CVE-2026-20700

dyld-signing-oracle-poc A controlled exploration of dyld's page-in linking and chained fixup machinery as a PAC signing oracle, in the context of CVE-2026-20700. On arm64e, every function pointer is hardware-authenticated. The goal here is to show that dyld itself can be directed — through a...

Linux Distros Unpatched Vulnerability : CVE-2026-98597

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: usb: sr9700: include receive overhead in the length check The receive fixup subtracts the Ethernet CRC from the reported packet length, but compares that...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mtreportfixup A malicious HID device can trigger a slab out-of-bounds condition during mtreportfixup by passing in a report descriptor smaller than 607 bytes. mtreportfixup attemp...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Do not use BUGON in linktofixupdir. During error injection testing, the following panic occurred: Kernel BUG at fs/btrfs/tree-log.c:1862! Invalid opcode: 0000 1 SMP NOPTI CPU: 1 PID: 7836 Comm: mount Not tainted...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: Fixed out-of-bounds accesses in RX fixup The ax88179rxfixup function contains several out-of-bounds accesses that can be triggered by a malicious or defective USB device. Specifically: - The metadata array...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: arm64: Do not call NULL in docompatalignmentfixup. doalignmentt32tohandler only fixes alignment faults for specific instructions; otherwise, it returns NULL e.g., for LDREX. When this occurs, a signal is sent to the caller...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: xfs: Fixed the allocation of the log recovery buffer for the legacy hsize parameter. The commit a70f9fe52daa “xfs: detects and handles invalid iclog size settings provided by mkfs“” added a fix for incorrect hsize values used ...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Video: fbdev: sm712fb – Fixed a crash in smtcfbwrite When the sm712fb driver writes three bytes to the framebuffer, the driver crashes. Bug: Unable to handle a page fault for the address: ffffc90001ffffff RIP: 0010:...

CVE-2026-41210 Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id

Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: cougar – fixed a slab-out-of-bounds read in cougarreportfixup. The reportfixup function for the Cougar 500k Gaming Keyboard did not verify that the report descriptor size was correct before accessing it...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Wait for fixup workers before stopping the cleaner kthread during umount. During unmount, at closectree, we follow these steps in this order: 1 Park the cleaner kthread – this does not destroy the kthread; it simply hal...

Linux Distros Unpatched Vulnerability : CVE-2026-81885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because...

SUSE CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

UBUNTU-CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885 radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885

radare2 prior to 6.2.0 contains a denial-of-service vulnerability in its NE relocation fixup-chain parser . The parser followed fixup chains without an iteration limit or cycle detection, so a crafted NE executable containing an in-bounds relocation entry that points back to itself causes the par...

CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885: Allocation of Resources Without Limits or Throttling

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...