8899 matches found
CVE-2026-58093 Kernel use-after-free via tty ioctls
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...
CVE-2026-58091
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...
CVE-2026-58091
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...
EUVD-2026-66236
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...
kernel: i2c: stub: Reject I2C block transfers with invalid length
A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...
PT-2026-82094
Name of the Vulnerable Software and Affected Versions OpenZFS affected versions not specified Description On Linux, several ioctl authorization checks incorrectly treat capabilities held within a user-created, unprivileged namespace as equivalent to actual host privileges. This allows an...
CVE-2026-79619: Incorrect Authorization
On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrativ...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098930)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098930 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098701)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098701 advisory. In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported...
FreeBSD : FreeBSD -- Kernel use-after-free via tty ioctls (a34b5154-a0ff-11f1-ae1f-bc241121aa0a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a34b5154-a0ff-11f1-ae1f-bc241121aa0a advisory. The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After...
VulnCheck KEV: CVE-2026-36425
An issue in OPSWAT AppRemover Driver ardrv.sys v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation...
PT-2026-82200
Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description An issue exists in the s390/qeth component where the qeth snmp command and qeth l3 arp query functions allocate a buffer based on a user-supplied length udata len without verifying a low...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098692)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098692 advisory. In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fastimageblit This issue triggers when a userspace...
CVE-2026-58091: Use After Free
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...
CVE-2026-58094: Time-of-check Time-of-use (TOCTOU) Race Condition
The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...
Linux Distros Unpatched Vulnerability : CVE-2026-79619
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host...
Linux Distros Unpatched Vulnerability : CVE-2026-80584
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/qeth: validate user buffer length in SNMP and ARP query ioctls qethsnmpcommand and qethl3arpquery allocate a buffer sized by a user-supplied length udatale...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104579)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104579 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the...
Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098844)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098844 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on set received ioctl due to item overflow If the set received ioctl...
CVE-2026-58093: Concurrent Execution using Shared Resource with Improper Synchronization
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...