CVE-2022-1015

CVE-2022-1015 Root Cause In the nftparseregister function, because there is no validation when the arg defaults, an out-of-bounds OOB occurs on the stack of the nftdochain function. At this point, using the payload expression allows both read and write. The payload operates as follows: That is, b...

CVE-2020-1020

CVE-2020-1020 Windows Font Driver Type 1 VToHOrigin stack corruption only works on win7 x64...

Linux Distros Unpatched Vulnerability : CVE-2026-80975

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char...

Linux Distros Unpatched Vulnerability : CVE-2026-80944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller- provided data buffer in cmdnode-databuf. Several callers...

CVE-2026-80975

In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...

DEBIAN-CVE-2026-80975

In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...

AZL-100650 CVE-2026-80944 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

DEBIAN-CVE-2026-80944

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

CVE-2026-80944

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

CVE-2026-80975 mfd: qnap-mcu: keep the reply buffer alive past a command timeout

In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...

CVE-2026-80975 mfd: qnap-mcu: keep the reply buffer alive past a command timeout

In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...

CVE-2026-80975

In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnapmcuexec publishes an on-stack buffer to the receive path: unsigned char rxQNAPMCURXBUFFERSIZE; ... reply-data = rx; reply-length = length; and qnapmcureceivebu...

CVE-2026-80975

CVE-2026-80975 is a use-after-free vulnerability in the Linux kernel's qnap-mcu MFD driver. When a command times out or a write fails, qnap_mcu_exec() returns while reply->data still points to its own stack frame. A late MCU reply or unsolicited message written by the serdev receive path then ...

CVE-2026-80944 wifi: mwifiex: Detach sync cmd buffer on interrupted wait

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

CVE-2026-80944

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

CVE-2026-80944 wifi: mwifiex: Detach sync cmd buffer on interrupted wait

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

EUVD-2026-76267

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...

CVE-2026-80944

CVE-2026-80944 affects the Linux kernel's mwifiex Wi-Fi driver. Synchronous commands store a caller-provided data buffer in cmd_node->data_buf; several callers pass stack-allocated objects. If wait_event_interruptible_timeout() is interrupted, the caller releases the stack object while the fir...

PT-2026-90074

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmd node-data buf. Several callers pass stack-allocated objects there. If wait event interruptible...

PT-2026-90105

In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnap mcu exec publishes an on-stack buffer to the receive path: unsigned char rxQNAP MCU RX BUFFER SIZE; ... reply-data = rx; reply-length = length; and qnap mcu...