8868 matches found
CVE-2026-99149
The Linux kernel contains a vulnerability in the drm/amdgpu driver where amdgpu_gem_userptr_ioctl() fails to properly clean up resources during certain error conditions. Specifically, when amdgpu_hmm_range_alloc() fails, the function returns -ENOMEM immediately, causing a leak of the GEM object ,...
CVE-2026-99149 drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpuhmmrangealloc fails amdgpugemuserptrioctl returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo-parent...
CVE-2026-99125 s390/pai: Handle multiple PMU stop callback invocations
In the Linux kernel, the following vulnerability has been resolved: s390/pai: Handle multiple PMU stop callback invocations Handle the following scenario: The kernel protects itself against a very high sampling load and throttles the sampling using: perfeventthrottle -- PMU-stop Shortly later the...
PT-2026-128142
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpu hmm range alloc fails amdgpu gem userptr ioctl returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the...
UBUNTU-CVE-2026-99149
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpuhmmrangealloc fails amdgpugemuserptrioctl returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo-parent...
Linux Distros Unpatched Vulnerability : CVE-2026-99149
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpuhmmrangealloc fails amdgpugemuserptrioctl returns -ENOMEM right away and skips the cleanup...
CVE-2021-21551
CVE-2021-21551 Simple PoC for exploiting CVE-2021-21551 for LPE by spawning system cmd. https://vulners.com/cve/CVE-2021-21551 An issue was discovered in signed dell windows driver dbutil23.sys which may lead to compromisation of whole local system. Driver's ioctl dispatch routine lacks of...
SUSE CVE-2026-99063
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...
CVE-2021-32537
CVE-2021-32537: Out-of-bounds access in RTKVHD64 leading to pool corruption. This is a bug that I reported to Realtek beginning of April 2021. The affected driver is named RTKVHD64.sys and seems to be available on a bunch of mainstream hardware tested the below hardware configurations but probabl...
CVE-2026-99063
A flaw was found in the Linux kernel's Device Mapper DM subsystem. When processing certain input/output control ioctl requests with minimal buffer sizes, the interface fails to properly validate that the result buffer's start offset remains within the allocated memory boundaries. A local attacker...
SUSE CVE-2026-98619
In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnllock for the ioctl self test An offline self test that brings the interface down and back up with netifclose / netifopen requires rtnllock for both. Since the ethtool IOCTL path became rtnl-optional for...
SUSE CVE-2026-98872
In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...
Linux Distros Unpatched Vulnerability : CVE-2026-98872
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent wi...
n_gsm_exploit
This appears to still be a 0-day. I had no intention of publishing this exploit before the vulnerability was patched, but a 0-day exploit was published by another researcher who found the same vulnerability, so I published my code as well. Please use this for research purposes only. RCA The TTY o...
CVE-2021-38304-PoC
CVE-2021-38304 Proof of Concept Overview This repository contains a proof of concept for a critical security vulnerability in older versions of the National Instruments nipalk.sys driver. The vulnerability allows for arbitrary code execution and memory disclosure in kernel mode. It is intended...
CVE-2026-89823
A flaw was found in the Linux kernel's Direct Rendering Manager DRM subsystem. A race condition exists during the partial failure of drmdevregister when a minor device is registered but the primary minor fails. A local user could exploit this by opening the registered minor device and initiating ...
SUSE CVE-2026-98935
In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...
kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA timer component. A lack of serialization in the userspace-driven timer utimer TRIGGER ioctl allows two threads to concurrently call sndtimerinterrupt. This race condition can lead to a use-after-free vulnerability, wher...
DEBIAN-CVE-2026-99063
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...
CVE-2026-99063
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...