Linux kernel nvec_rx_completed() Heap Buffer Overflow

The vulnerability of the nvecrxcompleted function in the drivers/staging/nvec/nvec.c file of the Linux kernel is related to the improper implementation of the control flow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

Linux kernel Heap Buffer Overflow DoS

The vulnerability in the amseventtochannel function within the drivers/iio/adc/xilinx-ams.c file of the Linux kernel is related to buffer overflow conditions. Exploitation of this vulnerability could allow an attacker to compromise the confidentiality, integrity, and availability of protected...

Linux drivers iio magnetometer ak8975 Heap Buffer Overflow DoS

The vulnerability of the drivers/iio/magnetometer/ak8975.c component in the Linux operating system is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux drivers mailbox mtk-adsp-mailbox Heap Buffer Overflow DoS

The vulnerability in the drivers/mailbox/mtk-adsp-mailbox.c component of the Linux kernel is related to an improper implementation of a control flow. Exploitation of this vulnerability may allow an attacker to compromise the confidentiality, integrity, and availability of protected information...

Linux PCI ROM Buffer Overflow DoS

The vulnerability of the drivers/pci/rom.c component of the Linux operating system’s kernel is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibility of the protected information...

ioctlance

IOCTLance Descripción Presentado en CODE BLUE 2023, este proyecto titulado Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis presenta IOCTLance, una herramienta que mejora su capacidad para detectar varios tipos de vulnerabilidades en controladores del Model...

rtl8812au

Controladores inalámbricos RTL8812AU/21AU y RTL8814AU Solo para uso con Linux y Android ESTOS CONTROLADORES ESTÁN OBSOLETOS. Use los controladores mac80211 en https://github.com/lwfinger/rtw88 ¡Importante! Use "ip" e "iw" en lugar de "ifconfig" e "iwconfig" Se describe más abajo, ¡LEA EL README!...

CVE-2026-19576

The Goodix GT9xx input driver in drivers/input/inputgt911.c reads the touch point count from the controller's status register and masks it with GT911TOUCHPOINTSMSK 0x0F, yielding a value of 0..15. In gt911process that value is used directly as the loop bound for filling pointreg, a stack array...

CVE-2026-19736 Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths

The NXP MCUX TRNG entropy driver in drivers/entropy/entropymcuxtrng.c passed the caller's byte count straight to the vendor SDK routine TRNGGetRandomData. On i.MX RT5xx and RT6xx parts the SDK compiles its TRNGSWHEALTHTESTS variant, which always copies whole 32-bit words and draws entropy rounded...

CVE-2026-19736 Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths

The NXP MCUX TRNG entropy driver in drivers/entropy/entropymcuxtrng.c passed the caller's byte count straight to the vendor SDK routine TRNGGetRandomData. On i.MX RT5xx and RT6xx parts the SDK compiles its TRNGSWHEALTHTESTS variant, which always copies whole 32-bit words and draws entropy rounded...

EUVD-2026-97112

The Goodix GT9xx input driver in drivers/input/inputgt911.c reads the touch point count from the controller's status register and masks it with GT911TOUCHPOINTSMSK 0x0F, yielding a value of 0..15. In gt911process that value is used directly as the loop bound for filling pointreg, a stack array...

CVE-2026-19576 Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count

The Goodix GT9xx input driver in drivers/input/inputgt911.c reads the touch point count from the controller's status register and masks it with GT911TOUCHPOINTSMSK 0x0F, yielding a value of 0..15. In gt911process that value is used directly as the loop bound for filling pointreg, a stack array...

CVE-2026-19576

The Goodix GT9xx input driver in drivers/input/inputgt911.c reads the touch point count from the controller's status register and masks it with GT911TOUCHPOINTSMSK 0x0F, yielding a value of 0..15. In gt911process that value is used directly as the loop bound for filling pointreg, a stack array...

CVE-2026-19576 Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count

The Goodix GT9xx input driver in drivers/input/inputgt911.c reads the touch point count from the controller's status register and masks it with GT911TOUCHPOINTSMSK 0x0F, yielding a value of 0..15. In gt911process that value is used directly as the loop bound for filling pointreg, a stack array...

CVE-2026-19576

The Goodix GT9xx input driver (specifically in drivers/input/input_gt911.c) contains a stack out-of-bounds write vulnerability. The driver reads a touch point count from the controller's status register and uses it directly as a loop bound for filling the point_reg[] stack array. Because the arra...

CVE-2026-19669

The user-mode syscall verifiers zvrfyfuelgaugegetprops and zvrfyfuelgaugesetprops in drivers/fuelgauge/fuelgaugesyscallhandlers.c declared two variable-length arrays, union fuelgaugepropval kvalslen and fuelgaugepropt kpropslen, sized directly by the caller-supplied len argument. len is an...

concealed_position

Posición Oculta Posición Oculta es un ataque de escalada de privilegios locales contra Windows que utiliza el concepto de "Trae tu propia vulnerabilidad". Específicamente, Posición Oculta CP utiliza la lógica tal como fue diseñada de paquete punto e impresión en Windows que permite a un usuario c...

CVE-2026-98292

A flaw was found in the Linux kernel's MediaTek Bluetooth drivers. The drivers fail to properly validate the length of incoming Wireless Management Task WMT event packets before accessing their data fields. A malicious or compromised device could transmit a truncated or malformed event, causing a...

PT-2026-110221

The user-mode syscall verifiers z vrfy fuel gauge get props and z vrfy fuel gauge set props in drivers/fuel gauge/fuel gauge syscall handlers.c declared two variable-length arrays, union fuel gauge prop val k valslen and fuel gauge prop t k propslen, sized directly by the caller-supplied len...

CVE-2026-19669: Out-of-bounds Write

The user-mode syscall verifiers zvrfyfuelgaugegetprops and zvrfyfuelgaugesetprops in drivers/fuelgauge/fuelgaugesyscallhandlers.c declared two variable-length arrays, union fuelgaugepropval kvalslen and fuelgaugepropt kpropslen, sized directly by the caller-supplied len argument. len is an...