wmm_rule | net/wireless/reg.c | wmm | wmm->ap | no | BUG:oob_read |
| 34 | Critical | 350 | E | set_wmm_rule | net/wireless/reg.c | wmm | wmm->ap | no | BUG:oob_read |
| 35 | Critical | 350 | E | set_wmm_rule | net/wireless/reg.c | wmm | wmm->ap | no | BUG:oob_read |
| 36 | Critical | 340 | C | sctp_auth_ep_add_chunkid | net/sctp/auth.c | nchunks | subscript | yes? | BUG:oob_write |
| 37 | Critical | 340 | B | sctp_auth_make_key_vector | net/sctp/auth.c | random_len | memcpy() | no | BUG:oob_read |
| 38 | Critical | 340 | B | sctp_auth_make_key_vector | net/sctp/auth.c | chunks_len | memcpy() | no | BUG:oob_read |
| 39 | Critical | 340 | B | sctp_auth_make_key_vector | net/sctp/auth.c | hmacs_len | memcpy() | no | BUG:oob_read |
| 40 | Critical | 340 | C | sctp_outq_sack | net/sctp/outqueue.c | gap_ack_blocks | subscript | no | BUG:oob_read |
| 41 | Critical | 330 | F | __regdb_query_wmm | net/wireless/reg.c | coll | loop bound | no | BUG:oob_read |
| 42 | Critical | 330 | E | __regdb_query_wmm | net/wireless/reg.c | rule | rule->start | yes? | BUG:oob_read |
| 43 | Critical | 330 | E | __regdb_query_wmm | net/wireless/reg.c | rule | rule->end | yes? | BUG:oob_read |
| 44 | Critical | 330 | F | __sctp_auth_cid | net/sctp/auth.c | len | loop bound | no | BUG:oob_read |
| 45 | Critical | 330 | F | batadv_v_ogm_process_per_outif | net/batman-adv/bat_v_ogm.c | ntohs(ogm2->tvlv_len) | loop bound | no | BUG:oob_read |
| 46 | Critical | 330 | F | rds_ib_inc_copy_to_user | net/rds/ib_recv.c | len | loop bound | no | BUG:oob_read |
| 47 | Critical | 330 | F | rds_message_inc_copy_to_user | net/rds/message.c | len | loop bound | no | BUG:oob_read |
| 48 | Critical | 330 | E | regdb_query_country | net/wireless/reg.c | rule | rule->? | yes? | BUG:oob_read |
| 49 | Critical | 330 | E | regdb_query_country | net/wireless/reg.c | rule | rule->? | yes? | BUG:oob_read |
| 50 | Critical | 330 | E | regdb_query_country | net/wireless/reg.c | rule | rule->? | yes? | BUG:oob_read |
| 51 | Critical | 330 | E | regdb_query_country | net/wireless/reg.c | rule | rule->? | yes? | BUG:oob_read |
| 52 | Critical | 330 | E | regdb_query_country | net/wireless/reg.c | rule | rule->cac_timeout | yes? | BUG:oob_read |
| 53 | Critical | 330 | F | sctp_auth_asoc_get_hmac | net/sctp/auth.c | n_elt | loop bound | no | BUG:oob_read |
| 54 | Critical | 330 | F | sctp_auth_asoc_set_default_hmac | net/sctp/auth.c | n_params | loop bound | no | BUG:oob_read |
| 55 | Critical | 330 | F | sctp_auth_asoc_verify_hmac_id | net/sctp/auth.c | n_elt | loop bound | no | BUG:oob_read |
| 56 | Critical | 330 | F | sctp_get_asconf_response | net/sctp/sm_make_chunk.c | asconf_ack_len | loop bound | no | BUG:oob_read |
| 57 | Critical | 330 | E | sctp_process_asconf | net/sctp/sm_make_chunk.c | chunk_len | chunk_len->? | no | BUG:undersized_alloc |
| 58 | Critical | 330 | F | sctp_process_ext_param | net/sctp/sm_make_chunk.c | num_ext | loop bound | no | BUG:oob_read |
| 59 | Critical | 330 | F | sctp_verify_ext_param | net/sctp/sm_make_chunk.c | num_ext | loop bound | no | BUG:oob_read |
| 60 | Critical | 330 | F | sctp_verify_param | net/sctp/sm_make_chunk.c | n_elt | loop bound | no | BUG:oob_read |
| 61 | Critical | 330 | F | sja1110_rcv_inband_control_extension | net/dsa/tag_sja1105.c | rx_header | loop bound | no | BUG:oob_read |
| 62 | Critical | 320 | B | alloc_msg_with_page_vector | net/ceph/osd_client.c | front_len | kvmalloc() in ceph_msg_new2() | no | BUG:undersized_alloc |
| 63 | Critical | 320 | B | ceph_alloc_middle | net/ceph/messenger.c | middle_len | kvmalloc() in ceph_buffer_new() | no | BUG:undersized_alloc |
| 64 | Critical | 320 | B | sctp_getsockopt_local_auth_chunks | net/sctp/socket.c | num_chunks | copy_to_user() | yes? | BUG:oob_read |
| 65 | Critical | 320 | B | sctp_getsockopt_peer_auth_chunks | net/sctp/socket.c | num_chunks | copy_to_user() | yes? | BUG:oob_read |
| 66 | Critical | 310 | F | alloc_msg_with_page_vector | net/ceph/osd_client.c | data_len | loop bound | no | BUG:undersized_alloc |
| 67 | Critical | 300 | H | nft_cmp_select_ops | net/netfilter/nft_cmp.c | sreg | truncation | no | BUG:integer_overflow |
| 68 | Critical | 300 | H | nft_reg_to_type | net/netfilter/nft_immediate.c | reg | truncation | no | BUG:integer_overflow |
| 69 | Medium | 90 | B | nf_tables_newrule | net/netfilter/nf_tables_api.c | rule | sizeof(*rule) + size + usize | no | FP |
| 70 | Medium | 70 | A | batadv_frag_merge_packets | net/batman-adv/fragmentation.c | size | memcpy() in pskb_expand_head() | no | FP |
| 71 | Medium | 70 | A | batadv_frag_merge_packets | net/batman-adv/fragmentation.c | size | memcpy() in pskb_expand_head() | no | FP |
| 72 | Medium | 70 | E | batadv_v_ogm_forward | net/batman-adv/bat_v_ogm.c | ogm_forward | ogm_forward->throughput | no | FP |
| 73 | Medium | 70 | E | batadv_v_ogm_forward | net/batman-adv/bat_v_ogm.c | ogm_forward | ogm_forward->ttl | no | FP |
| 74 | Medium | 70 | E | batadv_v_ogm_forward | net/batman-adv/bat_v_ogm.c | ogm_forward | ogm_forward->throughput | no | FP |
| 75 | Medium | 70 | E | batadv_v_ogm_forward | net/batman-adv/bat_v_ogm.c | ogm_forward | ogm_forward->ttl | no | FP |
| 76 | Medium | 70 | E | br_ip4_multicast_igmp3_report | net/bridge/br_multicast.c | grec | grec->grec_src | no | FP |
| 77 | Medium | 70 | E | br_ip4_multicast_igmp3_report | net/bridge/br_multicast.c | grec | grec->grec_src | no | FP |
| 78 | Medium | 70 | E | br_ip4_multicast_igmp3_report | net/bridge/br_multicast.c | grec | grec->grec_src | no | FP |
| 79 | Medium | 70 | E | br_ip4_multicast_igmp3_report | net/bridge/br_multicast.c | grec | grec->grec_src | no | FP |
| 80 | Medium | 70 | E | br_ip4_multicast_igmp3_report | net/bridge/br_multicast.c | grec | grec->grec_src | no | FP |
| 81 | Medium | 70 | E | br_ip4_multicast_igmp3_report | net/bridge/br_multicast.c | grec | grec->grec_src | no | FP |
| 82 | Medium | 70 | B | cfg80211_parse_ml_elem_sta_data | net/wireless/scan.c | reporter_rnr | sizeof(struct element) + reporter_rnr->datalen | yes? | FP |
| 83 | Medium | 70 | E | encrypt_authorizer | net/ceph/auth_x.c | msg_b | msg_b->struct_v | no | FP |
| 84 | Medium | 70 | E | encrypt_authorizer | net/ceph/auth_x.c | msg_b | msg_b->nonce | no | FP |
| 85 | Medium | 70 | E | encrypt_authorizer | net/ceph/auth_x.c | msg_b | msg_b->have_challenge | no | FP |
| 86 | Medium | 70 | E | encrypt_authorizer | net/ceph/auth_x.c | msg_b | msg_b->server_challenge_plus_one | no | FP |
| 87 | Medium | 70 | E | encrypt_authorizer | net/ceph/auth_x.c | msg_b | msg_b->have_challenge | no | FP |
| 88 | Medium | 70 | E | encrypt_authorizer | net/ceph/auth_x.c | msg_b | msg_b->server_challenge_plus_one | no | FP |
| 89 | Medium | 70 | E | hci_le_per_adv_report_evt | net/bluetooth/hci_event.c | pa_sync | pa_sync->? | no | FP |
| 90 | Medium | 70 | E | hci_le_per_adv_report_evt | net/bluetooth/hci_event.c | pa_sync | pa_sync->? | no | FP |
| 91 | Medium | 70 | E | hci_le_per_adv_report_evt | net/bluetooth/hci_event.c | pa_sync | pa_sync->? | no | FP |
| 92 | Medium | 70 | E | hci_le_per_adv_report_evt | net/bluetooth/hci_event.c | pa_sync | pa_sync->? | no | FP |
| 93 | Medium | 70 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->extobj_hdr | no | FP |
| 94 | Medium | 70 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->extobj_hdr | no | FP |
| 95 | Medium | 70 | A | icmp_build_probe | net/ipv4/icmp.c | iio | memcpy() | no | FP |
| 96 | Medium | 70 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->ident | no | FP |
| 97 | Medium | 70 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->ident | no | FP |
| 98 | Medium | 70 | E | icmp_build_probe | net/ipv4/icmp.c | dev | dev->flags | no | FP |
| 99 | Medium | 70 | E | icmp_build_probe | net/ipv4/icmp.c | in_dev | in_dev->ifa_list | no | FP |
| 100 | Medium | 70 | E | icmp_build_probe | net/ipv4/icmp.c | in6_dev | in6_dev->addr_list | no | FP |
| 101 | Medium | 70 | E | ieee80211_mesh_rx_bcn_presp | net/mac80211/mesh.c | elems | elems->mesh_id | no | FP |
| 102 | Medium | 70 | E | ieee80211_mesh_rx_bcn_presp | net/mac80211/mesh.c | elems | elems->rsn | no | FP |
| 103 | Medium | 70 | E | ieee80211_mesh_rx_bcn_presp | net/mac80211/mesh.c | elems | elems->rsn | no | FP |
| 104 | Medium | 70 | E | ieee80211_mesh_rx_bcn_presp | net/mac80211/mesh.c | elems | elems->ds_params | no | FP |
| 105 | Medium | 70 | E | ieee80211_mesh_rx_bcn_presp | net/mac80211/mesh.c | elems | elems->ds_params | no | FP |
| 106 | Medium | 70 | E | ieee80211_mesh_rx_bcn_presp | net/mac80211/mesh.c | channel | channel->flags | no | FP |
| 107 | Medium | 70 | E | ieee80211_mesh_rx_bcn_presp | net/mac80211/mesh.c | elems | elems->mesh_config | no | FP |
| 108 | Medium | 70 | E | ieee80211_ml_epcs | net/mac80211/mlme.c | link_elems | link_elems->wmm_param | no | FP |
| 109 | Medium | 70 | E | ieee80211_ml_epcs | net/mac80211/mlme.c | link_elems | link_elems->wmm_param_len | no | FP |
| 110 | Medium | 70 | E | ieee80211_ml_epcs | net/mac80211/mlme.c | link_elems | link_elems->mu_edca_param_set | no | FP |
| 111 | Medium | 70 | E | llc_sap_action_send_test_r | net/llc/llc_s_ac.c | data_size | data_size->? | no | FP |
| 112 | Medium | 70 | E | llc_sap_action_send_test_r | net/llc/llc_s_ac.c | data_size | data_size->? | no | FP |
| 113 | Medium | 70 | E | llc_station_ac_send_test_r | net/llc/llc_station.c | data_size | data_size->? | no | FP |
| 114 | Medium | 70 | E | llc_station_ac_send_test_r | net/llc/llc_station.c | data_size | data_size->? | no | FP |
| 115 | Medium | 70 | E | nf_tables_newobj | net/netfilter/nf_tables_api.c | type | type->? | no | FP |
| 116 | Medium | 70 | E | nf_tables_newrule | net/netfilter/nf_tables_api.c | udata | udata->len | no | FP |
| 117 | Medium | 70 | E | nf_tables_newrule | net/netfilter/nf_tables_api.c | udata | udata->data | no | FP |
| 118 | Medium | 70 | E | nf_tproxy_get_sock_v6 | net/ipv6/netfilter/nf_tproxy_ipv6.c | sk | sk->sk_refcnt | no | FP |
| 119 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->? | no | FP |
| 120 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->? | no | FP |
| 121 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->? | no | FP |
| 122 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->? | no | FP |
| 123 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->? | no | FP |
| 124 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->? | no | FP |
| 125 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->? | no | FP |
| 126 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->? | no | FP |
| 127 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | regdom | regdom->n_reg_rules | no | FP |
| 128 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | regdom | regdom->alpha2 | no | FP |
| 129 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | regdom | regdom->alpha2 | no | FP |
| 130 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | regdom | regdom->dfs_region | no | FP |
| 131 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | regdom | regdom->n_reg_rules | no | FP |
| 132 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | regdom | regdom->reg_rules | no | FP |
| 133 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->freq_range | no | FP |
| 134 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->freq_range | no | FP |
| 135 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->freq_range | no | FP |
| 136 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->power_rule | no | FP |
| 137 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->power_rule | no | FP |
| 138 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->flags | no | FP |
| 139 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->flags | no | FP |
| 140 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->flags | no | FP |
| 141 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->flags | no | FP |
| 142 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->flags | no | FP |
| 143 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->flags | no | FP |
| 144 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->dfs_cac_ms | no | FP |
| 145 | Medium | 70 | E | regdb_query_country | net/wireless/reg.c | rrule | rrule->dfs_cac_ms | no | FP |
| 146 | Medium | 70 | A | rxgk_yfs_decode_ticket | net/rxrpc/rxgk_app.c | ticket | memcpy() | no | FP |
| 147 | Medium | 70 | A | rxgk_yfs_decode_ticket | net/rxrpc/rxgk_app.c | q | memcpy() | no | FP |
| 148 | Medium | 70 | A | rxgk_yfs_decode_ticket | net/rxrpc/rxgk_app.c | ticket | memcpy() | no | FP |
| 149 | Medium | 70 | A | rxrpc_preparse_xdr | net/rxrpc/key.c | toklen | memcpy() in rxrpc_preparse_xdr_yfs_rxgk() | no | FP |
| 150 | Medium | 70 | A | rxrpc_preparse_xdr_yfs_rxgk | net/rxrpc/key.c | ticket | memcpy() | no | FP |
| 151 | Medium | 70 | E | sctp_auth_make_key_vector | net/sctp/auth.c | len | len->? | no | FP |
| 152 | Medium | 70 | E | sctp_auth_make_key_vector | net/sctp/auth.c | len | len->? | no | FP |
| 153 | Medium | 70 | A | sctp_auth_make_key_vector | net/sctp/auth.c | new | memcpy() | no | FP |
| 154 | Medium | 70 | E | sctp_auth_make_key_vector | net/sctp/auth.c | new | new->data | no | FP |
| 155 | Medium | 70 | A | sctp_auth_make_key_vector | net/sctp/auth.c | new | memcpy() | no | FP |
| 156 | Medium | 70 | E | sctp_auth_make_key_vector | net/sctp/auth.c | new | new->data | no | FP |
| 157 | Medium | 70 | A | sctp_auth_make_key_vector | net/sctp/auth.c | new | memcpy() | no | FP |
| 158 | Medium | 70 | E | sctp_auth_make_key_vector | net/sctp/auth.c | new | new->data | no | FP |
| 159 | Medium | 70 | E | sctp_process_strreset_outreq | net/sctp/stream.c | nums | nums->? | no | FP |
| 160 | Medium | 70 | E | sctp_process_strreset_outreq | net/sctp/stream.c | nums | nums->? | no | FP |
| 161 | Medium | 70 | E | sctp_process_strreset_outreq | net/sctp/stream.c | nums | nums->? | no | FP |
| 162 | Medium | 70 | E | sctp_process_strreset_outreq | net/sctp/stream.c | nums | nums->? | no | FP |
| 163 | Medium | 70 | E | sctp_process_strreset_outreq | net/sctp/stream.c | nums | nums->? | no | FP |
| 164 | Medium | 70 | E | sctp_process_strreset_resp | net/sctp/stream.c | nums | nums->? | no | FP |
| 165 | Medium | 70 | E | sctp_process_strreset_resp | net/sctp/stream.c | nums | nums->? | no | FP |
| 166 | Medium | 70 | E | sctp_process_strreset_resp | net/sctp/stream.c | nums | nums->? | no | FP |
| 167 | Medium | 70 | E | sctp_process_strreset_resp | net/sctp/stream.c | nums | nums->? | no | FP |
| 168 | Medium | 70 | E | sctp_process_strreset_resp | net/sctp/stream.c | nums | nums->? | no | FP |
| 169 | Medium | 70 | E | sctp_process_strreset_resp | net/sctp/stream.c | i | i->state | no | FP |
| 170 | Medium | 70 | E | sctp_process_strreset_tsnreq | net/sctp/stream.c | i | i->mid | no | FP |
| 171 | Medium | 70 | E | sctp_process_strreset_tsnreq | net/sctp/stream.c | i | i->mid_uo | no | FP |
| 172 | Medium | 70 | E | sctp_process_strreset_tsnreq | net/sctp/stream.c | i | i->mid | no | FP |
| 173 | Medium | 70 | E | sctp_sf_do_5_1B_init | net/sctp/sm_statefuns.c | len | len->? | no | FP |
| 174 | Medium | 70 | E | sctp_sf_do_5_1B_init | net/sctp/sm_statefuns.c | len | len->? | no | FP |
| 175 | Medium | 70 | E | sctp_sf_do_5_1B_init | net/sctp/sm_statefuns.c | len | len->? | no | FP |
| 176 | Medium | 70 | E | sctp_sf_do_5_1B_init | net/sctp/sm_statefuns.c | len | len->? | no | FP |
| 177 | Medium | 70 | E | sctp_sf_do_unexpected_init | net/sctp/sm_statefuns.c | len | len->? | no | FP |
| 178 | Medium | 70 | E | sctp_sf_do_unexpected_init | net/sctp/sm_statefuns.c | len | len->? | no | FP |
| 179 | Medium | 70 | E | sctp_sf_do_unexpected_init | net/sctp/sm_statefuns.c | len | len->? | no | FP |
| 180 | Medium | 70 | E | sctp_sf_do_unexpected_init | net/sctp/sm_statefuns.c | len | len->? | no | FP |
| 181 | Medium | 70 | E | send_hci_cmd_sync | net/bluetooth/mgmt.c | skb | skb->? | no | FP |
| 182 | Medium | 70 | E | send_hci_cmd_sync | net/bluetooth/mgmt.c | skb | skb->? | no | FP |
| 183 | Medium | 70 | E | send_hci_cmd_sync | net/bluetooth/mgmt.c | skb | skb->? | no | FP |
| 184 | Medium | 70 | E | send_hci_cmd_sync | net/bluetooth/mgmt.c | skb | skb->? | no | FP |
| 185 | Medium | 70 | E | send_hci_cmd_sync | net/bluetooth/mgmt.c | skb | skb->? | no | FP |
| 186 | Medium | 70 | E | send_hci_cmd_sync | net/bluetooth/mgmt.c | skb | skb->? | no | FP |
| 187 | Medium | 70 | E | send_hci_cmd_sync | net/bluetooth/mgmt.c | skb | skb->? | no | FP |
| 188 | Medium | 70 | E | send_hci_cmd_sync | net/bluetooth/mgmt.c | skb | skb->? | no | FP |
| 189 | Medium | 70 | E | set_sctp_state | net/netfilter/ipvs/ip_vs_proto_sctp.c | sch | sch->type | no | FP |
| 190 | Medium | 70 | A | smc_clc_msg_hdr_valid | net/smc/smc_clc.c | trl | memcmp() | no | FP |
| 191 | Medium | 70 | E | smc_clc_msg_hdr_valid | net/smc/smc_clc.c | trl | trl->eyecatcher | no | FP |
| 192 | Medium | 70 | A | smc_clc_msg_hdr_valid | net/smc/smc_clc.c | trl | memcmp() | no | FP |
| 193 | Medium | 70 | E | smc_clc_msg_hdr_valid | net/smc/smc_clc.c | trl | trl->eyecatcher | no | FP |
| 194 | Medium | 70 | E | valid_country | net/wireless/reg.c | rule_ptr | rule_ptr->? | no | FP |
| 195 | Medium | 70 | E | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | hdr->src_cid | no | FP |
| 196 | Medium | 70 | E | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | hdr->src_port | no | FP |
| 197 | Medium | 70 | E | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | hdr->dst_cid | no | FP |
| 198 | Medium | 70 | E | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | hdr->dst_port | no | FP |
| 199 | Medium | 70 | E | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | hdr->transport | no | FP |
| 200 | Medium | 70 | E | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | hdr->len | no | FP |
| 201 | Medium | 70 | A | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | memset() | no | FP |
| 202 | Medium | 70 | E | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | hdr->reserved | no | FP |
| 203 | Medium | 70 | E | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | hdr->op | no | FP |
| 204 | Medium | 70 | E | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | hdr->op | no | FP |
| 205 | Medium | 70 | E | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | hdr->op | no | FP |
| 206 | Medium | 70 | E | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | hdr->op | no | FP |
| 207 | Medium | 70 | E | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | hdr->op | no | FP |
| 208 | Medium | 60 | C | __cookie_v4_check | net/ipv4/syncookies.c | mssind | subscript | no | FP |
| 209 | Medium | 60 | C | __cookie_v6_check | net/ipv6/syncookies.c | mssind | subscript | no | FP |
| 210 | Medium | 60 | G2 | __do_replace | net/ipv4/netfilter/arp_tables.c | sizeof(struct xt_counters) * num_counters | copy_to_user() unvalidated size | no | FP |
| 211 | Medium | 60 | G2 | __do_replace | net/ipv4/netfilter/ip_tables.c | sizeof(struct xt_counters) * num_counters | copy_to_user() unvalidated size | no | FP |
| 212 | Medium | 60 | G2 | __do_replace | net/ipv6/netfilter/ip6_tables.c | sizeof(struct xt_counters) * num_counters | copy_to_user() unvalidated size | no | FP |
| 213 | Medium | 60 | G2 | __get_filter | net/core/filter.c | fsize | copy_from_user() unvalidated size | no | FP |
| 214 | Medium | 60 | C | __ieee80211_tx_status | net/mac80211/status.c | tid | subscript (callee) | no | FP |
| 215 | Medium | 60 | C | __ieee80211_tx_status | net/mac80211/status.c | tid | subscript | no | FP |
| 216 | Medium | 60 | C | __ieee80211_tx_status | net/mac80211/status.c | tid | subscript | no | FP |
| 217 | Medium | 60 | C | __sctp_rcv_lookup_endpoint | net/sctp/input.c | hash | subscript | no | FP |
| 218 | Medium | 60 | C | __udp4_lib_lookup | net/ipv4/udp.c | hnum | subscript (callee) | no | FP |
| 219 | Medium | 60 | C | __udp4_lib_lookup | net/ipv4/udp.c | hnum | subscript (callee) | no | FP |
| 220 | Medium | 60 | C | __udp4_lib_mcast_deliver | net/ipv4/udp.c | hash2 | subscript | no | FP |
| 221 | Medium | 60 | C | __udp4_lib_mcast_demux_lookup | net/ipv4/udp.c | slot | subscript | no | FP |
| 222 | Medium | 60 | C | __udp6_lib_lookup | net/ipv6/udp.c | hnum | subscript (callee) | no | FP |
| 223 | Medium | 60 | C | __udp6_lib_lookup | net/ipv6/udp.c | hnum | subscript (callee) | no | FP |
| 224 | Medium | 60 | C | __udp6_lib_mcast_deliver | net/ipv6/udp.c | hash2 | subscript | no | FP |
| 225 | Medium | 60 | G2 | atm_dev_ioctl | net/atm/resources.c | size | copy_to_user() unvalidated size | no | FP |
| 226 | Medium | 60 | G2 | atm_dev_ioctl | net/atm/resources.c | size | copy_to_user() unvalidated size | no | FP |
| 227 | Medium | 60 | G2 | atm_dev_ioctl | net/atm/resources.c | ESI_LEN | copy_from_user() unvalidated size | no | FP |
| 228 | Medium | 60 | G2 | atm_dev_ioctl | net/atm/resources.c | size | copy_to_user() unvalidated size | no | FP |
| 229 | Medium | 60 | G2 | atm_dev_ioctl | net/atm/resources.c | size | copy_to_user() unvalidated size | no | FP |
| 230 | Medium | 60 | C | batadv_frag_insert_packet | net/batman-adv/fragmentation.c | bucket | subscript | no | FP |
| 231 | Medium | 60 | B | batadv_tvlv_container_ogm_append | net/batman-adv/tvlv.c | ntohs(tvlv->tvlv_hdr.len) | memcpy() | no | FP |
| 232 | Medium | 60 | B | batadv_tvlv_container_register | net/batman-adv/tvlv.c | ntohs(tvlv_new->tvlv_hdr.len) | memcpy() | no | FP |
| 233 | Medium | 60 | G2 | bpf_ctx_finish | net/bpf/test_run.c | copy_size | copy_to_user() unvalidated size | no | FP |
| 234 | Medium | 60 | G2 | bpf_ctx_init | net/bpf/test_run.c | size | copy_from_user() unvalidated size | no | FP |
| 235 | Medium | 60 | G2 | bpf_prog_create_from_user | net/core/filter.c | fsize | copy_from_user() unvalidated size | no | FP |
| 236 | Medium | 60 | G2 | bpf_prog_test_run_skb | net/bpf/test_run.c | data_len | copy_from_user() unvalidated size | no | FP |
| 237 | Medium | 60 | G2 | bpf_prog_test_run_xdp | net/bpf/test_run.c | data_len | copy_from_user() unvalidated size | no | FP |
| 238 | Medium | 60 | G2 | bpf_test_finish | net/bpf/test_run.c | len | copy_to_user() unvalidated size | no | FP |
| 239 | Medium | 60 | G2 | bpf_test_finish | net/bpf/test_run.c | data_len | copy_to_user() unvalidated size | no | FP |
| 240 | Medium | 60 | G2 | br_ioctl_stub | net/bridge/br_ioctl.c | IFNAMSIZ | copy_from_user() unvalidated size | no | FP |
| 241 | Medium | 60 | B | cfg80211_get_p2p_attr | net/wireless/util.c | copy | memcpy() | no | FP |
| 242 | Medium | 60 | C | cipso_v4_map_cat_enum_ntoh | net/ipv4/cipso_ipv4.c | get_unaligned_be16(&net_cat[iter]) | subscript (callee) | no | FP |
| 243 | Medium | 60 | G2 | cmsghdr_from_user_compat_to_kern | net/compat.c | (cmsg.cmsg_len - sizeof(*ucmsg)) | copy_from_user() unvalidated size | no | FP |
| 244 | Medium | 60 | G2 | compat_do_replace | net/bridge/netfilter/ebtables.c | tmp.entries_size | copy_from_user() unvalidated size | no | FP |
| 245 | Medium | 60 | G2 | compat_match_to_user | net/bridge/netfilter/ebtables.c | strlen(match->name) + 1 | copy_to_user() unvalidated size | no | FP |
| 246 | Medium | 60 | G2 | compat_target_to_user | net/bridge/netfilter/ebtables.c | strlen(target->name) + 1 | copy_to_user() unvalidated size | no | FP |
| 247 | Medium | 60 | C | conntrack_pptp_help | net/netfilter/nf_conntrack_pptp.c | msg | subscript | no | FP |
| 248 | Medium | 60 | G2 | dgram_getsockopt | net/ieee802154/socket.c | len | copy_to_user() unvalidated size | no | FP |
| 249 | Medium | 60 | G2 | do_ip_vs_get_ctl | net/netfilter/ipvs/ip_vs_ctl.c | strlen(buf)+1 | copy_to_user() unvalidated size | no | FP |
| 250 | Medium | 60 | G2 | do_rawv6_getsockopt | net/ipv6/raw.c | len | copy_to_user() unvalidated size | no | FP |
| 251 | Medium | 60 | G2 | ebt_obj_to_user | net/bridge/netfilter/ebtables.c | EBT_EXTENSION_MAXNAMELEN | copy_to_user() unvalidated size | no | FP |
| 252 | Medium | 60 | C | esp6_find_tcp_sk | net/ipv6/esp6.c | ntohs(sport) | subscript (callee) | no | FP |
| 253 | Medium | 60 | G2 | ethtool_copy_validate_indir | net/ethtool/ioctl.c | array_size(size, sizeof(indir[0])) | copy_from_user() unvalidated size | no | FP |
| 254 | Medium | 60 | G2 | ethtool_get_dump_data | net/ethtool/ioctl.c | len | copy_to_user() unvalidated size | no | FP |
| 255 | Medium | 60 | G2 | ethtool_get_features | net/ethtool/ioctl.c | array_size(copy_size, sizeof(*features)) | copy_to_user() unvalidated size | no | FP |
| 256 | Medium | 60 | G2 | ethtool_get_phy_stats | net/ethtool/ioctl.c | array_size(stats.n_stats, sizeof(u64)) | copy_to_user() unvalidated size | no | FP |
| 257 | Medium | 60 | G2 | ethtool_get_sset_info | net/ethtool/ioctl.c | array_size(idx, sizeof(u32)) | copy_to_user() unvalidated size | no | FP |
| 258 | Medium | 60 | G2 | ethtool_get_stats | net/ethtool/ioctl.c | array_size(stats.n_stats, sizeof(u64)) | copy_to_user() unvalidated size | no | FP |
| 259 | Medium | 60 | G2 | ethtool_get_tunable | net/ethtool/ioctl.c | tuna.len | copy_to_user() unvalidated size | no | FP |
| 260 | Medium | 60 | G2 | ethtool_rxnfc_copy_from_compat | net/ethtool/ioctl.c | min(size, sizeof(crxnfc)) | copy_from_user() unvalidated size | no | FP |
| 261 | Medium | 60 | G2 | ethtool_rxnfc_copy_from_user | net/ethtool/ioctl.c | size | copy_from_user() unvalidated size | no | FP |
| 262 | Medium | 60 | G2 | ethtool_rxnfc_copy_to_compat | net/ethtool/ioctl.c | min(size, sizeof(crxnfc)) | copy_to_user() unvalidated size | no | FP |
| 263 | Medium | 60 | G2 | ethtool_rxnfc_copy_to_user | net/ethtool/ioctl.c | size | copy_to_user() unvalidated size | no | FP |
| 264 | Medium | 60 | G2 | ethtool_rxnfc_copy_to_user | net/ethtool/ioctl.c | rxnfc->rule_cnt * sizeof(u32) | copy_to_user() unvalidated size | no | FP |
| 265 | Medium | 60 | G2 | ethtool_self_test | net/ethtool/ioctl.c | array_size(test.len, sizeof(u64)) | copy_to_user() unvalidated size | no | FP |
| 266 | Medium | 60 | C | fib_table_lookup | net/ipv4/fib_trie.c | cindex | subscript | no | FP |
| 267 | Medium | 60 | G2 | force_no_mitm_write | net/bluetooth/hci_debugfs.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 268 | Medium | 60 | G2 | get_phy_tunable | net/ethtool/ioctl.c | tuna.len | copy_to_user() unvalidated size | no | FP |
| 269 | Medium | 60 | G2 | hci_get_conn_list | net/bluetooth/hci_conn.c | size | copy_to_user() unvalidated size | no | FP |
| 270 | Medium | 60 | B | ieee80211_assoc_config_link | net/mac80211/mlme.c | elems | memcpy() in ieee80211_eht_cap_ie_to_sta_eht_cap() | no | FP |
| 271 | Medium | 60 | C | ieee80211_assoc_config_link | net/mac80211/mlme.c | elems | subscript (callee) | no | FP |
| 272 | Medium | 60 | B | ieee80211_assoc_config_link | net/mac80211/mlme.c | elems | memcmp() in ieee80211_config_bw() | no | FP |
| 273 | Medium | 60 | C | ieee80211_process_addba_resp | net/mac80211/agg-tx.c | tid | subscript (callee) | no | FP |
| 274 | Medium | 60 | C | ieee80211_process_addba_resp | net/mac80211/agg-tx.c | tid | subscript (callee) | no | FP |
| 275 | Medium | 60 | C | ieee80211_process_addba_resp | net/mac80211/agg-tx.c | tid | subscript | no | FP |
| 276 | Medium | 60 | C | ieee80211_process_addba_resp | net/mac80211/agg-tx.c | tid | subscript | no | FP |
| 277 | Medium | 60 | C | ieee80211_process_delba | net/mac80211/ht.c | tid | subscript (callee) | no | FP |
| 278 | Medium | 60 | C | ieee80211_process_delba | net/mac80211/ht.c | tid | subscript (callee) | no | FP |
| 279 | Medium | 60 | C | ieee80211_process_delba | net/mac80211/ht.c | tid | subscript (callee) | no | FP |
| 280 | Medium | 60 | C | ieee80211_process_delba | net/mac80211/ht.c | tid | subscript (callee) | no | FP |
| 281 | Medium | 60 | C | ieee80211_rx_h_ctrl | net/mac80211/rx.c | tid | subscript | no | FP |
| 282 | Medium | 60 | B | ieee80211_rx_mgmt_beacon | net/mac80211/mlme.c | elems | memcmp() in ieee80211_config_bw() | no | FP |
| 283 | Medium | 60 | G2 | ioctl_private_iw_point | net/wireless/wext-priv.c | extra_size | copy_from_user() unvalidated size | no | FP |
| 284 | Medium | 60 | G2 | ioctl_private_iw_point | net/wireless/wext-priv.c | extra_size | copy_to_user() unvalidated size | no | FP |
| 285 | Medium | 60 | G2 | ip_set_sockfn_get | net/netfilter/ipset/ip_set_core.c | copylen | copy_to_user() unvalidated size | no | FP |
| 286 | Medium | 60 | G2 | ipip6_tunnel_get_prl | net/ipv6/sit.c | len | copy_to_user() unvalidated size | no | FP |
| 287 | Medium | 60 | G2 | lowpan_control_write | net/bluetooth/6lowpan.c | buf_size | copy_from_user() unvalidated size | no | FP |
| 288 | Medium | 60 | G2 | lowpan_ctx_pfx_write | net/6lowpan/debugfs.c | min_t(size_t, sizeof(buf) - 1,
count) | copy_from_user() unvalidated size | no | FP |
| 289 | Medium | 60 | G2 | mctp_ioctl_tag_copy_from_user | net/mctp/af_mctp.c | size | copy_from_user() unvalidated size | no | FP |
| 290 | Medium | 60 | G2 | mctp_ioctl_tag_copy_to_user | net/mctp/af_mctp.c | size | copy_to_user() unvalidated size | no | FP |
| 291 | Medium | 60 | C | mesh_rmc_check | net/mac80211/mesh.c | idx | subscript | no | FP |
| 292 | Medium | 60 | C | mesh_rmc_check | net/mac80211/mesh.c | idx | subscript | no | FP |
| 293 | Medium | 60 | G2 | mptcp_get_subflow_data | net/mptcp/sockopt.c | copylen | copy_from_user() unvalidated size | no | FP |
| 294 | Medium | 60 | G2 | mptcp_put_full_info | net/mptcp/sockopt.c | copylen | copy_to_user() unvalidated size | no | FP |
| 295 | Medium | 60 | G2 | mptcp_put_subflow_data | net/mptcp/sockopt.c | copylen | copy_to_user() unvalidated size | no | FP |
| 296 | Medium | 60 | C | netdev_cmd_to_name | net/core/dev.c | ntohs(type) &
PTYPE_HASH_MASK | subscript | no | FP |
| 297 | Medium | 60 | B | nf_tables_newobj | net/netfilter/nf_tables_api.c | type | memset() in nft_obj_init() | no | FP |
| 298 | Medium | 60 | B | nf_tables_newobj | net/netfilter/nf_tables_api.c | type | kzalloc() in nft_obj_init() | no | FP |
| 299 | Medium | 60 | C | nf_tproxy_get_sock_v6 | net/ipv6/netfilter/nf_tproxy_ipv6.c | ntohs(dport) | subscript (callee) | no | FP |
| 300 | Medium | 60 | G2 | old_deviceless | net/bridge/br_ioctl.c | IFNAMSIZ | copy_from_user() unvalidated size | no | FP |
| 301 | Medium | 60 | G2 | pf | net/core/pktgen.c | max | copy_from_user() unvalidated size | no | FP |
| 302 | Medium | 60 | C | pf | net/core/pktgen.c | t | subscript | no | FP |
| 303 | Medium | 60 | C | pf | net/core/pktgen.c | entry_index | subscript | no | FP |
| 304 | Medium | 60 | C | ptype_head | net/core/dev.c | ntohs(pt->type) & PTYPE_HASH_MASK | subscript | no | FP |
| 305 | Medium | 60 | C | ptype_seq_next | net/core/net-procfs.c | hash | subscript | no | FP |
| 306 | Medium | 60 | G2 | put_cmsg_compat | net/compat.c | cmlen - sizeof(struct compat_cmsghdr) | copy_to_user() unvalidated size | no | FP |
| 307 | Medium | 60 | G2 | put_user_ifreq | net/socket.c | size | copy_to_user() unvalidated size | no | FP |
| 308 | Medium | 60 | C | qrtr_ns_worker | net/qrtr/ns.c | cmd | subscript | no | FP |
| 309 | Medium | 60 | C | rds_cong_clear_bit | net/rds/cong.c | i | subscript | no | FP |
| 310 | Medium | 60 | C | rds_cong_test_bit | net/rds/cong.c | i | subscript | no | FP |
| 311 | Medium | 60 | G2 | rfkill_fop_read | net/rfkill/core.c | sz | copy_to_user() unvalidated size | no | FP |
| 312 | Medium | 60 | G2 | rpc_pipe_generic_upcall | net/sunrpc/rpc_pipe.c | mlen | copy_to_user() unvalidated size | no | FP |
| 313 | Medium | 60 | G2 | rtentry_to_fib_config | net/ipv4/fib_frontend.c | IFNAMSIZ-1 | copy_from_user() unvalidated size | no | FP |
| 314 | Medium | 60 | B | rxgk_yfs_decode_ticket | net/rxrpc/rxgk_app.c | payload_len | kzalloc() | no | FP |
| 315 | Medium | 60 | B | rxrpc_preparse_xdr | net/rxrpc/key.c | toklen | kzalloc() in rxrpc_preparse_xdr_rxkad() | no | FP |
| 316 | Medium | 60 | B | rxrpc_preparse_xdr_rxkad | net/rxrpc/key.c | plen | kzalloc() | no | FP |
| 317 | Medium | 60 | C | sctp_auth_asoc_get_hmac | net/sctp/auth.c | id | subscript (callee) | no | FP |
| 318 | Medium | 60 | C | sctp_auth_asoc_get_hmac | net/sctp/auth.c | id | subscript | no | FP |
| 319 | Medium | 60 | C | sctp_auth_asoc_set_default_hmac | net/sctp/auth.c | id | subscript (callee) | no | FP |
| 320 | Medium | 60 | G2 | sctp_getsockopt_local_addrs | net/sctp/socket.c | bytes_copied | copy_to_user() unvalidated size | no | FP |
| 321 | Medium | 60 | B | sctp_pack_cookie | net/sctp/sm_make_chunk.c | ntohs(init_chunk->chunk_hdr->length) | memcpy() | no | FP |
| 322 | Medium | 60 | C | sctp_process_strreset_addstrm_in | net/sctp/stream.c | i | subscript | no | FP |
| 323 | Medium | 60 | C | sctp_process_strreset_addstrm_out | net/sctp/stream.c | i | subscript | no | FP |
| 324 | Medium | 60 | C | sctp_process_strreset_inreq | net/sctp/stream.c | i | subscript | no | FP |
| 325 | Medium | 60 | C | sctp_process_strreset_inreq | net/sctp/stream.c | i | subscript | no | FP |
| 326 | Medium | 60 | C | sctp_process_strreset_outreq | net/sctp/stream.c | i | subscript | no | FP |
| 327 | Medium | 60 | C | sctp_process_strreset_outreq | net/sctp/stream.c | i | subscript | no | FP |
| 328 | Medium | 60 | C | sctp_process_strreset_tsnreq | net/sctp/stream.c | i | subscript | no | FP |
| 329 | Medium | 60 | C | sctp_sf_authenticate | net/sctp/sm_statefuns.c | ntohs(auth_hdr->hmac_id) | subscript (callee) | no | FP |
| 330 | Medium | 60 | B | send_hci_cmd_sync | net/bluetooth/mgmt.c | skb | memcpy() in mgmt_cmd_complete() | no | FP |
| 331 | Medium | 60 | C | set_sctp_state | net/netfilter/ipvs/ip_vs_proto_sctp.c | chunk_type | subscript | no | FP |
| 332 | Medium | 60 | C | set_sctp_state | net/netfilter/ipvs/ip_vs_proto_sctp.c | event | subscript | no | FP |
| 333 | Medium | 60 | C | set_sctp_state | net/netfilter/ipvs/ip_vs_proto_sctp.c | next_state | subscript | no | FP |
| 334 | Medium | 60 | C | set_sctp_state | net/netfilter/ipvs/ip_vs_proto_sctp.c | next_state | subscript | no | FP |
| 335 | Medium | 60 | G2 | sock_ioctl_inout | net/core/sock.c | size | copy_from_user() unvalidated size | no | FP |
| 336 | Medium | 60 | G2 | sock_ioctl_inout | net/core/sock.c | size | copy_to_user() unvalidated size | no | FP |
| 337 | Medium | 60 | C | tcp4_check_fraglist_gro | net/ipv4/tcp_offload.c | ntohs(th->dest) | subscript (callee) | no | FP |
| 338 | Medium | 60 | C | tcp6_check_fraglist_gro | net/ipv6/tcpv6_offload.c | ntohs(th->dest) | subscript (callee) | no | FP |
| 339 | Medium | 60 | C | tcp_v4_early_demux | net/ipv4/ip_input.c | ntohs(th->dest) | subscript (callee) | no | FP |
| 340 | Medium | 60 | C | tcp_v4_err | net/ipv4/tcp_ipv4.c | ntohs(th->source) | subscript (callee) | no | FP |
| 341 | Medium | 60 | C | tcp_v6_early_demux | net/ipv6/ip6_input.c | ntohs(th->dest) | subscript (callee) | no | FP |
| 342 | Medium | 60 | C | tcp_v6_err | net/ipv6/tcp_ipv6.c | ntohs(th->source) | subscript (callee) | no | FP |
| 343 | Medium | 60 | C | tipc_rcv | net/tipc/node.c | ntohl(ehdr->addr) | subscript (callee) | no | FP |
| 344 | Medium | 60 | C | tkip_mixing_phase1 | net/mac80211/tkip.c | p1k[4] ^ get_unaligned_le16(tk + 0 + j) | subscript (callee) | no | FP |
| 345 | Medium | 60 | C | tkip_mixing_phase1 | net/mac80211/tkip.c | p1k[0] ^ get_unaligned_le16(tk + 4 + j) | subscript (callee) | no | FP |
| 346 | Medium | 60 | C | tkip_mixing_phase1 | net/mac80211/tkip.c | p1k[1] ^ get_unaligned_le16(tk + 8 + j) | subscript (callee) | no | FP |
| 347 | Medium | 60 | C | tkip_mixing_phase1 | net/mac80211/tkip.c | p1k[2] ^ get_unaligned_le16(tk + 12 + j) | subscript (callee) | no | FP |
| 348 | Medium | 60 | C | tkip_mixing_phase1 | net/mac80211/tkip.c | p1k[3] ^ get_unaligned_le16(tk + 0 + j) | subscript (callee) | no | FP |
| 349 | Medium | 60 | C | tkip_mixing_phase2 | net/mac80211/tkip.c | ppk[5] ^ get_unaligned_le16(tk + 0) | subscript (callee) | no | FP |
| 350 | Medium | 60 | C | tkip_mixing_phase2 | net/mac80211/tkip.c | ppk[0] ^ get_unaligned_le16(tk + 2) | subscript (callee) | no | FP |
| 351 | Medium | 60 | C | tkip_mixing_phase2 | net/mac80211/tkip.c | ppk[1] ^ get_unaligned_le16(tk + 4) | subscript (callee) | no | FP |
| 352 | Medium | 60 | C | tkip_mixing_phase2 | net/mac80211/tkip.c | ppk[2] ^ get_unaligned_le16(tk + 6) | subscript (callee) | no | FP |
| 353 | Medium | 60 | C | tkip_mixing_phase2 | net/mac80211/tkip.c | ppk[3] ^ get_unaligned_le16(tk + 8) | subscript (callee) | no | FP |
| 354 | Medium | 60 | C | tkip_mixing_phase2 | net/mac80211/tkip.c | ppk[4] ^ get_unaligned_le16(tk + 10) | subscript (callee) | no | FP |
| 355 | Medium | 60 | B | virtio_transport_build_skb | net/vmw_vsock/virtio_transport_common.c | hdr | memset() | no | FP |
| 356 | Medium | 60 | C | xfrm_replay_check_bmp | net/xfrm/xfrm_replay.c | nr | subscript | no | FP |
| 357 | Medium | 60 | C | xfrm_replay_check_esn | net/xfrm/xfrm_replay.c | nr | subscript | no | FP |
| 358 | Medium | 60 | C | xfrmi4_err | net/xfrm/xfrm_interface_core.c | x | subscript (callee) | no | FP |
| 359 | Medium | 60 | C | xfrmi6_err | net/xfrm/xfrm_interface_core.c | x | subscript (callee) | no | FP |
| 360 | Medium | 60 | G2 | xt_data_to_user | net/netfilter/x_tables.c | usersize | copy_to_user() unvalidated size | no | FP |
| 361 | Medium | 60 | G2 | xt_obj_to_user | net/netfilter/x_tables.c | strlen(name) + 1 | copy_to_user() unvalidated size | no | FP |
| 362 | Low | 50 | E | __regdb_query_wmm | net/wireless/reg.c | rule | rule->? | yes? | FP |
| 363 | Low | 50 | E | __regdb_query_wmm | net/wireless/reg.c | rule | rule->? | yes? | FP |
| 364 | Low | 50 | E | __regdb_query_wmm | net/wireless/reg.c | rule | rule->? | yes? | FP |
| 365 | Low | 50 | E | __regdb_query_wmm | net/wireless/reg.c | rule | rule->? | yes? | FP |
| 366 | Low | 50 | E | __regdb_query_wmm | net/wireless/reg.c | rule | rule->? | yes? | FP |
| 367 | Low | 50 | E | __regdb_query_wmm | net/wireless/reg.c | rule | rule->? | yes? | FP |
| 368 | Low | 50 | E | __regdb_query_wmm | net/wireless/reg.c | rule | rule->? | yes? | FP |
| 369 | Low | 50 | E | __regdb_query_wmm | net/wireless/reg.c | rule | rule->? | yes? | FP |
| 370 | Low | 50 | F | batadv_send_other_tt_response | net/batman-adv/translation-table.c | ntohs(tt_data->num_vlan) | loop bound | no | FP |
| 371 | Low | 50 | F | batadv_tvlv_ogm_receive | net/batman-adv/tvlv.c | tvlv_value_len | loop bound | no | FP |
| 372 | Low | 50 | F | br_ip4_multicast_igmp3_report | net/bridge/br_multicast.c | num | loop bound | no | FP |
| 373 | Low | 50 | F | br_ip6_multicast_mld2_report | net/bridge/br_multicast.c | num | loop bound | no | FP |
| 374 | Low | 50 | F | cipso_v4_map_cat_rng_ntoh | net/ipv4/cipso_ipv4.c | cat_low | loop bound | no | FP |
| 375 | Low | 50 | F | cipso_v4_map_cat_rng_ntoh | net/ipv4/cipso_ipv4.c | cat_high | loop bound | no | FP |
| 376 | Low | 50 | F | ethtool_cmis_cdb_execute_epl_cmd | net/ethtool/cmis_cdb.c | epl_len | loop bound | no | FP |
| 377 | Low | 50 | F | ethtool_cmis_cdb_execute_epl_cmd | net/ethtool/cmis_cdb.c | epl_len | loop bound | no | FP |
| 378 | Low | 50 | F | hash_by_src | net/netfilter/nf_nat_core.c | attempts | loop bound | no | FP |
| 379 | Low | 50 | F | hash_ip4_uadt | net/netfilter/ipset/ip_set_hash_ip.c | ip | loop bound | no | FP |
| 380 | Low | 50 | F | hash_ipmark4_uadt | net/netfilter/ipset/ip_set_hash_ipmark.c | ip | loop bound | no | FP |
| 381 | Low | 50 | F | hash_ipport4_uadt | net/netfilter/ipset/ip_set_hash_ipport.c | ip | loop bound | no | FP |
| 382 | Low | 50 | F | hash_ipport4_uadt | net/netfilter/ipset/ip_set_hash_ipport.c | p | loop bound | no | FP |
| 383 | Low | 50 | F | hash_ipport6_uadt | net/netfilter/ipset/ip_set_hash_ipport.c | port | loop bound | no | FP |
| 384 | Low | 50 | F | hash_ipportip4_uadt | net/netfilter/ipset/ip_set_hash_ipportip.c | ip | loop bound | no | FP |
| 385 | Low | 50 | F | hash_ipportip4_uadt | net/netfilter/ipset/ip_set_hash_ipportip.c | p | loop bound | no | FP |
| 386 | Low | 50 | F | hash_ipportip6_uadt | net/netfilter/ipset/ip_set_hash_ipportip.c | port | loop bound | no | FP |
| 387 | Low | 50 | F | hash_ipportnet4_uadt | net/netfilter/ipset/ip_set_hash_ipportnet.c | ip | loop bound | no | FP |
| 388 | Low | 50 | F | hash_ipportnet4_uadt | net/netfilter/ipset/ip_set_hash_ipportnet.c | p | loop bound | no | FP |
| 389 | Low | 50 | F | hash_ipportnet4_uadt | net/netfilter/ipset/ip_set_hash_ipportnet.c | ip2 | loop bound | no | FP |
| 390 | Low | 50 | F | hash_ipportnet6_uadt | net/netfilter/ipset/ip_set_hash_ipportnet.c | port | loop bound | no | FP |
| 391 | Low | 50 | F | hash_net4_uadt | net/netfilter/ipset/ip_set_hash_net.c | ip | loop bound | no | FP |
| 392 | Low | 50 | F | hash_netiface4_uadt | net/netfilter/ipset/ip_set_hash_netiface.c | ip | loop bound | no | FP |
| 393 | Low | 50 | F | hash_netnet4_uadt | net/netfilter/ipset/ip_set_hash_netnet.c | ip | loop bound | no | FP |
| 394 | Low | 50 | F | hash_netnet4_uadt | net/netfilter/ipset/ip_set_hash_netnet.c | ip2 | loop bound | no | FP |
| 395 | Low | 50 | F | hash_netport4_uadt | net/netfilter/ipset/ip_set_hash_netport.c | ip | loop bound | no | FP |
| 396 | Low | 50 | F | hash_netport4_uadt | net/netfilter/ipset/ip_set_hash_netport.c | p | loop bound | no | FP |
| 397 | Low | 50 | F | hash_netport6_uadt | net/netfilter/ipset/ip_set_hash_netport.c | port | loop bound | no | FP |
| 398 | Low | 50 | F | hash_netportnet4_uadt | net/netfilter/ipset/ip_set_hash_netportnet.c | ip | loop bound | no | FP |
| 399 | Low | 50 | F | hash_netportnet4_uadt | net/netfilter/ipset/ip_set_hash_netportnet.c | p | loop bound | no | FP |
| 400 | Low | 50 | F | hash_netportnet4_uadt | net/netfilter/ipset/ip_set_hash_netportnet.c | ip2 | loop bound | no | FP |
| 401 | Low | 50 | F | hash_netportnet6_uadt | net/netfilter/ipset/ip_set_hash_netportnet.c | port | loop bound | no | FP |
| 402 | Low | 50 | F | ic_bootp_recv | net/ipv4/ipconfig.c | end | loop bound | no | FP |
| 403 | Low | 50 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->ident | yes? | FP |
| 404 | Low | 50 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->ident | yes? | FP |
| 405 | Low | 50 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->ident | yes? | FP |
| 406 | Low | 50 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->ident | yes? | FP |
| 407 | Low | 50 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->ident | yes? | FP |
| 408 | Low | 50 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->ident | yes? | FP |
| 409 | Low | 50 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->ident | yes? | FP |
| 410 | Low | 50 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->ident | yes? | FP |
| 411 | Low | 50 | E | icmp_build_probe | net/ipv4/icmp.c | iio | iio->ident | yes? | FP |
| 412 | Low | 50 | A | ieee80211_rx_h_defragment | net/mac80211/rx.c | entry | memcpy() in pskb_expand_head() | yes? | FP |
| 413 | Low | 50 | A | ieee80211_rx_h_defragment | net/mac80211/rx.c | entry | memcpy() in pskb_expand_head() | yes? | FP |
| 414 | Low | 50 | F | ieee80211_rx_mgmt_beacon | net/mac80211/mlme.c | elems | loop bound | no | FP |
| 415 | Low | 50 | F | iptfs_input_ordered | net/xfrm/xfrm_iptfs.c | data | loop bound | no | FP |
| 416 | Low | 50 | F | netlbl_af6list_audit_addr | net/netlabel/netlabel_addrlist.c | mask_val | loop bound | no | FP |
| 417 | Low | 50 | E | nf_tables_newrule | net/netfilter/nf_tables_api.c | rule | rule->handle | yes? | FP |
| 418 | Low | 50 | E | nf_tables_newrule | net/netfilter/nf_tables_api.c | rule | rule->dlen | yes? | FP |
| 419 | Low | 50 | E | nf_tables_newrule | net/netfilter/nf_tables_api.c | rule | rule->udata | yes? | FP |
| 420 | Low | 50 | E | nf_tables_newrule | net/netfilter/nf_tables_api.c | rule | rule->list | yes? | FP |
| 421 | Low | 50 | E | nf_tables_newrule | net/netfilter/nf_tables_api.c | rule | rule->list | yes? | FP |
| 422 | Low | 50 | E | nf_tables_newrule | net/netfilter/nf_tables_api.c | rule | rule->list | yes? | FP |
| 423 | Low | 50 | E | nf_tables_newrule | net/netfilter/nf_tables_api.c | rule | rule->list | yes? | FP |
| 424 | Low | 50 | E | nf_tables_newrule | net/netfilter/nf_tables_api.c | rule | rule->list | yes? | FP |
| 425 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->data | yes? | FP |
| 426 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->bindings | yes? | FP |
| 427 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->catchall_list | yes? | FP |
| 428 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->refs | yes? | FP |
| 429 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->table | yes? | FP |
| 430 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->net | yes? | FP |
| 431 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->ops | yes? | FP |
| 432 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->ktype | yes? | FP |
| 433 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->klen | yes? | FP |
| 434 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->dtype | yes? | FP |
| 435 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->objtype | yes? | FP |
| 436 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->dlen | yes? | FP |
| 437 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->flags | yes? | FP |
| 438 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->size | yes? | FP |
| 439 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->policy | yes? | FP |
| 440 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->udlen | yes? | FP |
| 441 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->udata | yes? | FP |
| 442 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->timeout | yes? | FP |
| 443 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->gc_int | yes? | FP |
| 444 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->field_count | yes? | FP |
| 445 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->field_len | yes? | FP |
| 446 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->exprs | yes? | FP |
| 447 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->num_exprs | yes? | FP |
| 448 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->handle | yes? | FP |
| 449 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->pending_update | yes? | FP |
| 450 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->list | yes? | FP |
| 451 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->num_exprs | yes? | FP |
| 452 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->exprs | yes? | FP |
| 453 | Low | 50 | E | nf_tables_newset | net/netfilter/nf_tables_api.c | set | set->name | yes? | FP |
| 454 | Low | 50 | F | prep_next_sparse_read | net/ceph/osd_client.c | req | loop bound | no | FP |
| 455 | Low | 50 | F | rds_ib_xmit | net/rds/ib_send.c | i | loop bound | no | FP |
| 456 | Low | 50 | E | regdb_query_country | net/wireless/reg.c | rule | rule->? | yes? | FP |
| 457 | Low | 50 | E | regdb_query_country | net/wireless/reg.c | rule | rule->? | yes? | FP |
| 458 | Low | 50 | E | regdb_query_country | net/wireless/reg.c | rule | rule->? | yes? | FP |
| 459 | Low | 50 | E | regdb_query_country | net/wireless/reg.c | rule | rule->? | yes? | FP |
| 460 | Low | 50 | F | regdb_query_country | net/wireless/reg.c | regdom | loop bound | no | FP |
| 461 | Low | 50 | F | rxrpc_preparse_xdr | net/rxrpc/key.c | loop | loop bound | no | FP |
| 462 | Low | 50 | F | sctp_acked | net/sctp/outqueue.c | blocks | loop bound | no | FP |
| 463 | Low | 50 | F | sctp_check_transmitted | net/sctp/outqueue.c | tsn | loop bound | no | FP |
| 464 | Low | 50 | E | sctp_eat_data | net/sctp/sm_statefuns.c | tsn | tsn->? | yes? | FP |
| 465 | Low | 50 | F | sctp_getsockopt_hmac_ident | net/sctp/socket.c | num_idents | loop bound | no | FP |
| 466 | Low | 50 | F | sctp_process_asconf_ack | net/sctp/sm_make_chunk.c | asconf_param | loop bound | no | FP |
| 467 | Low | 50 | F | sctp_process_param | net/sctp/sm_make_chunk.c | sat | loop bound | no | FP |
| 468 | Low | 50 | F | sctp_process_strreset_inreq | net/sctp/stream.c | i | loop bound | no | FP |
| 469 | Low | 50 | E | sctp_process_strreset_inreq | net/sctp/stream.c | i | i->state | yes? | FP |
| 470 | Low | 50 | E | sctp_process_strreset_inreq | net/sctp/stream.c | i | i->state | yes? | FP |
| 471 | Low | 50 | F | sctp_process_strreset_outreq | net/sctp/stream.c | i | loop bound | no | FP |
| 472 | Low | 50 | E | sctp_process_strreset_outreq | net/sctp/stream.c | i | i->mid | yes? | FP |
| 473 | Low | 50 | E | sctp_process_strreset_outreq | net/sctp/stream.c | i | i->mid | yes? | FP |
| 474 | Low | 50 | F | sctp_process_strreset_outreq | net/sctp/stream.c | nums | loop bound | no | FP |
| 475 | Low | 50 | F | sctp_process_strreset_resp | net/sctp/stream.c | number | loop bound | no | FP |
| 476 | Low | 50 | F | sctp_process_strreset_resp | net/sctp/stream.c | nums | loop bound | no | FP |
| 477 | Low | 50 | F | sctp_process_strreset_resp | net/sctp/stream.c | nums | loop bound | no | FP |
| 478 | Low | 50 | F | sctp_process_strreset_tsnreq | net/sctp/stream.c | i | loop bound | no | FP |
| 479 | Low | 50 | F | sctp_process_strreset_tsnreq | net/sctp/stream.c | i | loop bound | no | FP |
| 480 | Low | 50 | F | sctp_sack_update_unack_data | net/sctp/outqueue.c | (inline) | loop bound | no | FP |
| 481 | Low | 50 | E | set_sctp_state | net/netfilter/ipvs/ip_vs_proto_sctp.c | sch | sch->type | yes? | FP |
| 482 | Low | 50 | F | skb_checksum_setup_ipv6 | net/core/skbuff.c | len | loop bound | no | FP |
| 483 | Low | 50 | F | tipc_nl_compat_name_table_dump_header | net/tipc/netlink_compat.c | depth | loop bound | no | FP |
| 484 | Low | 50 | E | valid_country | net/wireless/reg.c | rule_ptr | rule_ptr->? | yes? | FP |
| 485 | Low | 50 | E | valid_country | net/wireless/reg.c | rule_ptr | rule_ptr->? | yes? | FP |
| 486 | Low | 50 | E | valid_country | net/wireless/reg.c | rule_ptr | rule_ptr->? | yes? | FP |
| 487 | Low | 50 | E | valid_country | net/wireless/reg.c | coll | coll->len | yes? | FP |
| 488 | Low | 50 | E | valid_country | net/wireless/reg.c | coll | coll->n_rules | yes? | FP |
| 489 | Low | 50 | E | valid_country | net/wireless/reg.c | coll | coll->len | yes? | FP |
| 490 | Low | 50 | E | valid_country | net/wireless/reg.c | coll | coll->len | yes? | FP |
| 491 | Low | 50 | E | valid_country | net/wireless/reg.c | coll | coll->n_rules | yes? | FP |
| 492 | Low | 40 | C | __input_process_payload | net/xfrm/xfrm_iptfs.c | skb | subscript (callee) | yes? | FP |
| 493 | Low | 40 | H | ar9331_tag_rcv | net/dsa/tag_ar9331.c | ver | truncation | no | FP |
| 494 | Low | 40 | H | ar9331_tag_rcv | net/dsa/tag_ar9331.c | port | truncation | no | FP |
| 495 | Low | 40 | H | batadv_frag_insert_packet | net/batman-adv/fragmentation.c | bucket | truncation | no | FP |
| 496 | Low | 40 | H | cfg80211_parse_ml_elem_sta_data | net/wireless/scan.c | link_id | truncation | no | FP |
| 497 | Low | 40 | H | cfg80211_parse_ml_elem_sta_data | net/wireless/scan.c | use_for | truncation | no | FP |
| 498 | Low | 40 | H | ebt_vlan_mt | net/bridge/netfilter/ebt_vlan.c | prio | truncation | no | FP |
| 499 | Low | 40 | B | hci_le_per_adv_report_evt | net/bluetooth/hci_event.c | pa_sync | memcmp() in mgmt_device_connected() | yes? | FP |
| 500 | Low | 40 | C | hci_sock_sendmsg | net/bluetooth/hci_sock.c | ogf | subscript | yes? | FP |
| 501 | Low | 40 | B | icmp_build_probe | net/ipv4/icmp.c | ident_len | memcpy() | yes? | FP |
| 502 | Low | 40 | H | ieee80211_apply_vhtcap_overrides | net/mac80211/vht.c | m | truncation | no | FP |
| 503 | Low | 40 | H | ieee80211_apply_vhtcap_overrides | net/mac80211/vht.c | c | truncation | no | FP |
| 504 | Low | 40 | H | ieee80211_apply_vhtcap_overrides | net/mac80211/vht.c | m | truncation | no | FP |
| 505 | Low | 40 | H | ieee80211_apply_vhtcap_overrides | net/mac80211/vht.c | c | truncation | no | FP |
| 506 | Low | 40 | H | ieee80211_assoc_config_link | net/mac80211/mlme.c | elems | truncation | no | FP |
| 507 | Low | 40 | B | ieee80211_assoc_config_link | net/mac80211/mlme.c | elems | memcpy() in ieee80211_eht_cap_ie_to_sta_eht_cap() | yes? | FP |
| 508 | Low | 40 | H | ieee80211_eht_cap_ie_to_sta_eht_cap | net/mac80211/eht.c | eht_ppe_size | truncation | no | FP |
| 509 | Low | 40 | B | ieee80211_eht_cap_ie_to_sta_eht_cap | net/mac80211/eht.c | eht_ppe_size | memcpy() | yes? | FP |
| 510 | Low | 40 | H | ieee80211_max_rx_chains | net/mac80211/mlme.c | mcs_80 | truncation | no | FP |
| 511 | Low | 40 | H | ieee80211_max_rx_chains | net/mac80211/mlme.c | mcs_160 | truncation | no | FP |
| 512 | Low | 40 | B | ieee80211_mesh_rx_bcn_presp | net/mac80211/mesh.c | elems | memcmp() in mesh_matches_local() | yes? | FP |
| 513 | Low | 40 | H | ieee80211_ml_epcs | net/mac80211/mlme.c | link_id | truncation | no | FP |
| 514 | Low | 40 | C | ieee80211_ml_epcs | net/mac80211/mlme.c | link_id | subscript | yes? | FP |
| 515 | Low | 40 | H | ieee80211_ml_reconfiguration | net/mac80211/mlme.c | link_id | truncation | no | FP |
| 516 | Low | 40 | C | ieee80211_ml_reconfiguration | net/mac80211/mlme.c | link_id | subscript | yes? | FP |
| 517 | Low | 40 | C | ieee80211_ml_reconfiguration | net/mac80211/mlme.c | link_id | subscript | yes? | FP |
| 518 | Low | 40 | C | ieee80211_ml_reconfiguration | net/mac80211/mlme.c | link_id | subscript | yes? | FP |
| 519 | Low | 40 | C | ieee80211_ml_reconfiguration | net/mac80211/mlme.c | link_id | subscript | yes? | FP |
| 520 | Low | 40 | C | ieee80211_process_addba_request | net/mac80211/agg-rx.c | tid | subscript (callee) | yes? | FP |
| 521 | Low | 40 | C | ieee80211_process_addba_request | net/mac80211/agg-rx.c | tid | subscript (callee) | yes? | FP |
| 522 | Low | 40 | C | ieee80211_process_addba_request | net/mac80211/agg-rx.c | tid | subscript (callee) | yes? | FP |
| 523 | Low | 40 | C | ieee80211_process_addba_request | net/mac80211/agg-rx.c | tid | subscript (callee) | yes? | FP |
| 524 | Low | 40 | H | ieee80211_rx_mgmt_beacon | net/mac80211/mlme.c | elems | truncation | no | FP |
| 525 | Low | 40 | C | ieee80211_rx_mgmt_beacon | net/mac80211/mlme.c | elems | subscript (callee) | yes? | FP |
| 526 | Low | 40 | C | ieee80211_rx_mgmt_beacon | net/mac80211/mlme.c | elems | subscript (callee) | yes? | FP |
| 527 | Low | 40 | C | ieee80211_rx_mgmt_beacon | net/mac80211/mlme.c | elems | subscript (callee) | yes? | FP |
| 528 | Low | 40 | C | ieee80211_rx_mgmt_beacon | net/mac80211/mlme.c | elems | subscript (callee) | yes? | FP |
| 529 | Low | 40 | B | ieee80211_rx_mgmt_beacon | net/mac80211/mlme.c | elems | memcmp() in ieee80211_mgd_ssid_mismatch() | yes? | FP |
| 530 | Low | 40 | H | ieee80211_rx_mgmt_beacon | net/mac80211/mlme.c | erp_value | truncation | no | FP |
| 531 | Low | 40 | H | ieee80211_rx_uhr_link_reconfig_req | net/mac80211/ap.c | link_id | truncation | no | FP |
| 532 | Low | 40 | C | ieee80211_rx_uhr_link_reconfig_req | net/mac80211/ap.c | link_id | subscript | yes? | FP |
| 533 | Low | 40 | C | ieee80211_rx_uhr_link_reconfig_req | net/mac80211/ap.c | link_id | subscript | yes? | FP |
| 534 | Low | 40 | H | ieee80211_sta_nss_capability | net/mac80211/sta_info.c | mcs_160 | truncation | no | FP |
| 535 | Low | 40 | H | ieee80211_sta_nss_capability | net/mac80211/sta_info.c | mcs_80 | truncation | no | FP |
| 536 | Low | 40 | H | ieee80211_sta_nss_capability | net/mac80211/sta_info.c | mcs | truncation | no | FP |
| 537 | Low | 40 | H | ieee80211_verify_peer_he_mcs_support | net/mac80211/mlme.c | ap_op_val | truncation | no | FP |
| 538 | Low | 40 | H | ieee80211_verify_sta_he_mcs_support | net/mac80211/mlme.c | sta_rx_val | truncation | no | FP |
| 539 | Low | 40 | H | ieee80211_verify_sta_he_mcs_support | net/mac80211/mlme.c | sta_tx_val | truncation | no | FP |
| 540 | Low | 40 | H | ieee80211_verify_sta_he_mcs_support | net/mac80211/mlme.c | ap_val | truncation | no | FP |
| 541 | Low | 40 | H | ieee80211_verify_sta_vht_mcs_support | net/mac80211/mlme.c | ap_op_val | truncation | no | FP |
| 542 | Low | 40 | H | ieee80211_verify_sta_vht_mcs_support | net/mac80211/mlme.c | sta_rx_val | truncation | no | FP |
| 543 | Low | 40 | H | ieee80211_verify_sta_vht_mcs_support | net/mac80211/mlme.c | sta_tx_val | truncation | no | FP |
| 544 | Low | 40 | C | ip_vs_proc_sync_conn | net/netfilter/ipvs/ip_vs_sync.c | state | subscript (callee) | yes? | FP |
| 545 | Low | 40 | C | ip_vs_process_message_v0 | net/netfilter/ipvs/ip_vs_sync.c | state | subscript (callee) | yes? | FP |
| 546 | Low | 40 | H | ksz_xmit_timestamp | net/dsa/tag_ksz.c | tstamp_raw | truncation | no | FP |
| 547 | Low | 40 | B | l2tp_ip6_recv | net/l2tp/l2tp_ip6.c | session | memcmp() in l2tp_recv_common() | yes? | FP |
| 548 | Low | 40 | B | l2tp_ip_recv | net/l2tp/l2tp_ip.c | session | memcmp() in l2tp_recv_common() | yes? | FP |
| 549 | Low | 40 | B | l2tp_udp_encap_recv | net/l2tp/l2tp_core.c | session | memcmp() in l2tp_recv_common() | yes? | FP |
| 550 | Low | 40 | C | mesh_process_plink_frame | net/mac80211/mesh_plink.c | event | subscript (callee) | yes? | FP |
| 551 | Low | 40 | H | mesh_rmc_check | net/mac80211/mesh.c | idx | truncation | no | FP |
| 552 | Low | 40 | H | nf_tables_newchain | net/netfilter/nf_tables_api.c | policy | truncation | no | FP |
| 553 | Low | 40 | H | nf_tables_newrule | net/netfilter/nf_tables_api.c | err | truncation | no | FP |
| 554 | Low | 40 | H | nf_tables_newrule | net/netfilter/nf_tables_api.c | err | truncation | no | FP |
| 555 | Low | 40 | H | nf_tables_newrule | net/netfilter/nf_tables_api.c | err | truncation | no | FP |
| 556 | Low | 40 | B | nf_tables_newset | net/netfilter/nf_tables_api.c | alloc_size | kvzalloc() | yes? | FP |
| 557 | Low | 40 | C | nfnl_hook_dump_start | net/netfilter/nfnetlink_hook.c | hooknum | subscript (callee) | yes? | FP |
| 558 | Low | 40 | C | nfnl_hook_dump_start | net/netfilter/nfnetlink_hook.c | hooknum | subscript (callee) | yes? | FP |
| 559 | Low | 40 | C | nfnl_hook_dump_start | net/netfilter/nfnetlink_hook.c | hooknum | subscript (callee) | yes? | FP |
| 560 | Low | 40 | C | nfnl_hook_dump_start | net/netfilter/nfnetlink_hook.c | hooknum | subscript (callee) | yes? | FP |
| 561 | Low | 40 | H | nl80211_send_iftype_data | net/wireless/nl80211.c | ppe_thresh_size | truncation | no | FP |
| 562 | Low | 40 | H | pf | net/core/pktgen.c | entry_index | truncation | no | FP |
| 563 | Low | 40 | C | pptp_inbound_pkt | net/ipv4/netfilter/nf_nat_pptp.c | msg | subscript (callee) | yes? | FP |
| 564 | Low | 40 | C | pptp_outbound_pkt | net/ipv4/netfilter/nf_nat_pptp.c | msg | subscript (callee) | yes? | FP |
| 565 | Low | 40 | C | ptype_seq_next | net/core/net-procfs.c | hash | subscript | yes? | FP |
| 566 | Low | 40 | H | qca_tag_rcv | net/dsa/tag_qca.c | ver | truncation | no | FP |
| 567 | Low | 40 | H | qca_tag_rcv | net/dsa/tag_qca.c | pk_type | truncation | no | FP |
| 568 | Low | 40 | C | qrtr_ns_worker | net/qrtr/ns.c | cmd | subscript | yes? | FP |
| 569 | Low | 40 | B | rds_add_bound | net/rds/bind.c | rover | memcpy() in __rds_create_bind_key() | yes? | FP |
| 570 | Low | 40 | H | rtl4a_tag_rcv | net/dsa/tag_rtl4_a.c | prot | truncation | no | FP |
| 571 | Low | 40 | H | rtl4a_tag_rcv | net/dsa/tag_rtl4_a.c | port | truncation | no | FP |
| 572 | Low | 40 | H | rtl8_4_read_tag | net/dsa/tag_rtl8_4.c | proto | truncation | no | FP |
| 573 | Low | 40 | H | rtl8_4_read_tag | net/dsa/tag_rtl8_4.c | reason | truncation | no | FP |
| 574 | Low | 40 | H | rtl8_4_read_tag | net/dsa/tag_rtl8_4.c | port | truncation | no | FP |
| 575 | Low | 40 | B | rxgk_yfs_decode_ticket | net/rxrpc/rxgk_app.c | klen | memcpy() | yes? | FP |
| 576 | Low | 40 | H | rxkad_verify_packet | net/rxrpc/rxkad.c | cksum | truncation | no | FP |
| 577 | Low | 40 | H | rxkad_verify_packet_1 | net/rxrpc/rxkad.c | check | truncation | no | FP |
| 578 | Low | 40 | H | rxkad_verify_packet_2 | net/rxrpc/rxkad.c | check | truncation | no | FP |
| 579 | Low | 40 | B | rxrpc_preparse_xdr | net/rxrpc/key.c | toklen | memcpy() in rxrpc_preparse_xdr_rxkad() | yes? | FP |
| 580 | Low | 40 | B | rxrpc_preparse_xdr | net/rxrpc/key.c | toklen | kzalloc() in rxrpc_preparse_xdr_yfs_rxgk() | yes? | FP |
| 581 | Low | 40 | B | rxrpc_preparse_xdr | net/rxrpc/key.c | toklen | kzalloc() in rxrpc_preparse_xdr_yfs_rxgk() | yes? | FP |
| 582 | Low | 40 | B | rxrpc_preparse_xdr_rxkad | net/rxrpc/key.c | tktlen | memcpy() | yes? | FP |
| 583 | Low | 40 | B | rxrpc_preparse_xdr_yfs_rxgk | net/rxrpc/key.c | raw_keylen | kzalloc() | yes? | FP |
| 584 | Low | 40 | B | rxrpc_preparse_xdr_yfs_rxgk | net/rxrpc/key.c | tktlen | kzalloc() | yes? | FP |
| 585 | Low | 40 | H | sctp_acked | net/sctp/outqueue.c | tsn_offset | truncation | no | FP |
| 586 | Low | 40 | B | sctp_auth_make_key_vector | net/sctp/auth.c | len | kmalloc() in sctp_auth_create_key() | yes? | FP |
| 587 | Low | 40 | C | sctp_get_port_local | net/sctp/socket.c | snum | subscript | yes? | FP |
| 588 | Low | 40 | H | sctp_outq_flush_data | net/sctp/outqueue.c | stream_state | truncation | no | FP |
| 589 | Low | 40 | H | sctp_process_strreset_addstrm_in | net/sctp/stream.c | i | truncation | no | FP |
| 590 | Low | 40 | H | sctp_process_strreset_addstrm_out | net/sctp/stream.c | i | truncation | no | FP |
| 591 | Low | 40 | H | sctp_process_strreset_inreq | net/sctp/stream.c | i | truncation | no | FP |
| 592 | Low | 40 | C | sctp_process_strreset_inreq | net/sctp/stream.c | i | subscript | yes? | FP |
| 593 | Low | 40 | H | sctp_process_strreset_outreq | net/sctp/stream.c | i | truncation | no | FP |
| 594 | Low | 40 | C | sctp_process_strreset_outreq | net/sctp/stream.c | i | subscript | yes? | FP |
| 595 | Low | 40 | H | sctp_process_strreset_tsnreq | net/sctp/stream.c | i | truncation | no | FP |
| 596 | Low | 40 | B | sctp_sf_authenticate | net/sctp/sm_statefuns.c | sig_len | memset() | yes? | FP |
| 597 | Low | 40 | C | send_hci_cmd_sync | net/bluetooth/mgmt.c | skb | subscript (callee) | yes? | FP |
| 598 | Low | 40 | C | set_sctp_state | net/netfilter/ipvs/ip_vs_proto_sctp.c | next_state | subscript (callee) | yes? | FP |
| 599 | Low | 40 | C | set_sctp_state | net/netfilter/ipvs/ip_vs_proto_sctp.c | next_state | subscript (callee) | yes? | FP |
| 600 | Low | 40 | H | skb_mpls_dec_ttl | net/core/skbuff.c | ttl | truncation | no | FP |
| 601 | Low | 40 | C | smc_rtoken_set | net/smc/smc_core.c | rtok_idx | subscript | yes? | FP |
| 602 | Low | 40 | C | smc_rtoken_set | net/smc/smc_core.c | rtok_idx | subscript | yes? | FP |
| 603 | Low | 40 | H | udp_compress | net/6lowpan/nhc_udp.c | tmp | truncation | no | FP |
| 604 | Low | 40 | H | udp_compress | net/6lowpan/nhc_udp.c | tmp | truncation | no | FP |
| 605 | Low | 40 | H | udp_compress | net/6lowpan/nhc_udp.c | tmp | truncation | no | FP |
| 606 | Low | 40 | C | xfrm_input | net/xfrm/xfrm_input.c | x | subscript (callee) | yes? | FP |
| 607 | Low | 30 | F | batadv_recv_mcast_packet | net/batman-adv/routing.c | tvlv_buff_len | loop bound | yes? | FP |
| 608 | Low | 30 | F | batadv_recv_unicast_tvlv | net/batman-adv/routing.c | tvlv_buff_len | loop bound | yes? | FP |
| 609 | Low | 30 | F | bnep_ctrl_set_mcfilter | net/bluetooth/bnep/core.c | n | loop bound | yes? | FP |
| 610 | Low | 30 | F | bnep_ctrl_set_netfilter | net/bluetooth/bnep/core.c | n | loop bound | yes? | FP |
| 611 | Low | 30 | F | br_ip4_multicast_igmp3_report | net/bridge/br_multicast.c | nsrcs | loop bound | yes? | FP |
| 612 | Low | 30 | F | br_ip6_multicast_mld2_report | net/bridge/br_multicast.c | nsrcs | loop bound | yes? | FP |
| 613 | Low | 30 | F | get_reply | net/ceph/osd_client.c | req | loop bound | yes? | FP |
| 614 | Low | 30 | F | handle_reply | net/ceph/osd_client.c | req | loop bound | yes? | FP |
| 615 | Low | 30 | F | ic_bootp_recv | net/ipv4/ipconfig.c | end | loop bound | yes? | FP |
| 616 | Low | 30 | F | ieee80211_process_addba_request | net/mac80211/agg-rx.c | buf_size | loop bound | yes? | FP |
| 617 | Low | 30 | F | ieee80211_rx_mgmt_assoc_resp | net/mac80211/mlme.c | status_code | loop bound | yes? | FP |
| 618 | Low | 30 | F | igmp_heard_query | net/ipv4/igmp.c | ntohs(ih3->nsrcs) | loop bound | yes? | FP |
| 619 | Low | 30 | F | ip_vs_process_message | net/netfilter/ipvs/ip_vs_sync.c | msg_end | loop bound | yes? | FP |
| 620 | Low | 30 | F | mrp_pdu_parse_vecattr | net/802/mrp.c | valen | loop bound | yes? | FP |
| 621 | Low | 30 | F | netlbl_af4list_audit_addr | net/netlabel/netlabel_addrlist.c | mask_val | loop bound | yes? | FP |
| 622 | Low | 30 | F | nf_tables_newset | net/netfilter/nf_tables_api.c | set | loop bound | yes? | FP |
| 623 | Low | 30 | F | nfnl_cthelper_parse_expect_policy | net/netfilter/nfnetlink_cthelper.c | class_max | loop bound | yes? | FP |
| 624 | Low | 30 | F | osd_sparse_read | net/ceph/osd_client.c | count | loop bound | yes? | FP |
| 625 | Low | 30 | F | rxgk_verify_authenticator | net/rxrpc/rxgk.c | call_count | loop bound | yes? | FP |
| 626 | Low | 30 | F | rxgk_verify_response | net/rxrpc/rxgk.c | auth_len | loop bound | yes? | FP |
| 627 | Low | 30 | F | rxrpc_preparse_xdr | net/rxrpc/key.c | len | loop bound | yes? | FP |
| 628 | Low | 30 | F | rxrpc_preparse_xdr | net/rxrpc/key.c | paddedlen | loop bound | yes? | FP |
| 629 | Low | 30 | F | rxrpc_preparse_xdr | net/rxrpc/key.c | ntoken | loop bound | yes? | FP |
| 630 | Low | 30 | F | sctp_process_strreset_inreq | net/sctp/stream.c | nums | loop bound | yes? | FP |
| 631 | Low | 30 | F | sctp_process_strreset_inreq | net/sctp/stream.c | i | loop bound | yes? | FP |
| 632 | Low | 30 | F | sctp_process_strreset_inreq | net/sctp/stream.c | i | loop bound | yes? | FP |
| 633 | Low | 30 | F | sctp_process_strreset_outreq | net/sctp/stream.c | i | loop bound | yes? | FP |
| 634 | Low | 30 | F | sctp_process_strreset_outreq | net/sctp/stream.c | i | loop bound | yes? | FP |
| 635 | Low | 30 | F | valid_country | net/wireless/reg.c | coll | loop bound | yes? | FP |
| 636 | Low | 30 | F | xfrm_replay_advance_bmp | net/xfrm/xfrm_replay.c | diff | loop bound | yes? | FP |
| 637 | Low | 30 | F | xfrm_replay_advance_esn | net/xfrm/xfrm_replay.c | diff | loop bound | yes? | FP |
| 638 | Low | 20 | H | fib_table_insert | net/ipv4/fib_trie.c | state | truncation | yes? | FP |
| 639 | Low | 20 | H | ieee80211_verify_peer_he_mcs_support | net/mac80211/mlme.c | ap_rx_val | truncation | yes? | FP |
| 640 | Low | 20 | H | ieee80211_verify_peer_he_mcs_support | net/mac80211/mlme.c | ap_tx_val | truncation | yes? | FP |
| 641 | Low | 20 | H | nf_tables_delchain | net/netfilter/nf_tables_api.c | use | truncation | yes? | FP |
| 642 | Low | 20 | H | nf_tables_newchain | net/netfilter/nf_tables_api.c | flags | truncation | yes? | FP |
| 643 | Low | 20 | H | set_sctp_state | net/netfilter/ipvs/ip_vs_proto_sctp.c | chunk_type | truncation | yes? | FP |