2085 matches found
The vulnerability of the Linux operating system’s driver/gpu/drm/amd/amdgpu cores allows a hacker to trigger a service failure.
The vulnerability of the Linux operating system’s components such as drivers, GPU, DRM, AMD, and AMDGPU cores is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause service failures...
The vulnerability of the drivers/pci/controller/cadence components in the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the drivers/pci/controller/cadence components in the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause a service failure...
The vulnerability in the driver/mtd/nand/raw/cadence-nand-controller.c component of the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the drivers/mtd/nand/raw/cadence-nand-controller.c component in the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...
CVE-2026-68270
A flaw was found in the Linux kernel's drm/sysfb component. This flaw occurs when calculating the visible size of the system framebuffer. The calculation uses 32-bit arithmetic, which can overflow if the values for height and stride are excessively large. This overflow leads to truncation of the...
CVE-2026-68262
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...
UBUNTU-CVE-2026-68270
In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calculating visible size Calculating the visible size of the system framebuffer can result in truncation of the result. The calculation uses 32-bit arithmetics, which can overflow if the...
CVE-2026-68108
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...
CVE-2026-68270 drm/sysfb: Avoid possible truncation with calculating visible size
In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calculating visible size Calculating the visible size of the system framebuffer can result in truncation of the result. The calculation uses 32-bit arithmetics, which can overflow if the...
CVE-2026-68262 drm/imagination: Fix user array stride in pvr_set_uobj_array()
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...
CVE-2026-68108
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...
CVE-2026-68108 drm/amdgpu/vce: fix integer overflow in image size
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...
CVE-2026-68108
In CVE-2026-68108, the Linux kernel component drm/amdgpu/vce is vulnerable to a 32-bit integer overflow when processing VCE command streams with oversized dimensions (e.g., 65536×65536), allowing out-of-bounds memory access by the GPU firmware. The issue is addressed by using 64-bit arithmetic to...
EUVD-2026-55489
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...
The vulnerability of the Ingress and TransportServer components of the NGINX Ingress Controller platform allows a attacker to cause service interruptions.
The vulnerability of the Ingress and TransportServer components of the NGINX Ingress Controller monitoring and management platform is related to a pointer arithmetic error. Exploiting this vulnerability could allow an attacker to cause service interruptions...
EUVD-2026-54682
The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...
CVE-2026-11743 Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write
The SF32LB MPI QSPI NOR flash driver drivers/flash/flashsf32lbmpiqspinor.c validated the flash offset and length on its read and write paths with the test offset + size data-size. Because offset is a signed offt while size is unsigned, a negative offset is converted to a large unsigned value and...
ROS-20260806-73-0034
The vulnerability of the dovalidatemem function in the rsrcnonstatic.c component of the Linux kernel is related to pointer arithmetic errors. Exploiting this vulnerability allows an attacker to cause a service failure...
PT-2026-76205
GNU Multiple Precision Arithmetic Library GMP through 6.2.1 has an mpz/inp raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms...
Pillow: Pillow: Native heap out-of-bounds write
A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation, and ImagingExpand computes output...