SUSE CVE-2026-99164

In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization order before devmrequestirq The driver calls devmrequestirq before initializing the completion used by the interrupt handler. Since the interrupt may occur immediately after...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: swp: Improve locking user experience When the first block is locked or the first few blocks, if the user wants to fully unlock the device, there are two possible outcomes: - Either they request to unlock the entire...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state using spigetdrvdata, but the probe never stores it; thus, suspend dereferences a NULL pointer. Store it during the probe...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel had...

CVE-2026-99164

A flaw was found in the Linux kernel's Serial Peripheral Interface SPI driver for i.MX devices. The driver allocates Direct Memory Access DMA bounce buffers that are smaller than the cache line size used during hardware mapping and synchronization. This size discrepancy causes DMA operations to...

Extracting-User-credentials-For-Web-portal-and-WiFi-AP-For-Hathway-Router-CVE-2024-44815-

Extracting-User-credentials-For-Hathway-Router Via SPI flash-CVE-2024-44815 Vulnerability Description: During the security assessment of the Router firmware, it was observed that router login credentials of both web portal and Wi-Fi access point are stored in plain text in SPI flash memoey...

SpiMitm

+OPTIONS: ^: SpiMitm - SPI flash read MitM attack PoC for anti-firmware forensics This PoC is focused on https://up-board.org/upsquared/specifications/UP Squared. How to use Follow Alan Sguigna's build process explained...

CVE-2025-51643

CVE-2025-51643: Unprotected SPI Flash Enables Firmware Extraction in Meitrack T366G-L Description Meitrack T366G-L GPS Tracker devices contain an SPI flash chip Winbond 25Q64JVSIQ that is accessible without authentication or tamper protection. An attacker with physical access can attach a standar...

spidump

spidump — SPI/QSPI trace capture & reconstruction spidump parses logic-analyzer captures of a device reading its SPI/QSPI NOR flash at boot and reconstructs the flash image from the read traffic — no direct chip read required. The flash command set is modelled with Scapy, so a read transaction is...

Exploit-Writeups

This is a collection of exploit writeups that I've authored: PS3 lv0ldr SPI MITM...

IntelTXE-PoC

Disclaimer All information is provided for educational purposes only. Follow these instructions at your own risk. Neither the authors nor their employer are responsible for any direct or consequential damage or loss arising from any person or organization acting or failing to act on the basis of...

Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383

Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383 Vulnerability Description: During the security assessment of the Router firmware, it was observed that sensative information regarding the devices connected to router such as Mobile phone,Laptos, Tablets is...

yaml-payload-2

yaml-payload A SnakeYAML deserialization exploit payload for CVE-2022-1471 , adapted from artsploit/yaml-payload originally based on mbechler/marshalsec. What it does When loaded via SnakeYAML's unsafe Yaml.load, this payload takes over the running application and replaces it with a "You've Been...

CVE-2026-98931

A flaw was found in the Linux kernel's Memory Technology Device MTD SPI-NAND driver. When probing a flash memory device configured without an Error Correction Code ECC engine, the driver attempts to access an uninitialized pointer. A local user could exploit this flaw to crash the system, resulti...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), dk.grinn.keycloak:keycloak-migrate-resource (>=0.0.6, <=1.0.11) +9 more potentially affected by CVE-2026-9083 via org.keycloak:keycloak-services (6.0.1)

org.keycloak:keycloak-services MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =0.29.1, =0.0.6, =0.0.6, =1.0.11 -...

dk.grinn.keycloak:keycloak-migrate-resource (11.0.3.0), dk.grinn.keycloak:keycloak-migrate-spi (11.0.3.0) +10 more potentially affected by CVE-2026-9083 via org.keycloak:keycloak-services (11.0.3)

org.keycloak:keycloak-services MAVEN version 11.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - dk.grinn.keycloak:keycloak-migrate-resource 11.0.3.0 - dk.grinn.keycloak:keycloak-migrate-spi...

dk.grinn.keycloak:keycloak-migrate-resource (11.0.3.0), dk.grinn.keycloak:keycloak-migrate-spi (11.0.3.0) +10 more potentially affected by CVE-2026-9799 via org.keycloak:keycloak-services (11.0.3)

org.keycloak:keycloak-services MAVEN version 11.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - dk.grinn.keycloak:keycloak-migrate-resource 11.0.3.0 - dk.grinn.keycloak:keycloak-migrate-spi...

com.github.vzakharchenko:keycloak-plugins (>=0.1, <=1.0.1), com.github.vzakharchenko:mikrotik-radius-plugin (>=0.1, <=1.0.1) +15 more potentially affected by CVE-2026-9800 via org.keycloak:keycloak-services (8.0.1)

org.keycloak:keycloak-services MAVEN version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:keycloak-plugins =0.1, =0.1, =0.1, =0.1, =2.0.4, =2.0.4, =2.0.5 -...

CVE-2026-99164

In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...