inception

Note: This tool is no longer under active development, please look at PCILeech instead. INCEPTION Inception is a physical memory manipulation and hacking tool exploiting PCI-based DMA. The tool can attack over FireWire, Thunderbolt, ExpressCard, PC Card and any other PCI/PCIe HW interfaces...

kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs when commands sent to the firmware FW are not properly cleared after a chip reset. A local attacker could exploit a race condition during direct memory access DMA unmapping, leading to a kernel panic. This can...

pcileech

PCILeech Summary: PCILeech uses PCIe hardware devices to read and write target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system. PCILeech also works without hardware together with a wide range of software memory acqusition methods supported by the...

s6_pcie_microblaze

PCI Express DIY hacking toolkit General information Contents SP605 board configuration Software configuration Examples Using Python API Practical DMA attacks Option ROM attacks Troubleshooting Building project from the source code General information This repository contains a set of tools and...

XenoboxX

Hardware Sandbox Toolkit Malware frequently employs anti-VM techniques, which can vary in their difficulty to detect and counteract. While integrating anti-detection measures in our labs is a frequently used option, we should also consider using a real hardware sandbox, even if this sounds weird...

CVE-2016-2067

ADRENO GPU IOMMU DMA EXPLOIT Tested under Nexus 6p google/angler/angler:6.0.1/MMB29M/2431559:user/release-keys About the bug Discussed in 2016 via Blackhat EU About the exploit With iommu dma writes, vdso.so is overwritten with shellcode. So after /init executes kernelclockgettime, the shellcode...

CVE-2026-98773

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in portshutdown if disconnected acmportshutdown is called from the tty-port machinery whenever the last user closes the port. acmdisconnect sets acm-disconnected and calls ttyportttyvhangup, which...

CVE-2026-98730

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

CVE-2026-98601

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...

CVE-2026-98592

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset'd local copy is committed with "txdescaddr =...

EUVD-2026-103858

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in portshutdown if disconnected acmportshutdown is called from the tty-port machinery whenever the last user closes the port. acmdisconnect sets acm-disconnected and calls ttyportttyvhangup, which...

EUVD-2026-103815

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

CVE-2026-98601

The Linux kernel contains a vulnerability in the btintel_pcie driver where the btintel_pcie_msix_rx_handle() function fails to validate device-supplied DMA indices. A malicious or malfunctioning device can provide an out-of-range frbd_tag (a 16-bit field), leading the driver to dereference an out...

EUVD-2026-103646

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...

CVE-2026-98601 Bluetooth: btintel_pcie: validate device-supplied DMA indices

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...

CVE-2026-98601

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...

EUVD-2026-103637

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset'd local copy is committed with "txdescaddr =...

CVE-2026-98592

The Linux kernel contains a vulnerability in the spacemit driver. The emac_tx_mem_map() function prematurely writes TX_DESC_0_OWN into ring descriptors before all fragments are successfully mapped. If emac_tx_map_frag() fails, the error path calls emac_free_tx_buf() to unmap buffers but fails to ...

CVE-2026-98592 net: spacemit: clear TX descriptor on fragment mapping failure

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset'd local copy is committed with "txdescaddr =...

PT-2026-116731

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveau sched struct nouveau sched embeds a struct drm gpu scheduler base. nouveau sched destroy calls nouveau sched fini which does drm sched fini&sched-base and then frees the obje...