830 matches found
EUVD-2026-80898
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to...
DEBIAN-CVE-2026-89869
In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...
CVE-2026-89869
In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...
CVE-2026-89869 media: qcom: iris: use disable_irq() during power-off
In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...
EUVD-2026-80469
In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...
CVE-2026-89869
The Linux kernel's qcom iris media driver has a race condition in the VPU power-off path. The function iris_vpu_power_off() used disable_irq_nosync(), which does not wait for an already-queued threaded IRQ handler to finish. As a result, a threaded IRQ handler could still execute after the VPU ha...
CVE-2026-89869 media: qcom: iris: use disable_irq() during power-off
In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...
PT-2026-93878
Name of the Vulnerable Software and Affected Versions IRIS versions prior to 2.4.30 Description Insufficient validation of case authorization occurs in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. An attacker with access to any single case can enumerate sequential...
CVE-2026-89869: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...
CVE-2026-92605: Authorization Bypass Through User-Controlled Key
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads from cases they have no authorization to...
Linux Distros Unpatched Vulnerability : CVE-2026-89869
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an alrea...
PT-2026-93510
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iris vpu power off function where the use of disable irq nosync fails to wait for queued threaded IRQ handlers to complete before returning. This can lead to a...
Malicious Package
Overview ecosystem-iris-eab640-project is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Linux kernel Heap Buffer Overflow DoS
The vulnerability of the irisvb2stopstreaming function in the drivers/media/platform/qcom/iris/irisvb2.c driver for multimedia devices in the Linux operating system is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this...
iris_hfi_gen2_session_stop() DoS
The vulnerability of the irishfigen2sessionstop function in the drivers/media/platform/qcom/iris/irishfigen2command.c driver for multimedia devices in the Linux operating system is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...
Linux Kernel Heap Buffer Overflow DoS
The vulnerability of the irishfigen1sessionunsetbuffers function in the drivers/media/platform/qcom/iris/irishfigen1command.c driver for multimedia devices in the Linux operating system is related to the copying of buffers without checking the size of the input data a classic buffer overflow...
iris-web v2.4.29
Incident Response Investigation System Current Version v2.4.20 Online Demonstration IRIS Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Table of contents Getting Started Run IrisWeb Configuration Versioning Showcase...
API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)
Summary The API Platform serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property. Impact An attacker who can submit write requests...