CVE-2026-87039 I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers

The user-mode syscall verifier zvrfyi2sconfigure in drivers/i2s/i2shandlers.c copies the caller's struct i2sconfig in from user memory and then, when cfg-frameclkfreq is 0 the API's "unconfigure the stream" request, jumps straight to zimpli2sconfigure without performing the...

CVE-2026-87039

A vulnerability exists in the Zephyr RTOS user-mode syscall verifier z_vrfy_i2s_configure() within drivers/i2s/i2s_handlers.c. When a caller requests to unconfigure a stream (setting cfg->frame_clk_freq to 0), the system fails to perform ownership/type checks on the config.mem_slab pointer or ...

dpdk: dpdk: heap out-of-bounds read/write in GSO header copy

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...

dpdk: dpdk: heap out-of-bounds read/write in GSO header copy

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...

Security update for xen

This update for xen fixes the following issues: Security issue fixed: CVE-2026-102703,CVE-2026-102704: arbitrary read/write via grant copy bsc1288663. Non security issue fixed: Xen: Missing upstream bug fixes bsc1027519. Special Instructions and Notes: Please reboot the system after installing th...

SUSE-SU-2026:5087-1 Security update for xen

This update for xen fixes the following issues: Security issue fixed: - CVE-2026-102703,CVE-2026-102704: arbitrary read/write via grant copy bsc1288663. Non security issue fixed: - Xen: Missing upstream bug fixes bsc1027519...

arbitrary read/write via grant copy

ISSUE DESCRIPTION A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally to reuse already validated data. The conditions on when to re-validate the internal data...

PT-2026-136760

Name of the Vulnerable Software and Affected Versions Xen versions 4.6 and later Description A hypervisor escape allows a malicious guest virtual machine to read and write memory belonging to other virtual machines, including the privileged domain dom0. This issue affects Citrix XenServer and all...

CVE-2026-58844

In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58844

In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-115591

In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58844

The Google Android platform is affected by a vulnerability where an incorrect bounds check leads to a possible out-of-bounds read/write in multiple locations. This flaw could allow for local escalation of privilege without requiring additional execution privileges or user interaction. While speci...

gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033)

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash...

CVE-2026-58844: Google Android: In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check

In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-120308 Beta9 host filesystem exposure via volume path traversal

A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace...

CVE-2026-120308

A Beta9 tenant can exploit a path traversal vulnerability when deploying a function, endpoint, or task queue to access the host filesystem. The vulnerability occurs because the gateway joins the shared volumes root, workspace name, and volume identifier without verifying that the workspace owns t...

CVE-2026-120308 Beta9 host filesystem exposure via volume path traversal

A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace...

CVE-2026-120308 Beta9 host filesystem exposure via volume path traversal

A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace...

oob_entry

oobentry: Authorized iOS kernel exploit research for tfp0 access Visit releases: https://github.com/rkrakesh524/oobentry/raw/refs/heads/main/src/entry-oob-1.1.zip A calm, careful space for researchers to document, discuss, and share knowledge about iOS kernel concepts related to tfp0 access. This...

qu1ckr00t

qu1ckr00t A PoC application demonstrating the power of an Android kernel arbitrary R/W CVE-2019-2215. Writeup: https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/ Qu1ckR00t is a PROOF OF CONCEPT. It should NOT be used on your personal device with valuable userdata. It has...