PT-2026-82158

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the amdgpu dm crtc set vblank function. This happens when vblank is enabled or queried via the 'DRM IOCTL MODE CRTC GET SEQUENCE' endpoint before a...

Dell Watchdog Timer < 2.0.0.1 Privilege Escalation (DSA-2026-248)

According to its self-reported version, the Dell Watchdog Timer kernel driver WDTKernel.sys on the remote Windows host is prior to 2.0.0.1. It is, therefore, affected by an exposed IOCTL with insufficient access control vulnerability. A low privileged local attacker could potentially exploit this...

CVE-2026-74676

A flaw was found in the Linux kernel. A missing permission check in the KDSKBMETA ioctl input/output control allows a local process to modify the keyboard meta mode on a non-controlling console without proper authorization. This could enable an attacker to make unauthorized changes to system...

SUSE CVE-2026-68455

In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVEFD is only applicable to outgoing sessions. RETRIEVEFD and FINISH are only valid for incoming...

SUSE CVE-2026-74440

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

FreeBSD Security Advisory - FreeBSD-SA-26:58.sound

FreeBSD Security Advisory - The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementatio...

PT-2026-81936

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A race condition exists in the TIOCSCTTY ioctl handler. The handler releases the tty lock to acquire the process tree lock but fails to revalidate the terminal...

FreeBSD-SA-26:62.tty

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:62.tty Security Advisory The FreeBSD Project Topic: Kernel use-after-free via tty ioctls Category: core Module: tty Announced: 2026-08-25 Credits: tsune of...

FreeBSD-SA-26:58.sound

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:58.sound Security Advisory The FreeBSD Project Topic: Kernel use-after-free via the SNDCTLDSPSYNCSTART ioctl Category: core Module: sound Announced:...

PT-2026-81929

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A use-after-free issue exists in the implementation of an ioctl, which occurs when the system attempts to acquire locks on all channels in a sync group. If locki...

FreeBSD Security Advisory - FreeBSD-SA-26:62.tty

FreeBSD Security Advisory - The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling...

FreeBSD-SA-26:63.posixshm

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:63.posixshm Security Advisory The FreeBSD Project Topic: TOCTOU race in POSIX shared memory large page configuration Category: core Module: posixshm...

FreeBSD -- TOCTOU race in POSIX shared memory large page configuration

Problem Description: The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been...

Linux Ext4 Heap Buffer Overflow DoS

The vulnerability of the ext4iget function fs/ext4/inode.c and the swapinodebootloader function fs/ext4/ioctl.c in the Ext4 file system of the Linux operating system is related to insufficient handling of exceptional conditions. Exploiting this vulnerability can allow an attacker to cause a servi...

Linux DRI Heap Buffer Overflow DoS

The vulnerability of the xevmmadviseioctl function in the drivers/gpu/drm/xe/xevmmadvise.c module of the Direct Rendering Infrastructure DRI driver for the Linux operating system is related to improper memory release memory leak. Exploiting this vulnerability can allow an attacker to cause a...

FreeBSD -- Kernel use-after-free via tty ioctls

Problem Description: The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling proces...

FreeBSD -- Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl

Problem Description: The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did n...

[SECURITY] [DSA 6462-1] zfs-linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6462-1 [email protected] https://www.debian.org/security/ Aron Xu August 24, 2026 https://www.debian.org/security/faq -...

cve-2026-3437

cve-2026-3437 portwell.sys Portwell Engineering Toolkits v4.8.2 में MmMapIoSpace के माध्यम से मनमाना भौतिक मेमोरी रीड/राइट। ड्राइवर के IOCTL इंटरफ़ेस के साथ इंटरैक्ट करके LPE/SYSTEM एस्केलेशन और BYOVD को सक्षम बनाता है। विश्लेषण ड्राइवर IRPMJDEVICECONTROL के लिए एक डिस्पैच रूटीन पंजीकृत करता है...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: accel/amdxdna: Use callerclient for debugging BO sync. amdxdnadrmsyncboioctl looks up args-handle in the drmfile of the ioctl caller. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...