508 matches found
CVE-2026-98296
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...
UBUNTU-CVE-2026-98296
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...
CVE-2026-25274
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization...
CVE-2026-25274 Use After Free in Windows WLAN Host
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization...
EUVD-2026-92976
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization...
CVE-2026-25274 Use After Free in Windows WLAN Host
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization...
CVE-2026-25274
The Windows WLAN Host is susceptible to a Memory Corruption vulnerability (CWE-416) due to a Use After Free condition. This issue arises when the system processes concurrent DMA buffer allocation and deallocation commands without proper synchronization. Exploitation requires high privileges and i...
CVE-2026-98296: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...
PT-2026-106350
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs when processing concurrent Direct Memory Access DMA buffer allocation and deallocation commands without proper synchronization. DMA is a...
Linux Distros Unpatched Vulnerability : CVE-2026-98296
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an...
CVE-2026-25274: Use After Free
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fixed NULL pointer dereferencing in sanitycheck. If mockchain returns NULL due to a memory allocation failure, it is passed to dmafenceenableswsignaling, resulting in a NULL pointer dereferencing there. Call...
Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: usb-storage: alauda: Fixed an issue where an uninitialized value was used in alaudacheckmedia. Syzbot reported that KMSAN complained about accessing an uninitialized value within the alauda subdriver of usb-storage. Bug: KMSAN...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: dma-buf: A memory barrier should be inserted before updating numfences. smpstoremb inserts a memory barrier after storing data. This differs from what the comment originally intended; a null pointer dereferencing can occur if the...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: The Zero SFP DMA buffer is not zeroed in FRU/I2C bsg handlers. The FRU and I2C bsg handlers stage their transfers in a DMAPOOLSIZE 256-byte buffer, which is obtained through dmapoolalloc. This buffer does not zero...
Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: Fixed the BUGON in the probe function. The snddmabuffer.bytes field now contains the aligned size, which this sndBUGON did not account for, resulting in the following issue: 9.625915 ------------ Cut here ----------...
kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use TOCTOU vulnerability allows a hardware component to modify a message identifier hwcmsgid in Direct Memory Access DMA memory after it has been validated but before it is used. This manipulation bypasses...
kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use TOCTOU vulnerability allows a hardware component to modify a message identifier hwcmsgid in Direct Memory Access DMA memory after it has been validated but before it is used. This manipulation bypasses...
AZL-104826 CVE-2026-97581 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity preparetileinfobuffer writes one entry per tile into the tilesizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded...
AZL-104541 CVE-2026-97578 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchipvpu981av1decsettileinfo divides contextupdatetileid by tileinfo-tilecols and writes one descriptor per tile into the tileinfo DMA buffer, which holds...