8713 matches found
CVE-2026-25263: Out-of-bounds Write
Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters...
Linux Distros Unpatched Vulnerability : CVE-2026-98205
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack...
PT-2026-106344
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when the kernel processes an IOCTL Input/Output Control command called from user space using invalid parameters. IOCTL is a...
Oracle Linux 8 : kernel (ELSA-2026-75747)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75747 advisory. - nvme/ioctl: check SUBMITIO with CAPSYSADMIN Chris Leech RHEL-269479 CVE-2026-90227 - nvme-pci: fix mempool alloc size Maurizio Lombardi RHEL-230386...
kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: prevents potential Spectre v1 exploits. It seems that cmd could be a Spectre v1 exploit, as it is provided by a user and used as an array index. This vulnerability prevents the contents of kernel memory from being leake...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
When sending malicious data to the kernel using the ioctl cmd FBIOPUTVSCREENINFO, the kernel will write memory beyond its boundaries...
Astra Linux – Vulnerability in Linux, Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: btrfs: Fixed a use-after-free after failing to create a snapshot. In ioctl.c’s createsnapshot function, we allocate a pending snapshot structure and then attach it to the transaction’s list of pending snapshots. After that, we ca...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: ext4: fixed the idatasem unlock order in ext4indmigrate Fuzzing reported a possible deadlock in jbd2logwaitcommit. This issue occurs when the EXT4IOCMIGRATE ioctl is set to require synchronous updates because the file descript...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ppp: The requirement for CAPNETADMIN in the target netns is necessary for unattached IOCTls. The operation of /dev/ppp is currently authorized against file-fcred-userns, while unattached administrative IOCTls operate on...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: fpga: Prevent integer overflow in dflfeatureioctlsetirq The multiplication hdr.count sizeofs32 can cause integer overflow on 32-bit systems, leading to memory corruption. Use arraysize to fix this issue...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: nbd: Fixed incomplete validation of ioctl arguments. We identified an alarm caused by incomplete validation of ioctl arguments without proper verification. The UBSAN warning appears as follows: UBSAN: Undefined behavior in...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: comedi: The issue of using uninitialized memory in doinsnioctl and doinsnlistioctl has been fixed. syzbot reports a KMSAN kernel-infosek in doinsnioctl. A kernel buffer is allocated to hold insn-n samples each of which is an...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure that info-enable callback is always set. The ioctl and sysfs handlers call the -enable callback unconditionally. Not all drivers implement this callback, resulting in NULL dereferencing. Examples of affected drivers:...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
A issue was discovered in the Linux kernel before version 6.6.8. The roseioctl function in net/rose/afrose.c has a use-after-free issue due to a race condition involving roseaccept...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: video: fbdev: arkfb: Fixed a divide-by-zero bug in arksetpixclock Since the user can control the arguments of the ioctl function from the user space, there are special cases where a divide-by-zero bug may occur. For example, in:...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerabilities have been resolved: ubi: Fixed a race condition between ctrlcdevioctl and ubicdevioctl. Hulk Robot reported a KASAN report regarding a use-after-free issue: ========================================== BUG: KASAN: use-after-free in...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: drm: Fixed a race condition between a partial failure of drmdevregister and the ioctl operation. If dmrdevregister fails after registering a minor device e.g., the primary device fails despite a minor device being registered, the...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: loop: Overflow check during loop configuration The user space can configure a loop using an ioctl call. In this process, a configuration of type loopconfig is passed see the loioctl case on line 1550 of drivers/block/loop.c. This...