ctl_ctloutput-leak

ctlctloutput-leak macOS High Sierra 10.13 の ctlctloutput 関数は、sooptcopyin の呼び出しの戻り値を無視します。これにより、初期化されていないカーネルヒープデータをユーザースペースに漏えいさせる競合ウィンドウが生じます。ctlctloutput-leak は、この情報漏えいを引き起こそうとする proof-of-concept エクスプロイトです。悪用には root 権限が必要です。 このエクスプロイトは、macOS High Sierra 10.13.1 Beta 17B25c および iOS 10.1.1...

CVE-2019-6207

CVE-2019-6207 getdirentriesattr カーネル ヒープ 情報漏洩 この脆弱性は、macOS=10.14.4 && ios 12.2 のサンドボックスでトリガーされる可能性があります。 この脆弱性についての詳細は後日更新します。...

CYBERDUDEBIVASH-MONGODB-DETECTOR-v2026

CYBERDUDEBIVASH MONGODB DETECTOR TOOL v2026.1 露出したMongoDBインスタンスとCVE-2025-14847 "MongoBleed"リスクを検出 — Zero-Trust Pythonスキャナー。 2026年においても、誤設定されたMongoDBデータベースはデータ漏洩やランサムウェア攻撃の主要な原因の一つです。このツールは、防御担当者がオープンポート、未認証アクセス、潜在的なヒープ漏洩の脆弱性を特定するのに役立ちます。 特徴 ポート27017の検出 未認証アクセスのチェック CVE-2025-14847 MongoBleed PoC検出...

CVE-2026-93174

CVE-2026-93174 affects the Linux kernel BPF subsystem. In copy_map_value_long(), the function passes map->value_size to bpf_obj_memcpy() instead of the correctly padded round_up(map->value_size, 8). When a per-CPU map contains special fields, bpf_obj_memcpy() copies around those fields with...

DEBIAN-CVE-2026-90000

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

CVE-2026-90000

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

AZL-101123 CVE-2026-90000 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

DEBIAN-CVE-2026-89846

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rspinfolen to avoid OOB sense-data read In qla2x00statusentry, the FWI2 status path advances sensedata and shrinks parsenselen by rspinfolen: if ISFWI2CAPABLEha sensedata += rspinfolen; parsenselen -=...

CVE-2026-90000 HID: rmi: fix OOB access with undersized RMI reports

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

CVE-2026-90000 HID: rmi: fix OOB access with undersized RMI reports

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

EUVD-2026-80608

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

CVE-2026-89865 scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers The FRU and I2C bsg handlers stage their transfer in a DMAPOOLSIZE 256-byte bounce buffer obtained from dmapoolalloc, which does not zero the allocation. They initialize...

AZL-101265 CVE-2026-89779 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...

CVE-2026-89779

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...

UBUNTU-CVE-2026-89779

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...

CVE-2026-89779

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...

EUVD-2026-80300

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...

CVE-2026-89779 fs/ntfs3: validate ef->size covers the record's name and value

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef-size covers the record's name and value When an EA record has a non-zero ef-size, ntfsreadea only checks that the record fits in the remaining buffer easize bytes, not that ef-size is large enough to hold th...

CVE-2026-90000: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data-inputreportsize =...

EUVD-2026-77133

The mcumgr SMP settings-management group handlers settingsmgmtread, settingsmgmtwrite, and settingsmgmtdelete in subsys/mgmt/mcumgr/grp/settingsmgmt/src/settingsmgmt.c allocate a keyname buffer and, for read, a data buffer via kmalloc when CONFIGMCUMGRGRPSETTINGSBUFFERTYPEHEAP is enabled, relying...