kernel: vsock/virtio: bind uarg before filling zerocopy skb

A flaw was found in the Linux kernel's vsock/virtio transport. This vulnerability occurs when the system processes zerocopy socket buffers skbs and encounters an error during memory allocation for fixed-buffer vectored data. The system may attempt to free memory incorrectly, leading to a...

kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

A flaw was found in the Linux kernel's ipvlan component. The ipvlan devices do not properly inherit neededheadroom and neededtailroom from the physical device phydev. This can lead to insufficient space being reserved for packet headers and trailers, potentially causing memory corruption, such as...

Cooper-ndss-2022

Cooper: 협동 변이를 이용한 스크립트 언어 바인딩 코드 테스트 Cooper는 협동 변이를 활용하여 스크립트 언어의 바인딩 코드를 테스트하여 메모리 안전 문제를 찾습니다. 협동 변이는 스크립트 코드와 관련 문서 객체를 동시에 수정하여 바인딩 코드의 다양한 코드 경로를 탐색합니다. 협동 변이를 지원하기 위해, 우리는 스크립트 코드와 문서 객체 간의 관계를 추론하여 2차원 변이를 안내합니다. 우리는 우리 도구 Cooper를 세 가지 널리 사용되는 상용 소프트웨어, Adobe Acrobat, Foxit Reader 및...

CVE-2025-53020-PoC

CVE-2025-53020 - Apache httpd HTTP/2 Memory Exhaustion PoC A proof of concept demonstrating CVE-2025-53020, a memory exhaustion vulnerability in Apache httpd's HTTP/2 implementation I found in mid-2025. 📖 Deep dive : galbarnahum.com/posts/apache-httpd-cve-2025-53020 Vulnerability Overview Apache...

kernel: nfsd: fix UAF in async copy cancel and shutdown

A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free UAF vulnerability. This allows an async copy object to be freed or used after being freed, potentially causing memory...

kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

A flaw was found in the Linux kernel's Network File System Daemon nfsd component. When performing an asynchronous async copy operation, a programming error causes a stale identifier IDR entry to point to memory that has already been reused. This can lead to memory corruption, where the system...

kernel: svcrdma: Reject inline replies that overflow the pull-up buffer

A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted network reply that is larger than expected. This can cause the system to write data beyond the intended memory area,...

kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem, specifically within the SEV Secure Encrypted Virtualization feature. A malicious guest operating system utilizing SEV-SNP Secure Nested Paging can exploit an out-of-bounds write vulnerability due to improper...

kernel: vsock/virtio: bind uarg before filling zerocopy skb

A flaw was found in the Linux kernel's vsock/virtio transport. This vulnerability occurs when the system processes zerocopy socket buffers skbs and encounters an error during memory allocation for fixed-buffer vectored data. The system may attempt to free memory incorrectly, leading to a...

kernel: igc: set tx buffer type for SMD frames

A flaw was found in the Linux kernel's igc network driver. The igcfpeinitsmdframe function, responsible for initializing transmit TX buffer fields for Stream-based Data SMD frames, does not correctly set the buffer type. This can result in stale XDP eXpress Data Path or XSK AFXDP socket types...

kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev

A flaw was found in the Linux kernel's ipvlan component. The ipvlan devices do not properly inherit neededheadroom and neededtailroom from the physical device phydev. This can lead to insufficient space being reserved for packet headers and trailers, potentially causing memory corruption, such as...

kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF

A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash...

kernel: vsock/virtio: fix zerocopy completion for multi-skb sends

A flaw was found in the Linux kernel's vsock/virtio component. This vulnerability occurs during zerocopy completion for large messages fragmented into multiple socket kernel buffers skbs. An issue in how user arguments uargs are handled for these buffers can lead to pinned user pages not being...

GHSA-MJCV-P78Q-W5FW github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

A denial-of-service DoS vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process...

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

A denial-of-service DoS vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process...

CVE-2026-107676 FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

EUVD-2026-95081

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107676 FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107676

FFmpeg versions through 9.0.2 are vulnerable to an uninitialized memory disclosure within the av_dynamic_hdr_plus_to_t35() function. When the tone_mapping_flag is set to 0, the function fails to initialize up to three payload bytes. An attacker can exploit this by providing crafted Matroska T.35 ...

CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...