CVE-2016-2067

ADRENO GPU IOMMU DMA 익스플로잇 테스트 환경: Nexus 6p google/angler/angler:6.0.1/MMB29M/2431559:user/release-keys 버그 정보 2016년 Blackhat EU에서 논의됨 익스플로잇 정보 iommu dma 쓰기를 사용하여 vdso.so를 셸코드로 덮어씁니다. 따라서 /init이 kernelclockgettime을 실행한 후 셸코드가 실행됩니다. /init 프로세스는 이후 루트 셸로 연결됩니다. 로그 root@kitploit: Reverse shell targe...

AZL-102071 CVE-2026-90388 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dmaallocfrompool, which returns the allocated page and fills cpuaddr only on success. Do not rely on cpuaddr to detect...

CVE-2026-90388

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dmaallocfrompool, which returns the allocated page and fills cpuaddr only on success. Do not rely on cpuaddr to detect...

DEBIAN-CVE-2026-90388

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dmaallocfrompool, which returns the allocated page and fills cpuaddr only on success. Do not rely on cpuaddr to detect...

CVE-2026-90241

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Tear down scalable-mode context on probe failure intelpasidsetupsmcontext walks a PCI device’s DMA aliases via pciforeachdmaalias and programs a scalable-mode context entry for each RID. For a device with a...

DEBIAN-CVE-2026-90241

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Tear down scalable-mode context on probe failure intelpasidsetupsmcontext walks a PCI device’s DMA aliases via pciforeachdmaalias and programs a scalable-mode context entry for each RID. For a device with a...

DEBIAN-CVE-2026-90244

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msipagelist Unlike a group's default domain, which is always freshly allocated and privately owned iommugroupallocdefaultdomain, VFIO type1's legacy container merges any newly attached group into...

DEBIAN-CVE-2026-90243

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copiedcontextteardown zeroes the 128-bit context entry with contextclearentry while the Present bit is still set, and only then issues the context-cache and...

CVE-2026-90243

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down copied context entry copiedcontextteardown zeroes the 128-bit context entry with contextclearentry while the Present bit is still set, and only then issues the context-cache and...

DEBIAN-CVE-2026-90240

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domaincontextclearone and devicepasidtableteardown are both invoked once per DMA alias of a device. Each function locates the context entry using the...

CVE-2026-90240

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush context cache with correct SID when tearing down aliases domaincontextclearone and devicepasidtableteardown are both invoked once per DMA alias of a device. Each function locates the context entry using the...

CVE-2026-90145

In the Linux kernel, the following vulnerability has been resolved: hinic3: Fix skb linearization mismatch and drop skb when skbchecksumhelp failed Previously, hinic3sendoneskb cached the skb fragment count before calling hinic3txoffload. If hinic3txcsum falls back to skbchecksumhelp for...

DEBIAN-CVE-2026-90145

In the Linux kernel, the following vulnerability has been resolved: hinic3: Fix skb linearization mismatch and drop skb when skbchecksumhelp failed Previously, hinic3sendoneskb cached the skb fragment count before calling hinic3txoffload. If hinic3txcsum falls back to skbchecksumhelp for...

CVE-2026-92505

CVE-2026-92505 addresses an undefined behavior bug in the Linux kernel's iommu/amd module, specifically in the devid_write debugfs function. The root cause is that when for_each_pci_segment() completes without finding a matching segment, the pci_seg pointer is left pointing to an invalid memory l...

EUVD-2026-82126

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix undefined behavior in devidwrite debugfs function When foreachpcisegment loop completes without finding a matching segment, the pciseg pointer is not NULL but points to an invalid memory location the list head...

CVE-2026-90388

CVE-2026-90388 is a Linux kernel vulnerability in the iommu/dma subsystem. The non-blocking, non-coherent DMA allocation path calls dma_alloc_from_pool(), which returns the allocated page and fills cpu_addr only on success. The affected code incorrectly relied on cpu_addr to detect allocation fai...

CVE-2026-90388 iommu/dma: Check atomic pool allocation result directly

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dmaallocfrompool, which returns the allocated page and fills cpuaddr only on success. Do not rely on cpuaddr to detect...

EUVD-2026-82049

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dmaallocfrompool, which returns the allocated page and fills cpuaddr only on success. Do not rely on cpuaddr to detect...

CVE-2026-90244

CVE-2026-90244 is a race condition in the Linux kernel's iommu/dma subsystem affecting the VFIO type1 legacy container . When an IOMMU publishes IOMMU_RESV_SW_MSI (e.g., ARM SMMU ), two devices sharing the same merged domain can concurrently enter iommu_dma_get_msi_page() under different group mu...

CVE-2026-90244 iommu/dma: Restore locking around msi_page_list

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msipagelist Unlike a group's default domain, which is always freshly allocated and privately owned iommugroupallocdefaultdomain, VFIO type1's legacy container merges any newly attached group into...