s6_pcie_microblaze

PCI Express DIY hacking toolkit General information Contents SP605 board configuration Software configuration Examples Using Python API Practical DMA attacks Option ROM attacks Troubleshooting Building project from the source code General information This repository contains a set of tools and...

pcileech

PCILeech Summary: PCILeech uses PCIe hardware devices to read and write target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system. PCILeech also works without hardware together with a wide range of software memory acqusition methods supported by the...

inception

Note: This tool is no longer under active development, please look at PCILeech instead. INCEPTION Inception is a physical memory manipulation and hacking tool exploiting PCI-based DMA. The tool can attack over FireWire, Thunderbolt, ExpressCard, PC Card and any other PCI/PCIe HW interfaces...

CVE-2016-2067

ADRENO GPU IOMMU DMA EXPLOIT Tested under Nexus 6p google/angler/angler:6.0.1/MMB29M/2431559:user/release-keys About the bug Discussed in 2016 via Blackhat EU About the exploit With iommu dma writes, vdso.so is overwritten with shellcode. So after /init executes kernelclockgettime, the shellcode...

XenoboxX

Hardware Sandbox Toolkit Malware frequently employs anti-VM techniques, which can vary in their difficulty to detect and counteract. While integrating anti-detection measures in our labs is a frequently used option, we should also consider using a real hardware sandbox, even if this sounds weird...

DMA-ProcessDumper

DMA-ProcessDumper Dumps entire memory of target process on the user-mode using DMA with MemProcFS over a PCIe FPGA device Building Copy leechcore.h, vmmdll.h and vmm.lib from MemProcFS into the DMA-ProcessDumper directory Compile using Visual Studio Copy leechcore.dll, vmm.dll and FTD3XX.dll from...

CVE-2026-51585

realtek poc rt26cx21x64.sys exploit Realtek PCIe GbE/2.5GbE/5GbE family Overview OID 0xFF816871 maps the nic's mmio bar into the calling proc's virtual addr space, MmLockedPagesSpecifyCache, reachable from um via \.\RealTekCardGUID This IOCTL 0x0012C818 is gated by a registry value DrvMode=4 Once...

kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension

A flaw was found in the Linux kernel's drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler MES fails to perform a necessary Translation Lookaside Buffer TLB invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access...

kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

A flaw was found in the Linux kernel's fsl-lpspi driver. This vulnerability occurs when the transmit TX Direct Memory Access DMA channel fails to prepare, but the receive RX DMA channel continues to operate. This can lead to memory corruption or a use-after-free condition, potentially allowing an...

kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension

A flaw was found in the Linux kernel's drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler MES fails to perform a necessary Translation Lookaside Buffer TLB invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access...

kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use TOCTOU vulnerability allows a hardware component to modify a message identifier hwcmsgid in Direct Memory Access DMA memory after it has been validated but before it is used. This manipulation bypasses...

Linux Distros Unpatched Vulnerability : CVE-2026-90591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The NXP ENET-QOS Ethernet driver's receive work handler ethnxpenetqosrx in drivers/ethernet/ethnxpenetqos hands each processed descriptor back to the DMA by...

UBUNTU-CVE-2026-90591

The NXP ENET-QOS Ethernet driver's receive work handler ethnxpenetqosrx in drivers/ethernet/ethnxpenetqos hands each processed descriptor back to the DMA by writing desc-read.control = rxdescrefreshflags, which sets OWNFLAG and BUF1ADDRVALIDFLAG. RDES0 of a receive descriptor is the DMA buffer...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-151169)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151169 advisory. In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengineterminateall does not wait for a running...

CVE-2026-90591

The NXP ENET-QOS Ethernet driver's receive work handler ethnxpenetqosrx in drivers/ethernet/ethnxpenetqos hands each processed descriptor back to the DMA by writing desc-read.control = rxdescrefreshflags, which sets OWNFLAG and BUF1ADDRVALIDFLAG. RDES0 of a receive descriptor is the DMA buffer...

EUVD-2026-120492

The NXP ENET-QOS Ethernet driver's receive work handler ethnxpenetqosrx in drivers/ethernet/ethnxpenetqos hands each processed descriptor back to the DMA by writing desc-read.control = rxdescrefreshflags, which sets OWNFLAG and BUF1ADDRVALIDFLAG. RDES0 of a receive descriptor is the DMA buffer...

CVE-2026-90591 NXP ENET-QOS Ethernet driver re-arms RX descriptors with a clobbered DMA buffer address on packet drop

The NXP ENET-QOS Ethernet driver's receive work handler ethnxpenetqosrx in drivers/ethernet/ethnxpenetqos hands each processed descriptor back to the DMA by writing desc-read.control = rxdescrefreshflags, which sets OWNFLAG and BUF1ADDRVALIDFLAG. RDES0 of a receive descriptor is the DMA buffer...

CVE-2026-90591

The NXP ENET-QOS Ethernet driver (located in drivers/ethernet/eth_nxp_enet_qos) contains a vulnerability in the eth_nxp_enet_qos_rx() receive work handler. The driver fails to properly rewrite the DMA buffer address during specific packet drop paths, such as net_pkt_rx_alloc() failures or receivi...

CVE-2026-90591 NXP ENET-QOS Ethernet driver re-arms RX descriptors with a clobbered DMA buffer address on packet drop

The NXP ENET-QOS Ethernet driver's receive work handler ethnxpenetqosrx in drivers/ethernet/ethnxpenetqos hands each processed descriptor back to the DMA by writing desc-read.control = rxdescrefreshflags, which sets OWNFLAG and BUF1ADDRVALIDFLAG. RDES0 of a receive descriptor is the DMA buffer...

PT-2026-141166

The NXP ENET QoS Ethernet driver in drivers/ethernet/eth nxp enet qos serialises transmission with a binary semaphore, data-tx.tx sem, taken in eth nxp enet qos tx and returned only by the transmit-completion interrupt handler tx dma done. A frame that has been handed to the transmit DMA when the...