8688 matches found
PT-2026-94846
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The mtd add partition function fails to reject the special offset value MTDPART OFS RETAIN -3. When this value is passed via the BLKPG ioctl on NAND devices, it causes undefined behavior...
CVE-2026-89823
In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...
EUVD-2026-80605
In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at the same time, it may be possible that the device is resumed after it is suspended in dmdestroy. The result is that the table is destroyed...
CVE-2026-89997
CVE-2026-89997 affects the Linux kernel device-mapper (dm) subsystem . A race condition occurs when the resume and remove ioctls are issued simultaneously: the device may be resumed after being suspended in __dm_destroy, causing the table to be destroyed without invoking the postsuspend method. S...
CVE-2026-89997 dm: fix resume-vs-remove race
In the Linux kernel, the following vulnerability has been resolved: dm: fix resume-vs-remove race If the user issues the resume ioctl and the remove ioctl at the same time, it may be possible that the device is resumed after it is suspended in dmdestroy. The result is that the table is destroyed...
CVE-2026-84408: Exposed IOCTL with Insufficient Access Control
QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...
PT-2026-93661
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the gadget dev ioctl function. The issue occurs because the function reads dev-gadget before acquiring dev-lock, while the dev-state is checked only...
PT-2026-93617
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the accel/ethosu component where ethosu ioctl submit job allocates a done fence before validating buffer handles. If an error occurs after this allocation, ethosu job...
PT-2026-93464
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between a partial drm dev register failure and an ioctl operation. If drm dev register fails after a minor has been registered, userspace may open that minor and...
CVE-2026-89823: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...
PT-2026-93658
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the rtw action frame parse function within the rtl8723bs staging driver. The function accepts a frame len parameter but fails to validate it before indexi...
PT-2026-93637
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dma-heap component where the DMA HEAP IOCTL ALLOC operation installs a file descriptor fd into the caller's fd table before the result is successfully copied back ...
The vulnerability of the ioctl component in the kernel of the FreeBSD operating system, which allows a hacker to increase their privileges
The vulnerability of the ioctl component in the FreeBSD operating system’s kernel relates to the possibility of using memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...
SUSE CVE-2026-89442
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...
Astra Linux – Vulnerability in Linux
A out-of-bounds memory write flaw was discovered in the Linux kernel’s joystick devices subsystem in versions prior to 5.9-rc1. This flaw allows a local user to crash the system or potentially escalate their privileges on the system. The greatest threat posed by this vulnerability is related to...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: drm/amdgpu: Fixed NULL pointer dereferencing in the VRAM logic for APU devices Previously, APU platforms and other scenarios with uninitialized VRAM managers triggered a NULL pointer dereferencing in ttmresourcemanagerusage. T...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: ext4: fixed the idatasem unlock order in ext4indmigrate Fuzzing reported a potential deadlock in jbd2logwaitcommit. This issue occurs when the EXT4IOCMIGRATE ioctl is set to require synchronous updates because the file...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ethtool: Fixed an issue where the uninitialized number of lanes was used. It is not possible to set the number of lanes when adjusting link modes using the legacy IOCTL ethtool interface. Since the structure struct...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fixed an infinite recursive call of clippush. syzbot reported the issue below. 0 This occurs when we call ioctlATMARPMKIP more than once. During the first call, clipmkip sets clippush to vcc-push; the second call copie...