fisy-fuzz

FIle SYstem - FUZZer This is the full file system fuzzing framework that I presented at the Hack in the Box 2020 Lockdown Edition conference in April. Conference Talk Conference Talk Single Video Conference Material Goal The goal of this framework is to uncover kernel security bugs on UNIX system...

ROOT-ZTE-X1001

ZTE Blade X1001 — Root with Magisk Android 15, Unisoc UMS9230 ⚠️ WARNING: Rooting a device can void the warranty, brick the device if done incorrectly, and erase all data. Proceed at your own risk. This repository is for educational purposes only. Table of Contents Device information Prerequisites...

CVE-2026-55781-poc

CVE-2026-55781 — NanaZip UFS Parser DoS Unbounded memory allocation in NanaZip's UFS handler via an attacker-controlled fsbsize field. Summary | Field | Value | |---|---| | CVE | CVE-2026-55781 | | Advisory | GHSA-m34h-jf84-m74h | | Vendor | M2Team / NanaZip | | Affected | NanaZip = 6.5 Preview...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ufs: create the root dentry after loading cylinder metadata ufsfillsuper installs sb-sroot before it loads the cylinder group structures for a writable mount: sb-sroot = dmakerootinode; ... if !sbrdonlysb if...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group metadata before caching it ufsreadcylinder copies the cylinder group index and the rotor positions directly from the on-disk group and caches them without any checks: ucpi-ccgx = fs32tocpusb, ucg-cgcg...

CVE-2026-99157

A flaw was found in the Linux kernel's SCSI Generic BSG subsystem. A local attacker can exploit this flaw to cause a Denial of Service DoS or potentially escalate privileges by triggering an out-of-bounds write in kernel memory. The issue arises because the buffer allocated for Universal Flash...

CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

SUSE CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

DEBIAN-CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

AZL-111299 CVE-2026-99157 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

UBUNTU-CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

EUVD-2026-111909

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

CVE-2026-99157 scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

CVE-2026-99157

The Linux kernel contains a vulnerability in the scsi: bsg component where a buffer overflow occurs during UFS ARPMB command processing. The bsg-lib allocates a 96-byte buffer based on SCSI_SENSE_BUFFERSIZE, but the struct ufs_rpmb_reply requires 104 bytes (a 40-byte header followed by a 64-byte ...

CVE-2026-99157 scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

PT-2026-128150

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bsg-lib where a reply buffer is allocated with a size of 96 bytes SCSI SENSE BUFFERSIZE per job. However, the ufs rpmb reply structure requires 104 bytes, consisti...

CVE-2026-99157

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

CVE-2026-99157: Linux: In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass reply_len to bsg_setup_queue() to…

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply is 104 bytes: a 40-byte struct ufsbsgreply followed by a 64-byte EHS...

Linux Distros Unpatched Vulnerability : CVE-2026-99157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: bsg: Pass replylen to bsgsetupqueue to fit UFS ARPMB replies bsg-lib allocates a 96-byte SCSISENSEBUFFERSIZE reply buffer per job, but struct ufsrpmbreply...