cve-2023-46813-poc

CVE-2023-46813 PoC 1. Applica le patch nella cartella host-patches all'host Linux e a QEMU. 2. Avvia una VM SEV-SNP. 3. Esegui il codice in questo repository e attendi il messaggio "waiting for the hypervisor to change memory to MMIO". 4. Esegui ripetutamente il comando attack in QEMU. 5. Una vol...

mmiotic

mmiotic Uno strumento esplorativo per il timing di MMIO — cronometra qualsiasi indirizzo fisico e disseziona l' hardware dalla latenza. Sorprendentemente utile per il reverse engineering dell'hardware, il fingerprinting degli hypervisor, l'analisi dell'attività dei dispositivi tramite canali...

CVE-2026-72063 gpio: tegra: do not call pinctrl for GPIO direction

In the Linux kernel, the following vulnerability has been resolved: gpio: tegra: do not call pinctrl for GPIO direction tegragpiodirectioninput and tegragpiodirectionoutput already program the GPIO controller direction registers directly. The additional pinctrlgpiodirectioninput/output calls do n...

wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses

...

CVE-2026-68327

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

CVE-2026-68193

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7925rxcheck and mt7925queuerxskb dispatch it to mt7925mactxfree on every bus. mt7925mactxfree cleans the DMA tx queues with...

CVE-2026-68175

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix resource leak on mmiotrace tracepipe close The mmiotrace tracer was added May 12th 2008. At that time, resources created in pipeopen could not be freed because there was not pipeclose function pointer of the tracer...

UBUNTU-CVE-2026-68195

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7615rxcheck and mt7615queuerxskb dispatch it to mt7615mactxfree on every bus. mt7615mactxfree cleans the DMA tx queues with...

CVE-2026-68195

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7615rxcheck and mt7615queuerxskb dispatch it to mt7615mactxfree on every bus. mt7615mactxfree cleans the DMA tx queues with...

EUVD-2026-55296

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7615rxcheck and mt7615queuerxskb dispatch it to mt7615mactxfree on every bus. mt7615mactxfree cleans the DMA tx queues with...

CVE-2026-68195

The CVE describes a Linux kernel issue in the mt76/mt7615 wireless driver where PKT_TYPE_TXRX_NOTIFY is mmio-only but was dispatched on non-mmio buses, causing a NULL dereference when mt7615_mac_tx_free() calls tx_cleanup() with a NULL queue_ops->tx_cleanup(). The fix drops TXRX_NOTIFY on non-...

CVE-2026-68194

The CVE-2026-68194 issue affects Linux kernel wifi driver stack mt76/mt7921: TXRX_NOTIFY is an mmio-only event but was dispatched on non-mmio buses (USB/SDIO) via mt7921_rx_check()/mt7921_queue_rx_skb(), causing a NULL pointer dereference in mt7921_mac_tx_free() when mt76_queue_tx_cleanup() calls...

CVE-2026-68194 wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7921rxcheck and mt7921queuerxskb dispatch it to mt7921mactxfree on every bus. mt7921mactxfree cleans the DMA tx queues with...

CVE-2026-68193

The CVE-2026-68193 entry concerns the Linux kernel’s wifi mt76 mt7925 driver. A TXRX_NOTIFY event is mmio-only, but mt7925_rx_check() and mt7925_queue_rx_skb() dispatched it to mt7925_mac_tx_free() on non-mmio buses, where tx cleanup called a NULL queue_ops->tx_cleanup() on USB. This caused a ...

CVE-2026-68193 wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7925rxcheck and mt7925queuerxskb dispatch it to mt7925mactxfree on every bus. mt7925mactxfree cleans the DMA tx queues with...

EUVD-2026-55277

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix mmiotrace possible NULL dereferencing of hiter-dev If the mmiopipeopen fails to find a PCI device, the hiter-dev will be assigned to NULL. The mmiotrace read function dereferences the hiter-dev if hiter exists. Chang...

CVE-2026-68176

The CVE-2026-68176 entry concerns the Linux kernel tracing subsystem (mmiotrace) where a NULL dereference could occur if mmio_pipe_open() fails to locate a PCI device and hiter->dev is NULL. The read() path previously dereferenced hiter->dev without verifying it; the fix adds a check for hi...

CVE-2026-68175

The CVE-2026-68175 entry documents a fixed resource leak in the Linux kernel tracing subsystem (mmiotrace) related to trace_pipe close. Specifically, mmio_pipe_open() allocated a header_iter and took a pci_dev reference when trace_pipe opened; mmio_close() frees them but was not wired to the trac...

CVE-2026-68175 tracing: Fix resource leak on mmiotrace trace_pipe close

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix resource leak on mmiotrace tracepipe close The mmiotrace tracer was added May 12th 2008. At that time, resources created in pipeopen could not be freed because there was not pipeclose function pointer of the tracer...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Viawdt: fixed a critical boot hang caused by unnamed resource allocation. The VIA watchdog driver uses allocateresource to reserve a MMIO region for the watchdog control register. However, the allocated resource was not given a...