CVE-2025-14174-Poc

Exploit PoC pour CVE-2025-14174 Aperçu Ce dépôt contient un exploit de preuve de concept PoC entièrement fonctionnel pour CVE-2025-14174 également référencé sous EUVD-2025-203113, une vulnérabilité critique de corruption mémoire dans le moteur graphique ANGLE. Le défaut provient d'une restriction...

CVE-2026-98376

The Linux kernel contains a vulnerability in the eBPF subsystem where percpu_array_map_ops.map_meta_equal incorrectly points to bpf_map_meta_equal(). Because the latter fails to compare max_entries, a percpu array used as an inner map can be replaced with a smaller one, bypassing size checks. Thi...

EUVD-2026-95531

In the Linux kernel, the following vulnerability has been resolved: bpf: Use arraymapmetaequal for percpu array inner map replacement percpuarraymapops.mapmetaequal points to the generic bpfmapmetaequal, which does not compare maxentries. When a percpu array serves as an inner map, replacing it...

CVE-2026-21001-WebAssembly-Linear-Memory-OOB-via-Table-Index-Confusion

CVE-2026-21001 – Внеграничный доступ к линейной памяти WebAssembly из-за путаницы индексов таблицы Обзор Модуль WebAssembly использует импортированную функцию без проверки границ индекса массива. Злоумышленник может указать индекс за пределами допустимого диапазона, чтобы читать или записывать...

CVE-2021-32537

CVE-2021-32537 : Accès hors limites dans RTKVHD64 menant à la corruption du pool. Ceci est un bogue que j'ai signalé à Realtek début avril 2021. Le pilote affecté s'appelle RTKVHD64.sys et semble disponible sur un grand nombre de matériels courants testé sur les configurations matérielles...

CVE-2019-9810

Exploit CVE-2019-9810 pour Firefox sur Windows CVE-2019-9810 est une vulnérabilité découverte et exploitée lors du Pwn2Own 2019 par Richard Zhu et Amat Cama. Elle affecte le moteur JavaScript de Mozilla, Spidermonkey, et a été utilisée pour compromettre le processus de rendu. Le problème a été...

CVE-2021-21220

Exploitation de CVE-2021-21220 Du comportement JIT incorrect à l'exécution de code à distance Aperçu Cette présentation explique l'exploitation de CVE-2021-21220 , une vulnérabilité dans le moteur JavaScript V8 de Google Chrome causée par des hypothèses incorrectes du compilateur JIT lors de...

DEBIAN-CVE-2026-98365

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

DEBIAN-CVE-2026-98291

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix off-by-one bounds check in RX submit btintelpciesubmitrx used frbdindex rxq-count to guard the FRBD array access, allowing frbdindex == rxq-count to pass through and index one element past the end of t...

AZL-106479 CVE-2026-98272 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in pagepool allocation The per‑processor buffering scheme is supported only if the number of pools nrxqs 2 does not exceed MVPP2BMMAXPOOLS 8. This is already checked in mvpp2probe during the...

AZL-105987 CVE-2026-98221 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...

AZL-106377 CVE-2026-98203 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...

DEBIAN-CVE-2026-98185

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiexret80211scan subtracts the fixed response fields and the firmware-provided BSS length from resp-size without first proving that either extent fits. A short response or oversize...

UBUNTU-CVE-2026-98203

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...

UBUNTU-CVE-2026-98272

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in pagepool allocation The per‑processor buffering scheme is supported only if the number of pools nrxqs 2 does not exceed MVPP2BMMAXPOOLS 8. This is already checked in mvpp2probe during the...

CVE-2026-98282

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommutcecheckioba The commit b1af23d836f8 "KVM: PPC: iommu: Unify TCE checking" unified IOBA parameter checking across KVM and VFIO into iommutcecheckioba. While doing so, the passed ...

CVE-2026-98272

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in pagepool allocation The per‑processor buffering scheme is supported only if the number of pools nrxqs 2 does not exceed MVPP2BMMAXPOOLS 8. This is already checked in mvpp2probe during the...

CVE-2026-98221

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...

UBUNTU-CVE-2026-98221

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...

CVE-2026-98203

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...