CVE-2021-28663

CVE-2021-28663 CVE-2021-28663에 대한 기본 PoC 익스플로잇 Android 커널 백도어 취약점 내부 이것은 CVE-2021-28663에 대한 기본 PoC입니다. Mali GPU Android 커널 드라이버의 설계 결함입니다. 1. GPUVA를 생성하고 동시에 mmap하여 물리 페이지에 대한 가상 주소를 얻습니다. 2. 물리 페이지에 대한 별칭을 생성하지만 mmap은 수행하지 않아 gpumapping은 1로 유지됩니다. 3. GPUVA의 플래그를 BASEMEMDONTNEED로 변경합니다. Mali는 이를 ...

CVE-2026-21007-GPU-Driver-ioctl-Race-Condition-Kernel-Memory-Mapping-

CVE-2026-21007 – GPU 驱动 ioctl 竞态条件（内核内存映射） 程序代码（C 模拟） // gpudriversim.c - Simulated GPU driver ioctl with race condition include include include include void gpummap = NULL; sizet mapsize = 0; int locked = 0; void ioctlmapsizet size // Allocate GPU memory and map to user gpummap = mallocsize;...

nvidia-gpu-security-poc

NVIDIA GPUドライバ — NVIDIAが期待どおりの動作としてクローズした2件の調査結果 NVIDIA Linux GPUドライバにおける2件の調査結果に対する概念実証コードと生の証拠。 いずれもNVIDIAのVDPを通じて報告され、NVIDIAによって意図された/期待どおりの動作としてクローズされた。 この挙動が文書化され再現可能となるよう公開されたもの。いずれもCVEはなく、修正される予定もない。 | 調査結果| 分類| ベンダーの対応| ディレクトリ ---|---|---|---|--- 1| NVMLを介したUID横断GPUプロセステレメトリ| 情報漏えい（CWE-20...

CVE-2024-0070-NVIDIA-GPU-Driver--Resonance-Vulnerability

CVE-2024-0070-NVIDIA-GPU-Driver--Resonance-Vulnerability NVIDIA의 GPU 드라이버는 메모리 관리에 시간적 일관성 결함이 있습니다. 587 kHz 공진에서 드라이버의 메모리 페이지는 α-붕괴 간섭을 경험하여 사용자 공간에서 커널 메모리에 접근할 수 있습니다. NVIDIA GPU α-공진 익스플로잇 CVE-2024-0070 개요 이 익스플로잇은 수렴 시간 이론CTT 원리를 사용하여 NVIDIA GPU 드라이버의 시간적 일관성 취약점 을 시연합니다. 이 취약점은 GPU 클록 주파수가...

CVE-2026-97495

A flaw was found in the Linux kernel's AMD GPU driver amdkfd. A local user could exploit this vulnerability to cause a Denial of Service DoS or kernel memory corruption by supplying an out-of-bounds doorbell identifier during queue allocation. The issue occurs because the doorbell allocation...

CVE-2026-97496

A flaw was found in the Linux kernel's AMD GPU driver amdkfd. A local attacker can trigger this vulnerability during process restoration by supplying manipulated queue descriptor values that lack proper boundary validation. This issue results in an out-of-bounds memory read, potentially exposing...

CVE-2026-97494

A flaw was found in the Linux kernel's AMD GPU driver. The driver fails to validate the size of firmware images before copying them into the Platform Security Processor PSP private buffer. A local user could exploit this vulnerability by loading an oversized or malformed firmware image, triggerin...

CVE-2026-93823

A flaw was found in the Linux kernel's AMD GPU driver amdkfd. A local user with access to the GPU device interface can trigger excessive kernel memory allocation by providing an abnormally large buffer size parameter during an input/output control ioctl request. This issue can exhaust system memo...

CVE-2026-93809

A flaw was found in the Linux kernel's AMD GPU driver amdgpu. A local user with administrative privileges could cause a Denial of Service DoS by unloading the driver module while callbacks are still scheduled. Because the driver does not wait for pending Read-Copy Update RCU callbacks to complete...

kernel: drm/virtio: use uninterruptible resv lock for plane updates

A flaw was found in the Linux kernel's VirtIO GPU Graphics Processing Unit driver. The virtiogpucursorplaneupdate and virtiogpuresourceflush functions fail to properly acquire a required lock, which can lead to a race condition. A local user could exploit this vulnerability by triggering a memory...

Linux Distros Unpatched Vulnerability : CVE-2026-93218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugeloc...

Linux Distros Unpatched Vulnerability : CVE-2026-93217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a...

SUSE CVE-2026-93217

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

SUSE CVE-2026-93218

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

kernel: drm/virtio: use uninterruptible resv lock for plane updates

A flaw was found in the Linux kernel's VirtIO GPU Graphics Processing Unit driver. The virtiogpucursorplaneupdate and virtiogpuresourceflush functions fail to properly acquire a required lock, which can lead to a race condition. A local user could exploit this vulnerability by triggering a memory...

CVE-2026-93217

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

DEBIAN-CVE-2026-93217

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

DEBIAN-CVE-2026-93218

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

UBUNTU-CVE-2026-93218

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

CVE-2026-93218 mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...