1201 matches found
CVE-2023-20938
CVE-2023-20938 English рднреЗрджреНрдпрддрд╛ рд╡рд┐рд╢реНрд▓реЗрд╖рдг 1. рдХреНрд▓рд╛рдЗрдВрдЯ A рдФрд░ рдХреНрд▓рд╛рдЗрдВрдЯ B рд╕рдВрджрд░реНрдн рдкреНрд░рдмрдВрдзрдХ servicemanager рдХреЗ рдорд╛рдзреНрдпрдо рд╕реЗ Binder рдХрдиреЗрдХреНрд╢рди рд╕реНрдерд╛рдкрд┐рдд рдХрд░рддреЗ рд╣реИрдВ 2. A рдиреЛрдб 0xbeef рдмрдирд╛рддрд╛ рд╣реИ node = bindernewnodeproc, fp;, B ref-targetnode рдХреЗ рдорд╛рдзреНрдпрдо рд╕реЗ рдиреЛрдб 0xbeef рдХреЛ рд╕рдВрджрд░реНрднрд┐рдд рдХрд░рддрд╛ рд╣реИ 3. B рдкрд╣рд▓реЗ targetnode 0xbeef рдХреЛ рд╕рд╣реА рдврдВрдЧ ...
CVE-2026-43494-PinTheft-PoC
SLEY тАФ ╪е╪л╪и╪з╪к ╪з┘Д┘Е┘Б┘З┘И┘Е ┘Д┘А PinTheft CVE-2026-43494 ╪е╪л╪и╪з╪к ╪з┘Д┘Е┘Б┘З┘И┘Е тАФ uid=1000raken тЖТ uid=0root ╪и╪╣╪п ╪к╪┤╪║┘К┘Д ./sley ╪╣┘Д┘Й WSL2 6.6.87.2-microsoft-standard-WSL2 ┘Е┘Д┘Б ┘И╪з╪н╪п ┘Д╪е╪л╪и╪з╪к ╪з┘Д┘Е┘Б┘З┘И┘Е ┘Д┘А CVE-2026-43494 PinTheft: ╪к╪╡╪╣┘К╪п ╪╡┘Д╪з╪н┘К╪з╪к ┘Е╪н┘Д┘К ┘Б┘К ┘Ж┘И╪з╪й ┘Д┘К┘Ж┘Г╪│ ┘К╪м┘Е╪╣ ╪и┘К┘Ж ╪о╪╖╪г ┘Б┘К ╪╣╪п ╪з┘Д┘Е╪▒╪з╪м╪╣ ┘Б┘К zerocopy ┘Д┘А RDS ┘И╪з┘Д┘Е╪о╪з╪▓┘Ж ╪з┘Д┘Е╪д┘В╪к╪й...
CVE-2026-80911
CVE-2026-80911 affects the Linux kernel ASoC SOF (Sound Open Firmware) audio driver. The vulnerability resides in the error path of sof_widget_setup_unlocked() . When either tplg_ops->dai_config or widget_kcontrol_setup fails during widget setup, sof_widget_free_unlocked() is called twice, cau...
CVE-2026-80888
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...
EUVD-2026-71401
In the Linux kernel, the following vulnerability has been resolved: futex: Avoid private hash use-after-free on final put futexprivatehashput drops the reference to fph before evaluating fph-mm for wakeupvar. futexrefput enables preemption again before returning. If that put drops the final...
CVE-2026-80732 ata: pata_sl82c105: fix bridge revision use-after-free
In the Linux kernel, the following vulnerability has been resolved: ata: patasl82c105: fix bridge revision use-after-free pcigetslot returns a referenced PCI device. Commit 44c10138fd4b "PCI: Change all drivers to use pcidevice-revision" replaced a configuration-space read with direct access to t...
CVE-2026-80642
A flaw was found in the Linux kernel's liveupdate subsystem. This vulnerability arises from improper reference counting of incoming File-Lifecycle-Bound FLB data. A subsystem might hold onto FLB data for an extended period, and without proper reference counting, the FLB structure could be...
CVE-2026-43494
ЁЯЫая╕П PinTheft тАФ CVE-2026-43494 рд▓рд┐рдирдХреНрд╕ рдХрд░реНрдиреЗрд▓ рдореЗрдВ RDS + iouring рдкреГрд╖реНрда рдХреИрд╢ рдЕрдзрд┐рд▓реЗрдЦрди рдХреЗ рдорд╛рдзреНрдпрдо рд╕реЗ рд╕реНрдерд╛рдиреАрдп рд╡рд┐рд╢реЗрд╖рд╛рдзрд┐рдХрд╛рд░ рд╡реГрджреНрдзрд┐ ЁЯУМ рдЕрд╡рд▓реЛрдХрди PinTheft рдПрдХ рдкрд░рд┐рд╖реНрдХреГрдд рд╕реНрдерд╛рдиреАрдп рд░реВрдЯ рд╢реЛрд╖рдг рд╣реИ рдЬреЛ CVE-2026-43494 рдХреЗ рд▓рд┐рдП рд╣реИ, рдЬреЛ рд▓рд┐рдирдХреНрд╕ рдХрд░реНрдиреЗрд▓ рдХреЗ рд░рд┐рд▓рд╛рдпрдмрд▓ рдбреЗрдЯрд╛рдЧреНрд░рд╛рдо рд╕реЙрдХреЗрдЯреНрд╕ RDS рдЙрдкрддрдВрддреНрд░ рдореЗрдВ рдПрдХ рд╕рдВрджрд░реНрдн-рдЧрдгрдирд╛ рдмрдЧ рд╣реИред RDS...
CVE-2026-80683
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...
UBUNTU-CVE-2026-80698
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices idxdconfwqrelease, idxdconfenginerelease, idxdconfgrouprelease each call kfree on the enclosing struct. The...
UBUNTU-CVE-2026-80683
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...
CVE-2026-80619
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix potential UAF in aareplaceprofiles The function aareplaceprofiles was accessing udata-size after calling aaputloaddataudata, causing a potential UAF. Fixed this by saving the size to a local variable before dropping...
CVE-2026-80692
CVE-2026-80692 is a theoretical Use-After-Free (UAF) in the Linux kernel's Bluetooth HCI subsystem , specifically in the hci_connect_acl() and hci_connect_le_sync() callbacks. If the conn object is freed while the hci_sync task is running, a UAF can occur. The fix holds a refcount to the conn obj...
CVE-2026-80692
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...
CVE-2026-80683
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with the scoconnput that follows scosockhold; the...
CVE-2026-80642
CVE-2026-80642 affects the Linux kernel 's liveupdate subsystem. During a Live Update, a subsystem may need to hold incoming File-Lifecycle-Bound (FLB) data for an extended period (e.g., during device enumeration). The vulnerability stems from a missing reference count on the incoming FLB structu...
CVE-2026-80619
CVE-2026-80619 is a Use-After-Free (UAF) in the Linux kernel's AppArmor subsystem. The function aa_replace_profiles accessed udata->size after calling aa_put_loaddata(udata), which drops the reference to the load data structure. The fix saves the size into a local variable before releasing the...
CVE-2026-80519 ovpn: finish crypto callback cleanup before peer release
In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration a...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098718)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098718 advisory. In the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in roseneigh refcount Current implementation maintains two...
Astra Linux тАУ Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-pci: A possible memory leak caused by the missing pcidevput has been fixed. pcigetdevice will increase the reference count of the returned pcidev. We need to use pcidev PUT to decrease the reference count before amdpro...