circuit-artist

A Digital Logic Simulation Game Every Circuit Is An Image 🎨 Check the Web Demo Game Rules Little pixel triangles are NANDs. Black pixels are background. Everything else is a wire. Screenshots 👀 | | !https://raw...

bd-alaris-firmware-analysis

BD Alaris 8015 Firmware Security Analysis Firmware Security Analysis of the BD Alaris 8015 PC Unit: Unencrypted Wi-Fi Credential Storage and Compound Vulnerabilities CVE-2016-9355 -orange Overview This project presents a firmware security analysis of the BD Alaris 8015 Point-of-Care PC infusion...

CVE-2026-98931

The Linux kernel contains a vulnerability in the mtd: spinand component where a NULL pointer dereference occurs when the "nand-no-ecc-engine" property is set in the Device Tree. Specifically, nanddev_get_ecc_engine() returns success while leaving nand->ecc.engine as NULL, but the SPI-NAND code...

EUVD-2026-108903

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddevgeteccengine takes the NANDECCENGINETYPENONE path and returns success while leaving nand-ecc.engine NULL. The SPI-NAND...

CVE-2026-98931 mtd: spinand: fix NULL pointer dereference with no ECC engine

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddevgeteccengine takes the NANDECCENGINETYPENONE path and returns success while leaving nand-ecc.engine NULL. The SPI-NAND...

CVE-2026-98721

A flaw was found in the Linux kernel's Cadence NAND controller driver. The driver registers its interrupt handler before initializing the internal synchronization lock and completion objects. A pending interrupt during initialization can trigger the handler to access this uninitialized state,...

CVE-2026-93048

A flaw was found in the Linux kernel's Memory Technology Device MTD partition driver. A local user can exploit this by passing a specially crafted offset value, MTDPARTOFSRETAIN, when adding a partition via the BLKPG ioctl on NAND devices. This improper handling can lead to a kernel warning or th...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.5 contains a security vulnerability. This vulnerability stems from the Cadence NAND interrupt handling program not initializing the IRQ lock and the completion object before registering the IRQ. This may lead to suspended interrupt accesses accessing an uninitialized...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: For the mtd:rawnand:fslupm module, a bug in the funexecop function has been fixed. A “off-by-one” test was present in this function. The “op-cs” data is copied into “fun-mchipnumber”, which is used to access the “mchipoffsets” an...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: atmel: The issue with reference counting was fixed in atmelnandcontrollerinit. The reference counting issue occurs in several error handling paths involving an object with a refcount, called “nc-dmac”. In these path...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: Serialize lock/unlock operations in relation to other NAND operations. The functions nandlock and nandunlock involve calling chip-ops.lockarea/unlockarea, but they do not hold the NAND device lock. In controllers th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: A possible null-ptr-deref issue exists in cadencenanddtprobe. This issue could lead to a null-ptr-deref when using ‘res’. If platformgetresource returns NULL, moving using ‘res’ after devmioremapresource wi...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102730

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

EUVD-2026-89201

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102730

LevelX's NAND flash-translation-layer metadata parser contains an unbounded out-of-bounds heap write triggered by mounting an attacker-controlled NAND flash image via lx_nand_flash_open(). The root cause is an unchecked on-flash count in a parser partially generated by an AI. This vulnerability a...

PT-2026-102796

Mounting an attacker-controlled NAND flash image lx nand flash open triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

CVE-2026-102730: Out-of-bounds Write

Mounting an attacker-controlled NAND flash image lxnandflashopen triggers an unbounded out-of-bounds heap write in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full...

ROS-20260929-73-0013

The vulnerability of the drivers/mtd/nand/raw/cadence-nand-controller.c component in the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...