CVE-2025-27031

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed...

CVE-2025-27031 Use After Free in Bluetooth HOST

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed...

CVE-2025-27031

CVE-2025-27031 affects Qualcomm chipsets. The vulnerability is a memory corruption in the kernel/driver path when handling IOCTLs: a buffer used in write loopback mode can be accessed after it has been freed, leading to potential arbitrary code execution or a crash. Affected component is describe...

CVE-2025-27031 Use After Free in Bluetooth HOST

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed...

CVE-2025-27031: Use After Free

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed...

CVE-2020-3610

Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no refcount taken for this object in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IO...

CVE-2023-53035 nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel-infoleak in nilfsioctlwrapcopy The ioctl helper function nilfsioctlwrapcopy, which exchanges a metadata array to/from user space, may copy uninitialized buffer regions to user space memory for read-only ioctl...

PT-2025-23585 · Qualcomm · Snapdragon +18

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue involves memory corruption during the processing of IOCTL commands. This occurs when the buffer in write loopback mode is accessed after being freed. Recommendations: At the moment...

CVE-2022-49297 nbd: fix io hung while disconnecting device

In the Linux kernel, the following vulnerability has been resolved: nbd: fix io hung while disconnecting device In our tests, "qemu-nbd" triggers a io hung: INFO: task qemu-nbd:11445 blocked for more than 368 seconds. Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca 884 "echo 0...

PT-2024-19868 · Unknown · Vba32M64.Sys +1

Name of the Vulnerable Software and Affected Versions: Vba32 Antivirus version 3.36.0 Description: The issue is related to an Arbitrary Memory Read vulnerability. It can be triggered by using specific IOCTL codes of the Vba32m64.sys driver, including 0x22201B, 0x22201F, 0x222023, 0x222027,...

CVE-2022-33226

Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications...

CVE-2022-33226: Buffer Copy without Checking Size of Input

Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications...

kernel: possible race condition in drivers/tty/tty_buffers.c

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flushtoldisc function. This flaw allows a local user to crash the...

Input validation

An issue was discovered in certain Verbatim drives through 2022-03-31. Due to missing integrity checks, an attacker can manipulate the content of the emulated CD-ROM drive containing the Windows and macOS client software. The content of this emulated CD-ROM drive is stored as an ISO-9660 image in...

CVE-2020-27786: Use After Free

A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change...

CVE-2020-3610

Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no refcount taken for this object in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IO...

CVE-2020-3610

Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no refcount taken for this object in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IO...

CVE-2020-3610

CVE-2020-3610 describes a double-free in a drawobj added to the drawqueue during IOCTL handling, due to a missing refcount for the object in multiple Snapdragon products (APQ8009/8053/8096AU/8098, MSM89xx, SDM4xx/6xx/7xx, SM8xxx, SXR2130, and related Qualcomm/Android platforms). The Red Hat and N...

CVE-2020-3610: Double Free

Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no refcount taken for this object in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IO...

CVE-2019-15877

In FreeBSD 12.1-STABLE before r356606 and 12.1-RELEASE before 12.1-RELEASE-p3, driver specific ioctl command handlers in the ixl network driver failed to check whether the caller has sufficient privileges allowing unprivileged users to trigger updates to the device's non-volatile memory...