CVE-2016-2067

ADRENO GPU IOMMU DMA EXPLOIT Tested under Nexus 6p google/angler/angler:6.0.1/MMB29M/2431559:user/release-keys About the bug Discussed in 2016 via Blackhat EU About the exploit With iommu dma writes, vdso.so is overwritten with shellcode. So after /init executes kernelclockgettime, the shellcode...

CVE-2026-89448

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit component. When tboot Trusted Boot is enabled, the system may fail to correctly request Access Control Services ACS. This misconfiguration could potentially lead to a bypass of intended Access Control Services, which...

CVE-2025-38676

CVE-2025-38676 — Desbordamiento de búfer en la pila del kernel de Linux ≤ 6.17-rc2 AMD IOMMU Este repositorio proporciona recursos PoC seguros y no explotables para estudiar CVE-2025-38676: Herramientas de recopilación de información + seguridad Arnés de arranque QEMU para ejercitar permutaciones...

Linux Distros Unpatched Vulnerability : CVE-2026-89450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field span...

Linux Distros Unpatched Vulnerability : CVE-2026-89452

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/msm: Unwind probe state on registration failure msmiommuprobe adds its devm-managed IOMMU object to qcomiommudevices before adding the IOMMU sysfs device...

Linux Distros Unpatched Vulnerability : CVE-2026-89448

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible...

CVE-2026-89453

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit driver for AMD. This vulnerability occurs when the system handles certain memory access errors, specifically Page Request PPR faults, without properly releasing a reference to a PCI device. This oversight causes a...

CVE-2026-89452

A flaw was found in the iommu/msm component of the Linux kernel. This vulnerability occurs when msmiommuprobe fails to properly unwind its probe state during registration, leaving a dangling list entry. A local attacker could potentially exploit this to cause a dereference of the dangling list...

CVE-2026-89451

A flaw was found in the Linux kernel's IOMMU Input/Output Memory Management Unit SVA Shared Virtual Addressing component. A race condition during the attachment of an SVA handle can lead to a situation where a device pointer is not properly initialized. A local attacker could exploit this flaw by...

CVE-2026-89449

A flaw was found in the Linux kernel's Input-Output Memory Management Unit IOMMU subsystem. When a device addition fails during the iommumockdeviceadd operation, the allocated device IOMMU structure is not properly deallocated. This oversight leads to a memory leak, which over time could be...

CVE-2026-89450

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv module. A Virtual Machine Manager VMM can exploit this vulnerability by providing a virtual Stream ID vSID that exceeds the intended 20-bit width of the SIDMATCH field. This improper input validation causes the system to incorrectly...

CVE-2026-89591

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...

DEBIAN-CVE-2026-89450

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Reject a vSID wider than the SIDMATCH field tegra241vintfinitvsid programs the guest-provided vSID into SIDMATCH, whose VIRTSID field spans bits 20:1 with bit 0 as the match-enable flag. The HW therefore...

DEBIAN-CVE-2026-89452

In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msmiommuprobe adds its devm-managed IOMMU object to qcomiommudevices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommudevicesysfsadd fails,...

DEBIAN-CVE-2026-89451

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

AZL-100817 CVE-2026-89452 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: iommu/msm: Unwind probe state on registration failure msmiommuprobe adds its devm-managed IOMMU object to qcomiommudevices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommudevicesysfsadd fails,...

AZL-100874 CVE-2026-89448 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iommu...

DEBIAN-CVE-2026-89448

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detectinteliommu don't include tboot, leading to a possible misconfiguration with ACS disabled e.g. due to user opts while iommu...

CVE-2026-89453

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

AZL-100277 CVE-2026-89451 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...