Microsoft Windows Cloud Files Mini Filter Driver CldiStreamPrepareRequestForMoreProcessing Type Confusion vulnerability

Summary A type confusion vulnerability exists in the CldiStreamPrepareRequestForMoreProcessing functionality of Windows Cloud Files Mini Filter Driver versions: 10.0.26100.8457 WinBuild.160101.0800 and 10.0.26100.8655 WinBuild.160101.0800. A specially crafted sequence of Cloud Filter API calls ca...

CVE-2026-80978

A flaw was found in the Linux kernel, specifically within its IP tunnel devices. A local attacker could create a stack of user-controlled IP tunnel devices, causing the system to miscalculate the required memory for network packet headers. This miscalculation can lead to unnecessary memory...

CVE-2026-89548

A flaw was found in the Linux kernel's SUNRPC component. When sunrpcdestroycachedetail is called, it may not properly drain the cachecleaner before freeing a cachedetail object. This oversight can lead to a use-after-free vulnerability, where the system attempts to access or use memory that has...

CVE-2026-89613

A flaw was found in the Linux kernel's NTFS filesystem driver. This vulnerability occurs when the driver processes an attribute with empty mapping pairs that have inconsistent highest Virtual Cluster Number VCN and size. A local attacker could potentially craft a malicious NTFS filesystem that,...

CVE-2026-89610

A flaw was found in the Linux kernel's NTFS component. The mapping pairs decoder fails to verify if a run length extends beyond the volume boundary. A local attacker could exploit this by providing a malformed NTFS image with a crafted mapping pairs array. This could lead to memory corruption and...

CVE-2026-89737

A flaw was found in the Linux kernel's USB Type-C Thunderbolt driver. The tbtaltmoderemove function fails to properly disable and drain work items before freeing associated plug and cable references. This oversight can lead to a use-after-free vulnerability, where the system attempts to access...

CVE-2026-89438

A flaw was found in the Linux kernel, specifically within the Intel Speed Select Technology ISST component. This vulnerability arises from insufficient validation of input values, such as logical CPU ID and CLOS ID, used in the core power feature. A local attacker could exploit this by providing...

CVE-2026-89509

A flaw was found in the Linux kernel's RDMA/ionic driver. This vulnerability arises from the driver's incorrect handling of rdmacounter allocations, specifically by not embedding counter driver data as required. This oversight can lead to a NULL pointer dereference when the allocandbind function ...

CVE-2026-89557

A flaw was found in the Linux kernel's Multiple Device md driver. A local attacker with control over a malicious disk image could provide a specially crafted on-disk superblock with an invalid 'bblogshift' value. This invalid value can lead to an integer overflow when processing bad block...

CVE-2026-89458

A flaw was found in the Linux kernel's s390/dasd component. The dasdinthandler function incorrectly marks failed Extended Sense Data ESE read operations as successful when processing unallocated ESE tracks. This leads to the block layer receiving stale or uninitialized memory instead of properly...

CVE-2026-80994

A flaw was found in the Open vSwitch component of the Linux kernel. A local attacker could exploit a use-after-free vulnerability during flow deletion. This occurs due to a race condition where the flow mask is freed prematurely, allowing subsequent operations to access deallocated memory...

CVE-2026-89622

A flaw was found in the Linux kernel's HID Human Interface Device subsystem, specifically in the mcp2221 driver. This vulnerability occurs because the driver fails to clear a buffer pointer after an I2C/SMBus transfer completes. A local attacker could exploit this by triggering a delayed or...

CVE-2026-89493

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs lives in a single...

CVE-2026-89506 RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Add UVERBSATTRUHW to UVERBSMETHODREGMR The original commit missed that three drivers mthca, irdma, siw have UHW data associated with regmr that cannot be passed through the ioctl. They also assume that the udata cann...

EUVD-2026-76399

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs lives in a single...

CVE-2026-89493

CVE-2026-89493 affects the ocfs2 filesystem in the Linux kernel. In ocfs2_validate_refcount_block(), the rl_used and rl_count fields of an on-disk refcount block are never checked against the block's fixed record capacity (247 for a 4K block) or against each other. A crafted or corrupted block wi...

CVE-2026-89329

A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service DoS where...

CVE-2026-89329 Device-mapper-multipath: local denial of service via blocking ipc send operations

A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service DoS where...

CVE-2025-7771

CVE-2025-7771 — ThrottleStop.sys 任意物理内存读写 针对 TechPowerUp ThrottleStop.sys 驱动（CVE-2025-7771）的完整概念验证（PoC）。 一个已签名且仍可加载的内核驱动通过两个 IOCTL 暴露了未经校验的物理内存读写。 本仓库将该原语转化为可用的从管理员到 SYSTEM 的本地权限提升，并记录了一个设备命名怪癖， 该怪癖可绕过大多数基于路径和文件名的检测。 针对相同 IOCTL 的 PoC 早已存在（见致谢）。这是一个独立的完整利用链，而非原语演示。 受影响的驱动 字段| 值 ---|--- SHA256|...

CVE-2024-55347

CVE 披露：CVE-2024-55347 CVE-2024-55347 公开披露 🚀 日期： 10-02-2025 摘要 Kroll Artifact Parser And Extractor KAPE v1.3.0.2 中存在一个二进制植入漏洞，攻击者可通过将恶意构造的二进制文件放置到特定目录中提升权限并执行任意代码。该漏洞可能导致未经授权的系统访问以及敏感数据的潜在泄露。 受影响产品 供应商： Kape by Eric Zimmerman 产品： kape.exe 版本： 1.3.0.2 漏洞描述 KAPE 产品团队、其开发者以及 CVE Mitre 已被告知 Kroll...