143331 matches found
qu1ckr00t
qu1ckr00t Androidカーネルの任意R/W（arbitrary R/W）の威力を示すPoCアプリケーションです（CVE-2019-2215）。解説: https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/ Qu1ckR00tはPROOF OF CONCEPT（概念実証）です。貴重なユーザーデータが入った個人のデバイスで使用しないでください。動作確認はPixel...
miniupnpd_poc
Miniupnpd path が526バイトを超えるコールバックURIを含む SUBSCRIBE リクエストを送信することで引き起こされます。 根本原因は、snprintf の戻り値を検証していないことです。snprintf は実際にコピーしたバイト数ではなく、コピー できたであろう バイト数を返すためです。 2019年1月25日時点で、このリポジトリ内のPoCはGoogle Wifiに対して正常にテストされています。 miniupnpd を利用する他のデバイスも影響を受ける可能性があります。 根本原因 upnpevents.c root@kitploit: static void...
CVE-2026-93281 wifi: rtw89: fix HE extended capability length check
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89maccheckheobssnarrowbwruiter reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen = 11 before...
EUVD-2026-86153
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89maccheckheobssnarrowbwruiter reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen = 11 before...
CVE-2026-93280 greybus: audio: bound the topology section sizes against the fetched size
In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...
CVE-2026-93280 greybus: audio: bound the topology section sizes against the fetched size
In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...
EUVD-2026-86152
In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...
CVE-2026-93280
The Linux kernel is vulnerable to an out-of-bounds read within the greybus: audio component. The issue occurs because gb_audio_gb_get_topology() fetches a topology blob based on a size provided by a module, but gbaudio_tplg_parse_data() fails to verify if the module-supplied section sizes (size_d...
EUVD-2026-86256
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvuregisterinterrupts walks every MSI-X vector and uses strstr to match "Mbox" or "FLR" in irqname before pinning those interrupts to CPU 0. irqname is a per-vector...
CVE-2026-93246
A vulnerability in the Linux kernel (specifically the octeontx2-af driver) allows an out-of-bounds read during the setting of MSI-X IRQ affinity. The rvu_register_interrupts() function uses strstr() to search for "Mbox" or "FLR" within the irq_name buffer. Because this buffer may contain uninitia...
CVE-2026-93246 octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvuregisterinterrupts walks every MSI-X vector and uses strstr to match "Mbox" or "FLR" in irqname before pinning those interrupts to CPU 0. irqname is a per-vector...
CVE-2026-93234 drm/gud: validate TV mode names before creating enum property
In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...
CVE-2026-93234
A vulnerability exists in the Linux kernel 's drm/gud component where the gud_connector_add_tv_mode() function fails to validate that TV mode names returned via the GUD protocol are NUL-terminated. Because the protocol uses fixed-size entries, a device returning a name without a terminating NUL b...
CVE-2026-93234 drm/gud: validate TV mode names before creating enum property
In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...
EUVD-2026-86239
In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...
EUVD-2026-86234
In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...
CVE-2026-93229 nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry
In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...
CVE-2026-93229
In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...
