ctl_ctloutput-leak

ctlctloutput-leak macOS High Sierra 10.13 の ctlctloutput 関数は、sooptcopyin の呼び出しの戻り値を無視します。これにより、初期化されていないカーネルヒープデータをユーザースペースに漏えいさせる競合ウィンドウが生じます。ctlctloutput-leak は、この情報漏えいを引き起こそうとする proof-of-concept エクスプロイトです。悪用には root 権限が必要です。 このエクスプロイトは、macOS High Sierra 10.13.1 Beta 17B25c および iOS 10.1.1...

CVE-2019-6207

CVE-2019-6207 getdirentriesattr カーネル ヒープ 情報漏洩 この脆弱性は、macOS=10.14.4 && ios 12.2 のサンドボックスでトリガーされる可能性があります。 この脆弱性についての詳細は後日更新します。...

CVE-2026-89743 misc: nsm: bound the device-reported response length

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsmsendrecvmsglocked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy backend...

kernel: smb/client: fix out-of-bounds read in smb2_compound_op()

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker, acting as a malicious SMB server, could send a specially crafted, truncated response with an oversized buffer length. This could lead to an out-of-bounds read in the smb2compoundop function, allowing the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098929)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098929 advisory. In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated R...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100510)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100510 advisory. In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated R...

CVE-2026-74278

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE with the original event embedded as variable-length data, while kernel...

CVE-2026-74278

CVE-2026-74278 affects the Linux kernel ALSA seq subsystem. The leak arises from bounce_error_event() always emitting SNDRV_SEQ_EVENT_KERNEL_ERROR with a raw struct snd_seq_event pointer exposed to users. The fix differentiates by client type: for USER_CLIENTS, send SNDRV_SEQ_EVENT_BOUNCE with SN...

Linux Distros Unpatched Vulnerability : CVE-2026-74278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: seq: Fix kernel heap address leak in bounceerrorevent The comment above bounceerrorevent documents that user clients should receive SNDRVSEQEVENTBOUNCE wi...

AZL-94040 CVE-2026-64540 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by...

CVE-2026-64540: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelinkrxfixup genelinkrxfixup splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by...

UBUNTU-CVE-2026-64479

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix uninitialised heap leak in sndseqeventdup sndseqeventdup copies an incoming event into a pool cell and, in the UMP-enabled build, clears the trailing cell-ump.raw.extra word that the memcpy did not cover. The guard...

CVE-2026-10677

The CVE concerns Zephyr’s CONFIG_USERSPACE verifier z_vrfy_k_poll() in kernel/poll.c, where a user-supplied k_poll_event[] is copied to kernel space and validated. Previously, an inline K_OOPS(K_SYSCALL_OBJ(...)) inside the loop could leak the allocation when a forged object handle was encountere...

CVE-2026-10677 Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool

The CONFIGUSERSPACE syscall verifier zvrfykpoll in kernel/poll.c allocates a kernel-side copy of the user-supplied kpollevent via zthreadmalloc and then validates each event's object handle. Before this fix, validation used KOOPSKSYSCALLOBJ... inline inside the loop, which kills the calling threa...

CVE-2026-10677 Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool

The CONFIGUSERSPACE syscall verifier zvrfykpoll in kernel/poll.c allocates a kernel-side copy of the user-supplied kpollevent via zthreadmalloc and then validates each event's object handle. Before this fix, validation used KOOPSKSYSCALLOBJ... inline inside the loop, which kills the calling threa...

CVE-2026-10677 Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool

The CONFIGUSERSPACE syscall verifier zvrfykpoll in kernel/poll.c allocates a kernel-side copy of the user-supplied kpollevent via zthreadmalloc and then validates each event's object handle. Before this fix, validation used KOOPSKSYSCALLOBJ... inline inside the loop, which kills the calling threa...

CVE-2026-46155: Out-of-bounds Read

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2compoundop If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, checkwsleas returns success without validating that the entire...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from an out-of-bounds read in the smb2compoundop function within the smb client. This vulnerability ma...

AZL-88458 CVE-2026-45994 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: ibmasm: fix OOB reads in commandfilewrite due to missing size checks The commandfilewrite handler allocates a kernel buffer of exactly count bytes and copies user data into it, but does not validate the buffer against the dot...

CVE-2026-45994: Out-of-bounds Read

In the Linux kernel, the following vulnerability has been resolved: ibmasm: fix OOB reads in commandfilewrite due to missing size checks The commandfilewrite handler allocates a kernel buffer of exactly count bytes and copies user data into it, but does not validate the buffer against the dot...