CVE-2026-98146

The Linux kernel contains a vulnerability in the accel/amdxdna component. The struct amdxdna_cmd_chain utilizes a flexible array annotated with __counted_by(command_count). Because this structure resides in shared AMDXDNA_BO_SHARE memory, userspace can concurrently modify command_count. If an att...

AZL-103784 CVE-2026-97497 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum number ...

CVE-2026-97497

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum number ...

AZL-103577 CVE-2026-93791 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: add a check on the tid coming from the firmware banotif-tid is a firmware-controlled u8 that is used directly as an array index into tiddata without any validation. Add a bounds check against IWLMAXTIDCOUNT...

CVE-2026-97497 drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum number ...

EUVD-2026-86095

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum number ...

CVE-2026-97497

The Linux kernel contains a vulnerability within the drm/amdkfd component. The allocate_sdma_queue function failed to perform bounds-checking on the restore_sdma_id option, which is used by CRIU . This oversight allowed for the specification of an sdma queue id exceeding the maximum number of que...

EUVD-2026-86093

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on allocatedoorbell allocateddoorbell has an option to set the doorbell id to a specific value used by CRIU. This value was not bounds checked. Check to confirm it's less than KFDMAXNUMOFQUEUESPERPROCESS...

Linux Distros Unpatched Vulnerability : CVE-2026-97497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't...

UBUNTU-CVE-2026-97497

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum number ...

Linux Distros Unpatched Vulnerability : CVE-2026-93791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware banotif-tid is a firmware-controlled u8 that is used directly as an array index into tiddata...

DEBIAN-CVE-2026-96674

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer an...

CVE-2026-96674

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer an...

lwip-snmpv3-stack-overflow-cve-2026-8836-critical-embedded-rce

CVE-2026-8836 — lwIP SNMPv3 スタックオーバーフロー PoC lwIPのSNMPv3 USMハンドラにおける重大なスタックベースのバッファオーバーフローであるCVE-2026-8836の概念実証エクスプロイト。 脆弱性 CVE : CVE-2026-8836 CVSS : 9.8 緊急 コンポーネント : snmpparseinboundframe src/apps/snmp/snmpmsg.c内 根本原因 : snmpasn1decraw 内のコメントアウトされた境界チェックと誤ったバッファサイズパラメータ バッファ :...

Oracle Linux 9 : gstreamer1-plugins-base (ELSA-2026-69100)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69100 advisory. - Fix CVE-2026-18297: opusdec channel position bounds check Resolves: RHEL-246587 - Fix crash in RTSP auth credential parsing CVE-2026-85150 Resolves:...

EUVD-2026-84029

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhostisopacket and allowing a usbredir peer to write past the end of the packet...

CVE-2026-31694-POC

CVE-2026-31694: FUSE readdirキャッシュの領域外書き込み fs/fuse/readdir.c:fuseadddirenttocacheにおける境界チェックの欠落。FUSEサーバーがnamelen = 4095のディレントを返すと、4120バイトのレコードにシリアライズされる。カーネルはこれを1つの4096バイトのページキャッシュページにコピーし、24バイトのサーバー制御データが次の物理ページにはみ出る（オーバーフローする）。...

CVE-2026-11105-Stack-Buffer-Overflow-in-Custom-Base64-Decoder

CVE-2026-11105 – カスタムBase64デコーダのスタックバッファオーバーフロー プログラムコード C root@kitploit: // base64vuln.c - Vulnerable Base64 decoder include include include int base64decodeconst char in, sizet inlen, char out, sizet outlen static const char table =...

spectre-attack-example

Spectre 攻撃の例 2018年1月2日 CVE-2017-5753 および CVE-2017-5715 「ゴースト」Spectre 脆弱性の悪用例 これは何か？ メモリにテキスト "The Magic Words are Squeamish Ossifrage." を配置し、脆弱性を利用して読み出そうとします。システムが脆弱であれば、標準出力に同じテキストが表示されます。 このコードでは、victimfunction 内のコンパイル命令が厳密なプログラム順に実行されると、array1size = 16 のため、関数は array10..15...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment システムが、以下に記載された「投機的実行」の脆弱性に対して評価を行います: CVE-2017-5715 ブランチターゲットインジェクション CVE-2017-5753 境界チェックバイパス CVE-2017-5754 不正データキャッシュロード 警告: ビルドオプションで「Prefer 32-bit」がチェックされていないことを確認してください。 管理者権限が必要です。 緩和策には以下が必要です: 1. アンチウイルス/セキュリティ製品がWindows Updateと互換性があることを示すレジストリ値を設定する 2...