claude_opus_cve_2023_0266

Demonstration that Claude 3 Opus does not understand CVE-2023-0266 and does not find it Demo 1. Even if told where the bug is Opus does not find it, and hallucinates the presence of lock acquisitions Demo 2. "Prompt engineering" aka telling the LLM exactly how to find the bug also doesn't work De...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Remove sndBUGON from sndusbmidioutputopen The function sndusbmidioutputopen includes a check for the NULL port, which involves calling sndBUGON. The use of sndBUGON was intended to prevent such issues from...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Use sndcardfreewhenclosed instead of sndcardfreewhenclosed. The USB disconnect callback should be short and not too long. Alternatively, the current code uses sndcardfree at the time of disconnection, but this waits...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fixed a potential data race in the PCM memory allocation helpers The PCM memory allocation helpers include a sanity check to prevent too many buffer allocations. However, this check is performed without proper locking,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97 – fixed a double-free in sndac97controllerregister. If ac97addadapter fails, putdevice is the correct way to release the device reference. kfree is not required. Add kfree if idralloc fails, and also in...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: emu10k1: Fixed an out-of-bounds access in sndemu10k1pcmchannelalloc The voice allocator sometimes begins allocating from near the end of the array, and then wraps around. However, the sndemu10k1pcmchannelalloc function...

CVE-2026-90781

A flaw was found in alsa-lib. This vulnerability is an off-by-one stack buffer overflow in the sndctlasciielemidparse function. A local attacker can exploit this by supplying a specially crafted, long control-element identifier string through saved state files or command-line arguments. This can...

CVE-2026-80971

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000freeusbrelatedresources frees both URBs and leaves the pointers behind: usbkillurbbcd2k-midiouturb; usbkillurbbcd2k-midiinurb; usbfreeurbbcd2k-midiouturb;...

CVE-2026-80967

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcxhr: initialize mutexes before requesting threaded IRQ pcxhrprobe requests pcxhrthreadedirq before initializing mgr-lock, even though the threaded handler takes that mutex. Initialize the manager locks before...

CVE-2026-89736

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: Fix use-after-free on sound card disconnect gaudiocleanup invokes sndcardfreewhenclosed to initiate sound card teardown and immediately frees the underlying struct snduacchip context. However,...

CVE-2026-90781

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sn...

CVE-2026-90781-alsa-lib-oob

CVE-2026-90781 — alsa-lib OOB Write Reproducer Standalone C reproducer for CVE-2026-90781 , a 1-byte out-of-bounds write in alsa-lib's sndctlasciielemidparse when parsing name= both quoted and unquoted forms. Vulnerability In src/control/ctlparse.c v1.2.16.1 and earlier development HEAD:...

Exploit for CVE-2026-90781

CVE-2026-90781 — alsa-lib OOB Write Reproducer Standalone C r...

DEBIAN-CVE-2026-90781

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-li...

CVE-2026-90781

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-li...

CVE-2026-90781

alsa-lib through 1.2.16.1 contains an off-by-one stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function (in ctlparse.c). When parsing a name= field with 64 or more characters, the function writes one byte past a 64-byte stack buffer, overwriting adjacent stack memory and potentiall...

CVE-2026-90781 alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-li...

EUVD-2026-77008

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-li...

CVE-2026-90781 alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-li...

CVE-2026-90781

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-li...