PT-2026-64530

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNP COMMIT Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEV PDH GEN and...

CVE-2026-64008

A flaw was found in the accel/rocket component of the Linux kernel. This vulnerability, a Use-After-Free UAF, occurs in the rocketioctlcreatebo function. A local attacker could exploit this by triggering a failure in subsequent operations after a Graphics Execution Manager GEM handle is created,...

CVE-2026-64191

A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...

SUSE CVE-2026-63793

In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize volume label accesses Protect vol-volumelabel with a mutex and snaphost the label before copytouser. This prevent a use-after-free when FSIOCSETFSLABEL replaces the vol-volumelabel and FSIOCGETTSLABEL reads it...

EUVD-2026-45594

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix execqueue leak on width check in stream open In xeoastreamopenioctl, when param.execq-width 1 the function returns -EOPNOTSUPP directly, skipping the existing errexecq cleanup path. The execqueue reference obtained...

EUVD-2026-45758

In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: add more safeties to EEPROM Netlink fallback The Netlink fallback path for reading module EEPROM fallbacksetparams validates that offset totallen return -EINVAL; This could lead to surprises in both drivers and...

EUVD-2026-45694

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6tnl.net in vti6siocdevprivate. After patch 1/2 in this series, vti6update unlinks and relinks the tunnel through t-net. vti6siocdevprivate still uses devnetdev for the collision lookup. For a tunnel moved through...

CVE-2026-53401

The CVE-2026-53401 vulnerability affects the Linux kernel fbdev omap2 driver (omapfb_mmap) with a race between mm_lock and fb_info->lock when mapping memory via OMAPFB_SETUP_PLANE. The race can lead to a use-after-free by reading start/len from mismatched region references and incrementing an ...

CVE-2026-53376

CVE-2026-53376 fixes an upper bound check in drm/amdkfd (kfd_ioctl_get_process_apertures_new) in the Linux kernel, preventing potential out-of-bounds access. The patch sequence is noted as cherry-picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f and has been applied to stable kernels fo...

PT-2026-61081

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.140 Description The issue exists in the drm/amdkfd component of the Linux kernel. A lack of upper bound validation for the num of nodes variable in the kfd ioctl get process apertures new function allows...

CVE-2019-25764

UNSUPPORTED WHEN ASSIGNED Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and invoke arbitrary IOCTLs, resulting in privilege escalation. Refer to the 'End-of-Life Notice and Driver Update for Legacy ASUS Drivers ...

CVE-2026-57896

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product...

CVE-2026-36425

An issue in OPSWAT AppRemover Driver ardrv.sys v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation...

CVE-2026-57896

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product...

CVE-2026-61389 AutomationDirect Productivity Suite Out-of-bounds Write

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability...

CVE-2026-60063 AutomationDirect Productivity Suite Out-of-bounds Write

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability...

CVE-2026-60063

Technical details about CVE-2026-60063 are not publicly available in the provided documents. The available descriptions mention an out-of-bounds write in the Productivity Suite and potential privilege escalation, but no affected versions, vectors, or mitigations are disclosed. Monitor for updates.

CVE-2026-15449 TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption

A time-of-check to time-of-use TOCTOU flaw in the illumos data-link pseudo-driver dld affects handling of the DLDIOCGETMACPROP and DLDIOCSETMACPROP ioctls on /dev/dld. drviocpropcommon in usr/src/uts/common/io/dld/dlddrv.c copies the dldiocmacpropt ioctl header in once to read its prvalsize field...

CVE-2026-15449 TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption

A time-of-check to time-of-use TOCTOU flaw in the illumos data-link pseudo-driver dld affects handling of the DLDIOCGETMACPROP and DLDIOCSETMACPROP ioctls on /dev/dld. drviocpropcommon in usr/src/uts/common/io/dld/dlddrv.c copies the dldiocmacpropt ioctl header in once to read its prvalsize field...

CVE-2026-15449

CVE-2026-15449 describes a TOCTOU vulnerability in the illumos data-link pseudo-driver (dld) regarding handling of DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. In drv_ioc_prop_common(), the header is read once to obtain pr_valsize, a kernel heap buffer is allocated, and then the fu...