8699 matches found
CVE-2026-58094
The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...
CVE-2026-58093 Kernel use-after-free via tty ioctls
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...
CVE-2026-58093
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...
CVE-2026-58093 Kernel use-after-free via tty ioctls
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...
CVE-2026-58093
The FreeBSD kernel contains a use-after-free vulnerability in the tty module's TIOCSCTTY ioctl handler. The issue stems from a race condition where the handler drops the tty lock to acquire the process tree lock but fails to revalidate the terminal's state upon reacquiring the lock. This allows a...
CVE-2026-58091
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...
EUVD-2026-66236
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...
CVE-2026-58091
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...
kernel: i2c: stub: Reject I2C block transfers with invalid length
A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...
Linux Distros Unpatched Vulnerability : CVE-2026-79619
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host...
Linux Distros Unpatched Vulnerability : CVE-2026-80584
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/qeth: validate user buffer length in SNMP and ARP query ioctls qethsnmpcommand and qethl3arpquery allocate a buffer sized by a user-supplied length udatale...
FreeBSD : FreeBSD -- Kernel use-after-free via tty ioctls (a34b5154-a0ff-11f1-ae1f-bc241121aa0a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a34b5154-a0ff-11f1-ae1f-bc241121aa0a advisory. The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After...
CVE-2026-58091: Use After Free
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...
PT-2026-81936
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...
VulnCheck KEV: CVE-2026-36425
An issue in OPSWAT AppRemover Driver ardrv.sys v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation...
CVE-2026-58093: Concurrent Execution using Shared Resource with Improper Synchronization
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...
CVE-2026-58094: Time-of-check Time-of-use (TOCTOU) Race Condition
The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098844)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098844 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on set received ioctl due to item overflow If the set received ioctl...
PT-2026-82094
Name of the Vulnerable Software and Affected Versions OpenZFS affected versions not specified Description On Linux, several ioctl authorization checks incorrectly treat capabilities held within a user-created, unprivileged namespace as equivalent to actual host privileges. This allows an...
PT-2026-82200
Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description An issue exists in the s390/qeth component where the qeth snmp command and qeth l3 arp query functions allocate a buffer based on a user-supplied length udata len without verifying a low...