1697 matches found
CVE-2026-33957
An out-of-bounds read/write vulnerability exists in the CustOS Driver of the Samsung Mobile Processor Exynos 1580 . Requesting oversized shared memory from the custos_iwc device triggers the flaw, potentially leading to memory corruption or information leakage . The CVSS 3.1 score is 4.2 (MEDIUM)...
Linux IPC shm_trydestroy_orphaned Heap Buffer Overflow DoS
The vulnerability of the shmtrydestroyorphaned function in the ipc/shm.c module of the Linux kernel’s interprocess communication subsystem is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow an attacker to cause a service...
PUB-A-510463247
In VPU, there is a possible shared memory overwrite due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-58094
The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...
EUVD-2026-66253
The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...
CVE-2026-58094
A Time-of-check Time-of-use (TOCTOU) race condition exists in the FIOSSHMLPGCNF ioctl(2) operation of the posixshm module in FreeBSD . The handler fails to hold the rangelock when checking if a page size has already been configured for a largepage shared memory object. This allows two concurrent ...
CVE-2026-58094 TOCTOU race in POSIX shared memory large page configuration
The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...
CVE-2026-58094 TOCTOU race in POSIX shared memory large page configuration
The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...
FreeBSD : FreeBSD -- TOCTOU race in POSIX shared memory large page configuration (ef63188f-a0ff-11f1-ae1f-bc241121aa0a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ef63188f-a0ff-11f1-ae1f-bc241121aa0a advisory. The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This ...
CVE-2022-2590-analysis
CVE-2022-2590, Dirty COW limitato a shmem versione del kernel Linux: Linux/x86 6.0.0-rc1 commit 37887783b3fef877bf34b8992c9199864da4afcb Introduzione: questa vulnerabilità consente all'attaccante di scrivere contenuto arbitrario in una pagina di memoria condivisa di sola lettura, facendo soddisfa...
FreeBSD -- TOCTOU race in POSIX shared memory large page configuration
Problem Description: The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been...
FreeBSD Security Advisory - FreeBSD-SA-26:63.posixshm
FreeBSD Security Advisory - The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been...
PT-2026-81937
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A race condition exists in the FIOSSHMLPGCNF ioctl2 operation used to configure the page size for a largepage shared memory object. The handler fails to hold the...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Ensure that objs is not NULL in virtiogpuarrayputfree. If virtiogpuobjectshmeminit fails e.g., due to fault injection, as happened in the bug report by syzbot, virtiogpuarrayputfree might be called with objs being NUL...
CVE-2026-74584
A flaw was found in the Linux kernel's RDMA/bnxtre component. A local attacker with access to the RDMA device could exploit this vulnerability due to a failure to zero out a shared memory page before exposing it to userspace. This could lead to information disclosure, allowing the attacker to rea...
CVE-2026-74451
A flaw was found in the drm/panthor component of the Linux kernel. The ifacefwtocpuaddr function, responsible for validating firmware interface structure sizes, does not adequately check if the firmware-provided Microcontroller Unit MCU virtual address fits entirely within the shared memory...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102102)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102102 advisory. In the Linux kernel, the following vulnerability has been resolved: net/packet: fix TOCTOU race on mmap'd vnethdr in tpacketsnd In tpacketsnd, when PACKETVNETHDR is...
CVE-2026-49427
Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile2 transmitted such an object with the SFNOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to...
EUVD-2026-62254
Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile2 transmitted such an object with the SFNOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to...
CVE-2026-49427 posixshm: largepage shared memory objects not explicitly wired
Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile2 transmitted such an object with the SFNOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to...