EUVD-2026-66462

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

CVE-2026-80547

A flaw was found in the Linux kernel's s390/vfioccw component. This vulnerability arises from the lack of a proper lock to manage the list of Channel Report Word CRW payloads, which are asynchronous events from hardware. Without this lock, these payloads may not be read cohesively, potentially...

claude_opus_cve_2023_0266

Claude 3 Opus が CVE-2023-0266 を理解しておらず、発見もできないことのデモンストレーション デモ 1。 バグの場所を伝えられたとしても Opus はそれを発見できず、ロック獲得の存在を幻覚します デモ 2。 「プロンプトエンジニアリング」すなわち、LLM にバグの見つけ方を正確に指示することも効果がありません デモ 3。 この Project Zero のブログ記事は、この脆弱性について説明しています。要約すると、sndctlelemwrite 関数に到達する経路は2つあります。1つは次のような形で、安全です: root@kitploit: sndctlioc...

vsock_poc

vsockpoc 调查 CVE-2021-26708 背后的漏洞 本仓库包含关于 CVE-2021-26708 的简要分析报告，以及如何将该漏洞转化为释放后使用（Use After Free）写入原语。这里的 PoC 并非完整的利用程序，只是我在调查该漏洞时使用的测试框架。它能够成功访问 kmalloc-64 缓存中释放后的条目，但没有提供任何用于内存整理并在该槽位放置感兴趣对象的相关代码。 这是由 @a13xp0p0v 报告的一个有趣的漏洞。它之所以引起我的注意，是因为补丁非常简单，仅仅在五个地方阻止了在锁外部获取对 vsk-transport 的引用。...

CVE-2026-80547

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

CVE-2026-80547

This vulnerability affects the Linux kernel 's s390/vfio_ccw subsystem (Virtual Function Interface for Channel-Word devices on the s390 architecture). The root cause is a missing lock on the CRW (Control Region Word) region, which handles asynchronous hardware events; without it, the list of payl...

CVE-2026-80547 s390/vfio_ccw: Implement a crw lock

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Implement a crw lock Unlike the channelprogram struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a...

CVE-2026-74733

A flaw was found in the Linux kernel's gpio: pca953x driver, which manages General Purpose Input/Output GPIO expanders. The driver uses its own locking mechanism, but the pca953xirqbussyncunlock function failed to acquire the necessary lock when performing register operations. This oversight coul...

CVE-2026-74646

A flaw was found in the Linux kernel's fastrpc subsystem. When an invoke operation is interrupted by a signal, the fastrpcinternalinvoke function moves memory mappings without properly holding the fl-lock. This missing lock during memory map manipulation creates a race condition, which could lead...

SUSE CVE-2026-74733

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74733

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74656

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

CVE-2026-74646

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

CVE-2026-74733

A race condition in the Linux kernel's gpio: pca953x driver (managing PCA953x GPIO expanders) allows concurrent threads to access hardware registers without proper locking. The function pca953x_irq_bus_sync_unlock() performed regmap read/write operations without holding the driver's i2c_lock , wh...

CVE-2026-74733 gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

EUVD-2026-64420

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74646 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

EUVD-2026-64583

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

CVE-2026-74646

CVE-2026-74646 is a race condition in the Linux kernel's misc: fastrpc subsystem. When a fastrpc invoke is interrupted by a signal, fastrpc_internal_invoke() moves all buffers from fl->mmaps onto cctx->invoke_interrupted_mmaps via list_del()/list_add_tail() without holding fl->lock , the...

CVE-2026-74646 misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...