4465 matches found
CVE-2026-9728
The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...
SUSE-SU-2026:23255-1 Security update for util-linux
This update for util-linux fixes the following issues: Security issues fixed: - CVE-2026-13595: heap use-after-free read in libblkid nested partition probing bsc1269583. - CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices bsc1261606. - Several security issues...
CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...
EUVD-2026-64897
The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...
CVE-2026-9728
CVE-2026-9728 is a time-of-check/time-of-use (TOCTOU) race condition in the Zephyr RTOS userspace mailbox subsystem. The syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validates msg->data/msg->size by reading them directly from live userspace memory, then forwards the o...
CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...
CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...
CVE-2026-74692
A flaw was found in the Linux kernel's net/smc component. A time-of-check to time-of-use TOCTOU race condition allows a remote attacker to exploit a window where the listener's state is checked without proper locking. By opening TCP connections while the server is closing, an attacker can cause a...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: liveupdate: Fixed a TOCTOU race condition in luosessionretrieve. The scope of the rwsemread lock in luosessionretrieve was extended to overlap with the acquisition of the session mutex. This prevents a concurrent thread from...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-control: Fixed the issue with TOCTOU in sofipc4bytesput. In sofipc4bytesput, the copy size is derived from the old data-size field in the buffer, rather than from the size field of the incoming new data from...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: ASoC: SOF: ipc3-control: Fixed the issue where TOCTOU was used in bytesput and bytesget. In sofipc3bytesput, the size used for the memcpy is derived from the old data-size that already exists in the buffer, rather than the siz...
PT-2026-80896
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A time-of-check/time-of-use TOCTOU race condition exists in the userspace syscall verifier z vrfy mbox send within drivers/mbox/mbox handlers.c. The verifier...
CVE-2026-9728: Time-of-check Time-of-use (TOCTOU) Race Condition
The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...
Exploit for CVE-2026-10053
CVE-2026-10053 — reproducible verification lab Self-contained...
SUSE CVE-2026-74692
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...
CVE-2026-74707
In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...
AZL-97083 CVE-2026-74692 affecting package kernel for versions less than 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...
CVE-2026-74692
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...
UBUNTU-CVE-2026-74707
In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...
UBUNTU-CVE-2026-74692
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...