CVE-2026-99016 riscv: futex: untag the user pointer before the atomic access

In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access accessok checks untaggedaddruaddr, but archfutexatomicopinuser and futexatomiccmpxchginatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc.w through...

CVE-2026-19676 PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode

The user-mode verifier for the pecitransfer system call, zvrfypecitransfer in drivers/peci/pecihandlers.c, checked only the device object permission and copied the caller-supplied struct pecimsg with kusermodefromcopy. That copy validates the outer structure only; the buf pointers and len values...

CVE-2026-19676

The peci_transfer() system call in the Zephyr RTOS (specifically within drivers/peci/peci_handlers.c ) fails to properly validate embedded buffer pointers and length values in the peci_msg structure. While the verifier checks outer structure permissions, it allows caller-controlled pointers in th...

CVE-2026-19676 PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode

The user-mode verifier for the pecitransfer system call, zvrfypecitransfer in drivers/peci/pecihandlers.c, checked only the device object permission and copied the caller-supplied struct pecimsg with kusermodefromcopy. That copy validates the outer structure only; the buf pointers and len values...

kernel: ALSA: usx2y: bound the hwdep mmap fault offset

A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...

CVE-2026-45958: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: fix to avoid directly dereferencing user pointer In vidiconnectionioctl, vidi-ediduser pointer is directly dereferenced in the kernel. This allows arbitrary kernel memory access from the user space, so instead o...

MiracleLinux 7 : kernel-3.10.0-1062.4.3.el7 (AXSA:2019-4398:06)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2019-4398:06 advisory. hw: Intel GPU blitter manipulation can allow for arbitrary kernel memory write CVE-2019-0155 Tenable has extracted the preceding description block directly...

CVE-2025-62525: Improper Input Validation

OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory using the ioctls of the ltq-ptm driver which is used to drive the datapath of the DSL line. This only effects the lantiq target supporting...

CVE-2025-0286 CVE-2025-0286

Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim machine...

CVE-2025-0288 CVE-2025-0288

Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalatio...

CVE-2025-0288

Various Paragon Software products, specifically those utilizing the biontdrv.sys driver (such as Paragon Partition Manager ), are vulnerable to an arbitrary kernel memory vulnerability. The flaw is caused by the memmove function failing to validate or sanitize user-controlled input, leading to a ...

CVE-2025-0288: Undefined Security Weakness

Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalatio...

PT-2025-9248

Name of the Vulnerable Software and Affected Versions Paragon Partition Manager version 7.9.1 Description The issue is caused by a failure to properly validate the length of user-supplied data, which can allow an attacker to execute arbitrary code on the victim machine. This is due to an arbitrar...

ASB-A-379728401

In TBD of TBD, there is a possible arbitrary kernel memory overwrite due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2021-34866

A vulnerability was found in Linux Kernel, where a type confusion problem in checkmapfunccompatibility may lead to free arbitrary kernel memory. Mitigation The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivilegedbpfdisabled...

SUSE: Security Advisory (SUSE-SU-2017:0464-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 8 : kernel (CESA-2019:3871)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3871 advisory. - hw: Intel GPU blitter manipulation can allow for arbitrary kernel memory write CVE-2019-0155 Note that Nessus has not tested for this issue but has instead...

ASB-A-135368228

In i915gemexecbuffer2ioctl of i915gemexecbuffer.c, there is a possible arbitrary kernel memory write due to a missing validation of a userspace pointer. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Input validation

The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to write to arbitrary kernel memory addresses because the IOCTL dispatcher lacks pointer validation. Exploiting this vulnerability results in privileged code execution...

CVE-2020-11520

The SDDisk2k.sys driver of WinMagic SecureDoc v8.5 and earlier allows local users to write to arbitrary kernel memory addresses because the IOCTL dispatcher lacks pointer validation. Exploiting this vulnerability results in privileged code execution...