154 matches found
Chrome-Skia-CVE-2024-8198
Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop28.html Steps to reproduce: 1. Apply the chromium.diff patch to chromium. 2. Run genskpic.py to generate drawablepicture.skp.hh, then move the generated file to src/gpu/commandbuffer/client. 3...
Chrome-Skia-CVE-2024-7966
Fixed in Chrome M128: https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop21.html Steps to reproduce: Apply the chromium.diff patch to chromium. Run genskpic.py to generate drawablepicture.skp.hh, then move the generated file to src/gpu/commandbuffer/client. Build and...
CVE-2026-25270
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver...
CVE-2026-25270
The Android Camera driver is vulnerable to a memory corruption issue caused by an out-of-bounds write . This occurs when the driver processes command buffer requests that contain invalid length parameters . While the specific affected versions are not provided in the documents, the vulnerability ...
CVE-2026-25270 Out-of-bounds Write in Camera Driver
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver...
EUVD-2026-92973
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver...
PT-2026-106347
Name of the Vulnerable Software and Affected Versions Android Camera driver affected versions not specified Description Memory corruption occurs when the Android Camera driver processes command buffer requests that contain invalid length parameters. Recommendations At the moment, there is no...
CVE-2026-25270: Out-of-bounds Write
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver...
AZL-101334 CVE-2026-89793 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: ublk: clear VMMAYWRITE on read-only ublk char device mmap ublkchmmap rejects mmap requests with VMWRITE set, but never clears VMMAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue...
CVE-2026-89793 ublk: clear VM_MAYWRITE on read-only ublk char device mmap
In the Linux kernel, the following vulnerability has been resolved: ublk: clear VMMAYWRITE on read-only ublk char device mmap ublkchmmap rejects mmap requests with VMWRITE set, but never clears VMMAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue...
EUVD-2026-80589
In the Linux kernel, the following vulnerability has been resolved: ublk: clear VMMAYWRITE on read-only ublk char device mmap ublkchmmap rejects mmap requests with VMWRITE set, but never clears VMMAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue...
SUSE CVE-2026-72075
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...
CVE-2026-74443
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...
UBUNTU-CVE-2026-72075
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...
CVE-2026-72075
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...
CVE-2026-72091 accel/amdxdna: reject user command submission without a command BO
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdxdnadrmsubmitexecbuf passes the user-supplied command BO handle straight into amdxdnacmdsubmit with drvcmd == NULL. When the handle is AMDXDNAINVALIDBOHANDLE 0...
CVE-2026-72075 Input: ims-pcu - fix race condition in reset_device sysfs callback
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...
EUVD-2026-59033
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...
CVE-2026-72075
In the Linux kernel, a race condition was fixed in the ims-pcu reset_device sysfs callback. The ims_pcu_reset_device() path called IMS_PCU_execute_command() without holding pcu->cmd_mutex, allowing data races and possible corruption of the shared command buffer when commands execute concurrent...
CVE-2026-72075 Input: ims-pcu - fix race condition in reset_device sysfs callback
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix race condition in resetdevice sysfs callback The imspcuresetdevice sysfs callback calls imspcuexecutecommand without acquiring pcu-cmdmutex. This can lead to data races and corruption of the shared command...