Estudo-de-Caso-CVE-2026-31431-CopyFail

🐧 CVE-2026-31431 — CopyFail: Linuxカーネル権限昇格 完全なケーススタディ — 発見の経緯、仕組み、テスト方法、再現方法（安全な環境での）、そして2017年以降のほぼすべてのLinuxディストリビューションに影響する重大な脆弱性の修正方法。 🚨 法的免責事項 / 免責条項 このリポジトリは教育目的専用 です。ここに含まれる情報は、セキュリティ専門家、研究者、サイバーセキュリティ学生を対象としています。明示的な許可なく、ここで説明されているいかなる技術もシステムで使用しないでください。...

CVE-2026-76840

RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStreamRead in libs/clipboard/src/windows/wfcliprdr.c requests...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Use variable length arrays instead of fixed-size ones. The issue with the “smatch warning” should be fixed: Error in ntfssetlabel: builtinmemcpy’s ‘uni-name’ is too small 20 vs 256...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: wl1251: A possible buffer overflow issue in wl1251cmdscan has been fixed. The function wl1251cmdscan calls memcpy without checking the length of the destination buffer. This vulnerability can be mitigated by checking that the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy for BIOS version The strlcat function with FORTIFY support triggers a panic because it assumes that the target buffer will overflow, even though the correct target buffer size is provided. In any case,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: VMCI: Fixed a runtime warning from memcpy in dgdispatchashost. Syzkaller encountered a “WARNING in dgdispatchashost” bug. memcpy: A field-spanning write was detected size 56 for a single field “&dginfo-msg” in...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: Fixed the vulnerability in the migratetoram function when there is a copy error. The nouveaudmemcopyone function ensures that the copy push command is sent to the device’s firmware, but it does not track whether the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: BPF: Fixed potential improper pointer dereferencing in bpfsysbpf. The bpfsysbpf helper function allows an eBPF program to load another eBPF program from within the kernel. In this case, the argument union bpfattr pointer along...

CVE-2026-68279

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drmdpsidebandparseremotedpcdread reads numbytes from the raw message and then unconditionally does: memcpybytes, &raw-msgidx, numbytes; without checking that idx...

EUVD-2026-54164

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates...

CVE-2026-15314

Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash...

CVE-2026-64304

A flaw was found in the Linux kernel's QAT QuickAssist Technology crypto module. This vulnerability occurs in the RSA key parser when handling CRT Chinese Remainder Theorem components. An underflow can happen during a memory copy operation if an RSA CRT component is larger than its allocated...

libssh2: libssh2: Denial of Service via integer underflow in AES-GCM cipher negotiation

A flaw was found in libssh2. A pre-authentication integer underflow vulnerability exists in the ssh2ciphercrypt function when negotiating AES-GCM ciphers during the handshake. A malicious SSH server can exploit this to trigger an out-of-bounds read and a memory copy operation with an extremely...

Linux Distros Unpatched Vulnerability : CVE-2026-64527

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without...

UBUNTU-CVE-2026-64527

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

CVE-2026-66033

A flaw was found in libssh2. A pre-authentication integer underflow vulnerability exists in the ssh2ciphercrypt function when negotiating AES-GCM ciphers during the handshake. A malicious SSH server can exploit this to trigger an out-of-bounds read and a memory copy operation with an extremely...

SUSE CVE-2026-64259

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

CVE-2026-64527 drm/hyperv: validate VMBus packet size in receive callback

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

EUVD-2026-48794

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks only verifies that the record's len field is self-consistent with its...

CVE-2026-64259 fuse-uring: make a fuse_req on SQE commit only findable after memcpy

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...