32 matches found
CVE-2026-98059
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...
UBUNTU-CVE-2026-98059
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...
EUVD-2026-86712
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...
CVE-2026-98059 bpf: Mark sched_process_wait argument as nullable
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...
CVE-2026-98059 bpf: Mark sched_process_wait argument as nullable
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...
CVE-2026-98059: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...
CVE-2026-98059
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: In the bpf and arm64 implementations, the value of prog-jitedlen was cleared along with prog-jited. The syzbot reported an attempt to perform an illegal copytouser operation from the bpfproggetinfobyfd function 1. There has been ...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990456)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990456 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog-jitedlen along prog-jited syzbot reported an illegal copytouser attempt fr...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988746)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988746 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog-jitedlen along prog-jited syzbot reported an illegal copytouser attempt fr...
SUSE CVE-2022-49341
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog-jitedlen along prog-jited syzbot reported an illegal copytouser attempt from bpfproggetinfobyfd 1 There was no repro yet on this bug, but I think that commit 0aef499f3172 "mm/usercopy: Detect vmalloc...
DEBIAN-CVE-2022-49341
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog-jitedlen along prog-jited syzbot reported an illegal copytouser attempt from bpfproggetinfobyfd 1 There was no repro yet on this bug, but I think that commit 0aef499f3172 "mm/usercopy: Detect vmalloc...
CVE-2022-49341 bpf, arm64: Clear prog->jited_len along prog->jited
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog-jitedlen along prog-jited syzbot reported an illegal copytouser attempt from bpfproggetinfobyfd 1 There was no repro yet on this bug, but I think that commit 0aef499f3172 "mm/usercopy: Detect vmalloc...
CVE-2022-49341
The CVE-2022-49341 entry concerns the Linux kernel vulnerability where bpf, arm64 paths could reveal kernel memory via copy_to_user() in bpf_prog_get_info_by_fd() due to incorrect handling of prog->jited_len. The issue arises when prog->jited_len is set (e.g., to 43) but prog->bpf_func i...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from prog-jitedlen not being cleared with prog-jited, which could lead to illegal memory accesses...
Mozilla Spidermonkey - Unboxed Objects Uninitialized Memory Access Exploit
/ Mozilla Spidermonkey - Unboxed Objects Uninitialized Memory Access For constructors, Spidermonkey implements a "definite property analysis" 1 to compute which properties will definitely exist on the constructed objects. Spidermonkey then directly allocates the constructed objects with the final...
Microsoft Edge Chakra - NewScObjectNoCtor or InitProto Type Confusion
Microsoft Edge Chakra - NewScObjectNoCtor or InitProto Type Confusion NewScObjectNoCtor and InitProto opcodes are treated as having no side effects, but actually they can have via the SetIsPrototype method of the type handler that can cause transition to a new type. This can lead to type confusio...
Microsoft Edge Chakra - 'NewScObjectNoCtor' or 'InitProto' Type Confusion
NewScObjectNoCtor and InitProto opcodes are treated as having no side effects, but actually they can have via the SetIsPrototype method of the type handler that can cause transition to a new type. This can lead to type confusion in the JITed code. In the PoC, it overwrites the pointer to property...
Microsoft Edge Chakra JIT - Magic Value Type Confusion Exploit
Exploit for windows platform in category dos / poc / BOOL JavascriptNativeFloatArray::SetItemuint32 index, double dValue if uint64&dValue == uint64&JavascriptNativeFloatArray::MissingItem JavascriptArray varArr = JavascriptNativeFloatArray::ToVarArraythis; varArr-DirectSetItemAtindex,...
Microsoft Edge Chakra JIT - Magic Value Type Confusion
Microsoft Edge Chakra JIT - Magic Value Type Confusion / BOOL JavascriptNativeFloatArray::SetItemuint32 index, double dValue if uint64&dValue == uint64&JavascriptNativeFloatArray::MissingItem JavascriptArray varArr = JavascriptNativeFloatArray::ToVarArraythis; varArr-DirectSetItemAtindex,...