cve-2011-3026-firefox

cve-2011-3026-firefox Example of exploiting CVE-2011-3026 on Firefox Linux/x86, from our Black Hat 2012 talk: "Exploiting the jemalloc Memory Allocator: Owning Firefox's Heap" Original slide deck available at: https://www.blackhat.com/html/bh-us-12/bh-us-12-archives.htmlArgyroudis Updated slide...

salt

Welcome to salt , a tool to reverse and learn kernel heap memory management. It can be useful to develop an exploit, to debug your own kernel code, and, more importantly, to play with the kernel heap allocations and learn its inner workings. This tool helps tracing allocations and the current sta...

Bad_Hoist-WriteUp

Sleirsgoevy's version of BadHoist Write-up | CVE-2018-4386 !Note Background information about the PS4: The PlayStation 4 Console features a custom AMD x86-64 CPU 8 cores, it's Orbis OS is based on FreeBSD v9.0 with parts of NetBSD as well. It also includes a wide variety of additional open source...

libdlmalloc

libdlmalloc libdlmalloc は、GDB とともに使用するために設計された Python スクリプトで、Doug Lea のアロケータ、別名 dlmalloc を解析するために使用できます。現在、dlmalloc 2.8.x バージョンをサポートしています。一部の機能は GDB とは独立して使用することもでき、例えば、スナップショットされたヒープメモリのオフライン解析を行うことができます。 libdlmalloc は、ヒープを解析するための他の gdb Python スクリプト、例えば libtalloc、unmaskjemalloc、libheap...

CVE-2026-11108-Integer-Overflow-in-Memory-Allocator-kmalloc-Sim-

CVE-2026-11108 – メモリアロケータ kmalloc Sim における整数オーバーフロー プログラムコード C // allocsim.c - Vulnerable memory allocator include include include define MAXBLOCK 1024 void mymallocsizet size sizet total = size + sizeofsizet; // header if total MAXBLOCK return NULL; void ptr = malloctotal; if !ptr return NULL;...

libtalloc

libtalloc libtalloc は、GDB で使用する Python スクリプトで、"trivial allocator" talloc を解析するために 使用できます。talloc の入門記事はここにあります: https://talloc.samba.org/talloc/doc/html/index.html libtalloc は、unmaskjemalloc や libheap などのヒープ解析用の他の gdb python スクリプトに触発されて作られました。基本的な機能の一部は これらのプロジェクトと同一です。...

DEBIAN-CVE-2026-98024

In the Linux kernel, the following vulnerability has been resolved: s390/ism: folioput after error dmb-cpuaddr was allocated via folioalloc. Use folioput instead of kfree in the error exit of ismallocdmb to avoid slab allocator corruption. While at it, reset dmb-cpuaddr after folioput to avoid...

CVE-2026-98024

In the Linux kernel, the following vulnerability has been resolved: s390/ism: folioput after error dmb-cpuaddr was allocated via folioalloc. Use folioput instead of kfree in the error exit of ismallocdmb to avoid slab allocator corruption. While at it, reset dmb-cpuaddr after folioput to avoid...

AZL-104307 CVE-2026-98024 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/ism: folioput after error dmb-cpuaddr was allocated via folioalloc. Use folioput instead of kfree in the error exit of ismallocdmb to avoid slab allocator corruption. While at it, reset dmb-cpuaddr after folioput to avoid...

UBUNTU-CVE-2026-98024

In the Linux kernel, the following vulnerability has been resolved: s390/ism: folioput after error dmb-cpuaddr was allocated via folioalloc. Use folioput instead of kfree in the error exit of ismallocdmb to avoid slab allocator corruption. While at it, reset dmb-cpuaddr after folioput to avoid...

EUVD-2026-86970

In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping condition is false, which includes cases where ntfsbitmapclearrun actually...

CVE-2026-98024 s390/ism: folio_put() after error

In the Linux kernel, the following vulnerability has been resolved: s390/ism: folioput after error dmb-cpuaddr was allocated via folioalloc. Use folioput instead of kfree in the error exit of ismallocdmb to avoid slab allocator corruption. While at it, reset dmb-cpuaddr after folioput to avoid...

EUVD-2026-86677

In the Linux kernel, the following vulnerability has been resolved: s390/ism: folioput after error dmb-cpuaddr was allocated via folioalloc. Use folioput instead of kfree in the error exit of ismallocdmb to avoid slab allocator corruption. While at it, reset dmb-cpuaddr after folioput to avoid...

CVE-2026-98024

A vulnerability exists in the Linux kernel (s390/ism) where the ism_alloc_dmb() function incorrectly used kfree() instead of folio_put() during an error exit for memory allocated via folio_alloc(). This flaw could lead to slab allocator corruption . The fix involves using folio_put() and resettin...

CVE-2026-98024 s390/ism: folio_put() after error

In the Linux kernel, the following vulnerability has been resolved: s390/ism: folioput after error dmb-cpuaddr was allocated via folioalloc. Use folioput instead of kfree in the error exit of ismallocdmb to avoid slab allocator corruption. While at it, reset dmb-cpuaddr after folioput to avoid...

Linux Distros Unpatched Vulnerability : CVE-2026-98024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/ism: folioput after error dmb-cpuaddr was allocated via folioalloc. Use folioput instead of kfree in the error exit of ismallocdmb to avoid slab allocator...

CVE-2026-98024

In the Linux kernel, the following vulnerability has been resolved: s390/ism: folioput after error dmb-cpuaddr was allocated via folioalloc. Use folioput instead of kfree in the error exit of ismallocdmb to avoid slab allocator corruption. While at it, reset dmb-cpuaddr after folioput to avoid...

Important: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.11.1 release

Red Hat build of OpenTelemetry 3.11.1 has been released This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes. Breaking changes: None Deprecations: None Technology Preview features: None Enhancements: None Bug fixes: Before this update, the...

CVE-2026-90047

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't hand out the flat CCS storage as usable VRAM getflatccsoffset reads the base of the flat CCS storage from the hardware, scales it by the number of enabled L3 nodes, and rounds the result up to 128K. Everything below...

CVE-2026-90047 drm/xe: Don't hand out the flat CCS storage as usable VRAM

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't hand out the flat CCS storage as usable VRAM getflatccsoffset reads the base of the flat CCS storage from the hardware, scales it by the number of enabled L3 nodes, and rounds the result up to 128K. Everything below...