6474 matches found
pcileech
PCILeech Summary: PCILeech uses PCIe hardware devices to read and write target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system. PCILeech also works without hardware together with a wide range of software memory acqusition methods supported by the...
XenoboxX
Hardware Sandbox Toolkit Malware frequently employs anti-VM techniques, which can vary in their difficulty to detect and counteract. While integrating anti-detection measures in our labs is a frequently used option, we should also consider using a real hardware sandbox, even if this sounds weird...
CVE-2026-80867
A flaw was found in the Linux kernel's Alpha/PCI subsystem. A local user could exploit a missing security check in the pcimmapresource function, which allows mapping of PCI Base Address Registers BARs to userspace. This vulnerability could enable a local attacker to perform Direct Memory Access D...
CVE-2026-89865
A flaw was found in the Linux kernel's qla2xxx SCSI driver. The FRU and I2C bsg handlers, responsible for data transfers, utilize a DMA Direct Memory Access buffer that is not fully cleared upon allocation. A local attacker could exploit this by manipulating the transfer length in the...
SUSE CVE-2026-89996
In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...
SUSE CVE-2026-99164
In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...
USN-8960-1: Linux kernel (OEM) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management; - Multiple devices driver; - ARM64 architecture; - EROFS file system; -...
CVE-2026-58827
In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-58827
In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-58827
In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-58827
A use after free vulnerability exists in multiple functions of dma-buf.c within the Google Android kernel. This flaw is caused by a race condition and can lead to a local escalation of privilege without requiring additional execution privileges or user interaction. No specific exploit details or ...
EUVD-2026-115585
In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIGDMAAPIDEBUGSG is enabled, importing a udmabuf into a DRM driver e.g., amdgpu used for video playback in GNOME Videos / Showtime triggers a false...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsiallocsgtables During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x4a/0x70...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers using dmafreecoherent, but does not clear the pointers afterward—unlike the sibling...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 DMA-align output buffer Sashiko reports: When sendoutputreport calls hidhwoutputreport, the underlying USB HID core calls usbinterruptmsg, which maps this buffer directly for DMA. When the DMA mapping flushes o...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pending streaming teardown has run. When user space later closes its file...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4overflowmemwork points BPOA at a 512KB slot inside the 16MB binner BO, but writes the size of the whole BO to BPOS. On every binner out-of-memory event,...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xxslc: fail DMA transfer on completion timeout lpc32xxxmitdma waits for the DMA completion callback but ignores waitforcompletiontimeout. As a result, a timed-out DMA transfer is unmapped and reported as...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnetteardown stops both rings and frees their frame buffers before calling tbxdomaindisablepaths. tbringstop zeroes the ring’s descriptor base, and tbnetfreebuffers...