CVE-2026-80887

CVE-2026-80887 is an integer overflow vulnerability in the Linux kernel 's drm/vmwgfx (VMware SVGA virtual GPU) driver. In vmw_shader_define(), the bounds check (u64)buffer->tbo.base.size guest_memory_offset and forwarded to host SVGA shader-create commands, potentially enabling out-of-bounds ...

EUVD-2026-71637

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use checkaddoverflow for shader size+offset bound vmwshaderdefine validates the user-supplied shader window against its backing buffer with u64buffer-tbo.base.size guestmemoryoffset and forwarded to host SVGA...

EUVD-2026-71277

In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab OOB read in interrupt URB callback The interrupt URB buffer is allocated in setupportinterruptin based on the endpoint's wMaxPacketSize: buffersize = usbendpointmaxpepd; port-interruptinbuffer =...

CVE-2026-80814

In the Linux kernel, the following vulnerability has been resolved: rndishost: add overflow check in rndisrxfixup Add an overflow check to ensure that dataoffset + datalen + 8 does not wrap, which would enable an OOB read of the USB data buffer...

EUVD-2026-71240

In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfsattr3leafverifyentry accesses lentry/rentry fields namelen, valuelen before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the en...

CVE-2026-80796

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add datalen bound checks to activation parameter extractors nciextractactivationparamsisodep and nciextractactivationparamsnfcdep read an inner length byte from the NCI RFINTFACTIVATEDNTF payload and use it to memcpy in...

CVE-2026-80760

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCICMDSYNC paramslen above 255 mgmthcicmdsync checks that the message length agrees with paramslen but puts no upper bound on it. paramslen is le16 while the parameter length in the HCI command header is a...

CVE-2026-11105-Stack-Buffer-Overflow-in-Custom-Base64-Decoder

CVE-2026-11105 – Переполнение буфера стека в собственном декодере Base64 Код программы C root@kitploit: // base64vuln.c - Vulnerable Base64 decoder include include include int base64decodeconst char in, sizet inlen, char out, sizet outlen static const char table =...

AZL-99041 CVE-2026-80747 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized...

CVE-2026-80747

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized...

CVE-2026-71221

A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images...

CVE-2026-80755

CVE-2026-80755 affects the Linux kernel SELinux subsystem. The root cause is in perm_read(), which bounds a permission value by SEL_VEC_MAX but never by nprim (the count of permissions for the owning class or common, taken verbatim from the policy image). As a result, security_get_permissions() w...

CVE-2026-80755 selinux: reject a permission value exceeding the class permission count

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count permread bounds a permission value by SELVECMAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image...

CVE-2026-80747 drm/amdkfd: Add bounds check for CRAT subtype length

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized...

CVE-2026-80747

CVE-2026-80747 is a Linux kernel vulnerability in the drm/amdkfd driver's CRAT table parser . The root cause is a missing bounds check: the parser verifies that the subtype header fits within the image but does not validate that the advertised subtype length stays within bounds. A malformed CRAT ...

EUVD-2026-70351

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized...

CVE-2026-85084

This vulnerability affects Samsung Open Source TizenFX in the MediaBufferBase indexer setter , where a missing bounds check (Improper Validation of Array Index) leads to an Out-of-bounds Write that can overflow buffers. The CVSS 3.1 score is 6.3 (MEDIUM) with a local attack vector, high complexit...

CVE-2026-85084 Out-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds check

Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buffers...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment يقوم بتقييم النظام للكشف عن ثغرات "التنفيذ التخميني" الموضحة في: CVE-2017-5715 حقن هدف الفرع CVE-2017-5753 تجاوز فحص الحدود CVE-2017-5754 تحميل بيانات ذاكرة التخزين المؤقت المارقة تحذير: تأكد من عدم تحديد خيار "Prefer 32-bit" في خيارات الإنشاء. يتطلب صلاحيات مرتفعة...

kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()

A flaw was found in the Linux kernel's nfnetlinkcthelper component. This vulnerability, an out-of-bounds read, occurs in the nfnlcthelperdumptable function when a network connection tracking helper is removed during a dump operation, leading to a bypassed bounds check. A local attacker could...