CVE-2026-20700

dyld-signing-oracle-poc A controlled exploration of dyld's page-in linking and chained fixup machinery as a PAC signing oracle, in the context of CVE-2026-20700. On arm64e, every function pointer is hardware-authenticated. The goal here is to show that dyld itself can be directed — through a...

Linux Distros Unpatched Vulnerability : CVE-2026-81885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because...

SUSE CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

UBUNTU-CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885

radare2 prior to 6.2.0 contains a denial-of-service vulnerability in its NE relocation fixup-chain parser . The parser followed fixup chains without an iteration limit or cycle detection, so a crafted NE executable containing an in-bounds relocation entry that points back to itself causes the par...

CVE-2026-81885

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885 radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

CVE-2026-81885: Allocation of Resources Without Limits or Throttling

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by...

PT-2026-96781

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0 Description The NE relocation fixup-chain parser in radare2 lacks an active iteration limit or cycle detection. When opening a specially crafted NE executable where an in-bounds relocation entry points back to...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Do not use BUGON in linktofixupdir. During error injection testing, the following panic occurred: Kernel BUG at fs/btrfs/tree-log.c:1862! Invalid opcode: 0000 1 SMP NOPTI CPU: 1 PID: 7836 Comm: mount Not tainted...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Wait for fixup workers before stopping the cleaner kthread during umount. During unmount, at closectree, we follow these steps in this order: 1 Park the cleaner kthread – this does not destroy the kthread; it simply hal...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: Fixed out-of-bounds accesses in RX fixup The ax88179rxfixup function contains several out-of-bounds accesses that can be triggered by a malicious or defective USB device. Specifically: - The metadata array...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mtreportfixup A malicious HID device can trigger a slab out-of-bounds during mtreportfixup by passing in a report descriptor that is smaller than 607 bytes. mtreportfixup attempts...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: HID: cougar – fixed a slab-out-of-bounds read in cougarreportfixup. The reportfixup function for the Cougar 500k Gaming Keyboard did not verify that the size of the report descriptor was correct before accessing it...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: HID: apple: avoided a memory leak in applereportfixup The applereportfixup function was returning a buffer allocated using kmemdup, but never freeing that buffer. The caller of reportfixup does not take ownership of the returned...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Fixed out-of-bounds accesses in RX fixup The function aqc111rxfixup contains several out-of-bounds accesses that can be triggered by a malicious or defective USB device. Specifically: - The metadata array...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Video: fbdev: sm712fb: Fixed a crash in smtcfbwrite When the sm712fb driver writes three bytes to the framebuffer, the driver crashes. Bug: Unable to handle a page fault for the address: ffffc90001ffffff RIP:...

PT-2026-85655

In the Linux kernel, the following vulnerability has been resolved: rndis host: add overflow check in rndis rx fixup Add an overflow check to ensure that data offset + data len + 8 does not wrap, which would enable an OOB read of the USB data buffer...