CVE-2026-87039 I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers

The user-mode syscall verifier zvrfyi2sconfigure in drivers/i2s/i2shandlers.c copies the caller's struct i2sconfig in from user memory and then, when cfg-frameclkfreq is 0 the API's "unconfigure the stream" request, jumps straight to zimpli2sconfigure without performing the...

EUVD-2026-116743

The user-mode syscall verifier zvrfyi2sconfigure in drivers/i2s/i2shandlers.c copies the caller's struct i2sconfig in from user memory and then, when cfg-frameclkfreq is 0 the API's "unconfigure the stream" request, jumps straight to zimpli2sconfigure without performing the...

CVE-2026-87039 I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers

The user-mode syscall verifier zvrfyi2sconfigure in drivers/i2s/i2shandlers.c copies the caller's struct i2sconfig in from user memory and then, when cfg-frameclkfreq is 0 the API's "unconfigure the stream" request, jumps straight to zimpli2sconfigure without performing the...

CVE-2026-87039

A vulnerability exists in the Zephyr RTOS user-mode syscall verifier z_vrfy_i2s_configure() within drivers/i2s/i2s_handlers.c. When a caller requests to unconfigure a stream (setting cfg->frame_clk_freq to 0), the system fails to perform ownership/type checks on the config.mem_slab pointer or ...

CVE-2026-87039

The user-mode syscall verifier zvrfyi2sconfigure in drivers/i2s/i2shandlers.c copies the caller's struct i2sconfig in from user memory and then, when cfg-frameclkfreq is 0 the API's "unconfigure the stream" request, jumps straight to zimpli2sconfigure without performing the...

Zephyr buffer error vulnerability

Versions Zephyr 4.4.0 through 4.5.0 contain a buffer error vulnerability. This vulnerability stems from the user-space system call verifier zvrfyi2sconfigure in drivers/i2s/i2shandlers.c, which copies i2sconfig from user memory. When frameclkfreq is set to 0, ownership, type checks, and blocksize...

PT-2026-136878

The user-mode syscall verifier z vrfy i2s configure in drivers/i2s/i2s handlers.c copies the caller's struct i2s config in from user memory and then, when cfg-frame clk freq is 0 the API's "unconfigure the stream" request, jumps straight to z impl i2s configure without performing the K SYSCALL...

Linux Distros Unpatched Vulnerability : CVE-2026-98591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skbpointeriflinear function checks whether ...

CVE-2026-5857

Contiki-NG's MQTT client parsepublishvhdr in os/net/app-layer/mqtt/mqtt.c sets topiclenreceived=1 before checking topiclen against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcpinput re-invokes the parser with topicreceived==0, and t...

PT-2026-68759

Name of the Vulnerable Software and Affected Versions Contiki-NG affected versions not specified Description The MQTT client contains a flaw in the parse publish vhdr function within os/net/app-layer/mqtt/mqtt.c. The function sets the topic len received flag to 1 before validating the topic len...

PT-2026-50982

Name of the Vulnerable Software and Affected Versions libaom affected versions not specified Description An arbitrary address write issue exists in the reference AV1 codec implementation. A missing bounds check in the Scalable Video Coding SVC layer ID control function allows an attacker to injec...

EUVD-2007-1877

Malware in sbrugna...

EUVD-2017-16399

Malware in sbrugna...

EUVD-2021-27595

Malicious code in bioql PyPI...

CVE-2022-42335

x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging HAP is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handlin...

SUSE CVE-2022-42335

x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging HAP is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handlin...

Fedora 38 : xen (2023-d28433ead1)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-d28433ead1 advisory. x86 shadow paging arbitrary pointer dereference XSA-430, CVE-2022-42335 Tenable has extracted the preceding description block directly from the Fedora securi...

ALPINE-CVE-2022-42335

x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging HAP is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handlin...

DEBIAN-CVE-2022-42335

x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging HAP is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handlin...

CVE-2022-42335

x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging HAP is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handlin...