syzkaller

syzkaller - カーネルファザー syzkaller（siːzˈkɔːlə）は、教師なしのカバレッジガイド型カーネルファザーです。 対応OS：FreeBSD、Fuchsia、gVisor、Linux、NetBSD、OpenBSD、Windows。 メーリングリスト: [email protected]（ウェブまたはメールで参加）。 発見されたバグ: Darwin/XNU、FreeBSD、Linux、NetBSD、OpenBSD、Windows。 ドキュメント 当初、syzkaller は Linux カーネルのファジングを念頭に開発されましたが、 現在では他の OS...

CVE-2022-29968

CVE-2022-29968 CVE-2022-29968에 대한 개념 증명 익스플로잇입니다. Linux 커널, 특히 iouring 시스템에서의 초기화되지 않은 메모리 취약점입니다. 이 크래시는 Syzkaller로 발견되었습니다. 크래시 분석은 Joseph Ravichandran과 Michael Wang이 수행했습니다. 익스플로잇은 Joseph Ravichandran이 작성했습니다. 이 버그는 6.858 at MIT, Spring 2022 최종 프로젝트의 일환으로 발견 및 보고되었습니다. 3e08773c3841 "block:...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: kernfs: A use-after-free issue has been fixed in kernfsremove. Syzkaller managed to trigger concurrent calls to kernfsremovebynamens for the same file, resulting in a KASAN detected use-after-free. This race condition occurs...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: htchst: In the ath9khtcrxmsg function, if there is no callback function, the provided skb is not freed. It is stated that ath9khtcrxmsg either frees the provided skb or passes its management to another callback...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ax25: The refcount leak caused by setting the SOBINDTODEVICE socket option has been fixed. If an AX25 device is bound to a socket by setting the SOBINDTODEVICE socket option, a refcount leak will occur in ax25release. The commit...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: gtp: Fixed a use-after-free in gtpencapdestroy. syzkaller reported a use-after-free in gtpencapdestroy. The same process freed “sk” and accessed it illegally. The commit e198987e7dd7 “gtp: fix suspicious RCU usage” added...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, hsr: rejecting HSR frames if skb cannot hold the tag. Receiving an HSR frame with insufficient space to hold the HSR tag in the skb can result in a crash kernel BUG. 45.390915 skbuff: skbunderpanic:...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/ipv6: avoided a possible Use After Free UAF in ip6routempathnotify syzbot discovered another use-after-free in ip6routempath Notify. 1 The commit f7225172f25a “net/ipv6: prevent use after free in ip6routempath Notify” fail...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: Handling of integer overflows in kmallocreserve The committed change was as follows: c ptr = kmallocsize; if ptr size = ksizeptr; size = kmallocsizeroundupsize; ptr = kmallocsize; This caused various crashes, as reported ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: fixed the lockdep issue in qdisctreereducebacklog The qdisctreereducebacklog function is called with the qdisc lock held, not RTNL. We must use qdisclookuprcu instead of qdisclookup. syzbot reported: WARNING:...

CVE-2023-52927

CVE-2023-52927 CVE-2023-52927 の LPE エクスプロイト - netfilter の Use-After-Free 脆弱性。 この脆弱性に関する私の解説: CVE-2023-52927 - 忘れられた Syzkaller レポートを kCTF エクスプロイトに変える 再現プログラム: KASAN trigger poc ビルド 依存関係をインストール: root@kitploit: make prerequisites エクスプロイトをビルド: root@kitploit: make exploit 対象 kCTF cos-109-17800.436.33...

DEBIAN-CVE-2026-89515

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsiallocsgtables During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x4a/0x70...

CVE-2026-89449 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

CVE-2026-89449 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107291)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107291 advisory. In the Linux kernel, the following vulnerability has been resolved: block/ioctl: prefer different overflow check Running syzkaller with the newly reintroduced signed...

CVE-2026-80852

CVE-2026-80852 is an out-of-bounds write in the Linux kernel's TLS device offload path (net/tls/tls_device.c). The root cause is that tls_push_data() skips its fragment-count check on an early MSG_MORE break, allowing num_frags to exceed MAX_SKB_FRAGS (17) when splice(SPLICE_F_MORE) calls are iss...

CVE-2026-80616

CVE-2026-80616 affects the Linux kernel ieee802154 subsystem. The issue occurs in cfg802154_switch_netns() , where calling WARN_ON() on -ENOMEM returned by dev_change_net_namespace() and device_rename() produces spurious kernel splats when deliberate fault injections are active. This is a low-imp...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmfmac – Check the count value of the channel specification to prevent out-of-bounds reads This patch fixes out-of-bounds reads in brcmfconstructchaninfo and brcmfenablebw402g, which occur when the count value of the...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ppp: Associating skb with a device at tx. Syzkaller triggered a flow dissector warning with the following code: c r0 = openat$ppp0xffffffffffffff9c, &0x7f0000000000, 0xc0802, 0x0 ioctl$PPPIOCNEWUNITr0, 0xc004743e,...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: PID: Taking a reference when initializing cadpid During boot, kernelinitfreeable initializes cadpid to the struct pid of the init task. Later, we may change cadpid via sysctl. When this happens, procdocadpid will increment the...