copyfail-exploit

Copy Fail · CVE-2026-31431 Escalatazione locale dei privilegi sui kernel Linux dalla versione 4.11 fino alle release 6.18 corrette escluse. Il bug risiede nell'interfaccia socket AFALG del kernel—in particolare nel modo in cui authencesn gestisce le liste scatter-gather durante la decrittazione...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Set the correct AMDGPU sg segment limitation. The driver needs to set the correct maxsegmentsize; otherwise, debugdmamapsg will complain about the over-mapping of the AMDGPU sg length as follows: WARNING: CPU: 6 PID:...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fixed the issue with the ib block iterator counter overflow. When registering a new DMA MR after selecting the best aligned page size for it, we iterate over the given sglist to split each entry into smaller, aligned D...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix looping of queued SG entries The value of dwc3request-numqueuedsgs is decremented upon completion. If a partially completed request is processed, then dwc3request-numqueuedsgs no longer reflects the total...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: safexcel – Added error handling for dmamapsg calls The macro dmamapsg function may return 0 in the event of an error. This patch enables checks in case of a macro failure and ensures that previously mapped buffers are...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/bnx2x: Prevent access to a freed page in pagepool Fixed a race condition that could lead to system crashes during EEH error handling During EEH error recovery, the bnx2x driver’s transmit timeout logic could create a race...

CVE-2026-89515

A flaw was found in the Linux kernel's SCSI core component. When processing data transfers using scatter-gather lists, the system does not properly initialize padding bytes for unaligned data elements. This can result in the exposure of uninitialized memory, potentially allowing a local attacker ...

CVE-2026-80748 mmc: loongson2: Fix sg iteration in data reorder functions

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500mmcreordercmddata and ls2k2000mmcreordercmddata, the foreachsg macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry...

CVE-2026-74678

A flaw was found in the Linux kernel's ax88179178a USB network driver. When the network interface has scatter-gather SG enabled and a packet linearization operation fails, the system fails to free the associated memory buffer. This oversight leads to a memory leak, which could be exploited by an...

EUVD-2026-53777

In the Linux kernel, the following vulnerability has been resolved: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIGDMAAPIDEBUGSG is enabled, importing a udmabuf into a DRM driver e.g. amdgpu for video playback in GNOME Videos / Showtime triggers a spurious...

PT-2026-68423

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dma-buf/udmabuf component where importing a udmabuf into a DRM driver triggers a spurious cacheline tracking warning when CONFIG DMA API DEBUG SG is enabled. This...

RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

...

SUSE CVE-2026-64464

In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhciringtosgtable allocates a temporary pages array and uses it to build the returned sgtable with sgalloctablefrompages. The error paths free the pages array, but the success path...

CVE-2026-64464

In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhciringtosgtable allocates a temporary pages array and uses it to build the returned sgtable with sgalloctablefrompages. The error paths free the pages array, but the success path...

CVE-2026-64464 xhci: sideband: fix ring sg table pages leak

In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhciringtosgtable allocates a temporary pages array and uses it to build the returned sgtable with sgalloctablefrompages. The error paths free the pages array, but the success path...

CVE-2026-64464

Consolidated details show CVE-2026-64464 affects the Linux kernel xhci sideband path: xhci_ring_to_sgtable() allocates a temporary pages array used to build an sg_table via sg_alloc_table_from_pages(). On success, the temporary array isn’t freed, causing a leak each time a sideband client uses an...

CVE-2026-64269

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdmawritesg When the server answers an RTRS READ, rdmawritesg builds the source scatter/gather entry for the IBWRRDMAWRITE that returns data to the peer. Its length is taken...

CVE-2026-64019

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express PCI Peripheral Component Interconnect driver. This vulnerability occurs due to a leak in the Direct Memory Access DMA mapping during data setup operations. Specifically, the system fails to properly unmap DMA resources when...

SUSE CVE-2026-64124

In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length netdevmembinddmabuf trusts dmabuf-size and sgdmalen to be PAGESIZE multiples without checking: - txvec is sized dmabuf-size / PAGESIZE, and netdevmemgetniov...

CVE-2026-64124

A flaw was found in the Linux kernel's network device memory net: devmem component. This vulnerability allows an attacker to trigger an out-of-bounds read by providing specially crafted Direct Memory Access DMA buffers with non-page-aligned sizes or Scatter-Gather SG list lengths. This could lead...