341856 matches found
CVE-2017-16995
Linux Kernel Version 4.14 - 4.4 Ubuntu && Debian Description This vulnerability exists in the eBPF bpf2 system call in the Linux kernel. When a user provides a malicious BPF program that causes a calculation error in the eBPF verifier module, it leads to arbitrary memory read/write issues...
CVE-2021-22555-PipeVersion
CVE-2021-22555 pipe version Using pipe-primitive to exploit CVE-2021-22555, so no kaslr leak nor smap smep ktpi bypass is needed : Q: What is pipe-primitive? A: https://github.com/veritas501/pipe-primitive Tested on both Linux 4.15 and Linux 5.8...
CVE-2022-36946
CVE-2022-36946 Reported-by: Domingo Dirutigliano and Nicola Guerrera While we were working on firegex, our application firewall for CTF Attack-Defence competitions, we stumbled upon a few kernel panics. This strange behavour was than isolated and anlayzed, leading to the discovery of this potenti...
CVE-2023-3640
SCTF2023kernelpwn SCTF 2023 kernel pwn Off-topic: A little advertisement — the author is a 2024 undergraduate graduate student, participating in this year's autumn recruitment. Feel free to contact me sycrop This problem aims to test two points. 1. The starting points of the cpu entry area mappin...
EUVD-2026-103568
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Atomize IRQ register read/modify/write ops Why The OTGGLOBALSYNCSTATUS register controls various HW IRQ sources for the output timing generator OTG. VUPDATENOLOCK is one of them. To enable the IRQ, driver sets th...
CVE-2026-98654
The Linux kernel contains a race condition within the drm/amd/display driver. The issue arises because read/modify/write (RMW) operations on the OTG_GLOBAL_SYNC_STATUS register (and other IRQ control registers) are not atomic. Specifically, a race can occur between a thread disabling an IRQ and t...
CVE-2026-98653
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gaccessshadowfault In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. datentrywalk will not find any leaf entry and...
CVE-2026-98653 KVM: s390: Fix _gaccess_shadow_fault()
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gaccessshadowfault In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. datentrywalk will not find any leaf entry and...
EUVD-2026-103567
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gaccessshadowfault In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. datentrywalk will not find any leaf entry and...
CVE-2026-98652 KVM: s390: Add missing srcu in kvm_s390_set_irq_state()
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in kvms390setirqstate Like kvms390injectvcpu, kvms390setirqstate also needs the kvm-srcu or the slots lock when performing the Store status operation. Fix by taking kvm-srcu in kvms390setirqstate...
CVE-2026-98652
The Linux kernel contains a vulnerability in the KVM subsystem specifically affecting the s390 architecture. The issue is caused by a missing srcu (or slots lock) in the kvm_s390_set_irq_state() function during the Store status operation, similar to the requirement in kvm_s390_inject_vcpu(). The ...
CVE-2026-98652 KVM: s390: Add missing srcu in kvm_s390_set_irq_state()
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in kvms390setirqstate Like kvms390injectvcpu, kvms390setirqstate also needs the kvm-srcu or the slots lock when performing the Store status operation. Fix by taking kvm-srcu in kvms390setirqstate...
EUVD-2026-103566
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Add missing srcu in kvms390setirqstate Like kvms390injectvcpu, kvms390setirqstate also needs the kvm-srcu or the slots lock when performing the Store status operation. Fix by taking kvm-srcu in kvms390setirqstate...
EUVD-2026-103564
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix potential races in dat skey functions When datcondsetstoragekey finds a large page, it will conditionally set the storage key in absolute memory using largecrstetophys to get the absolute address. There is a race...
EUVD-2026-103565
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer ...
CVE-2026-98649 KVM: s390: Fix race in _destroy_pages_crste()
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in destroypagescrste Use READONCE in destroypagescrste to read the crste, avoid dereferencing the pointer multiple times...
CVE-2026-98649
The Linux kernel contains a race condition within the KVM s390 module in the _destroy_pages_crste() function. The underlying cause is the multiple dereferencing of a pointer, which can be mitigated by using READ_ONCE() to read the crste. No specific version numbers, impact details, or exploit inf...
CVE-2026-98649 KVM: s390: Fix race in _destroy_pages_crste()
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in destroypagescrste Use READONCE in destroypagescrste to read the crste, avoid dereferencing the pointer multiple times...
EUVD-2026-103563
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in destroypagescrste Use READONCE in destroypagescrste to read the crste, avoid dereferencing the pointer multiple times...