CVE-2026-98565

A flaw was found in the Linux kernel's MediaTek MT7530 network switch driver. This flaw allows a local user with administrative privileges to cause a Denial of Service DoS through a kernel crash. The issue occurs during driver unbinding or module removal on specific hardware variants, where the...

CVE-2026-98526

A flaw was found in the Linux kernel's Logical Link Control LLC subsystem. This flaw allows an adjacent attacker to cause a Denial of Service DoS via a kernel crash. When transmitting an LLC response over stacked network interfaces, such as Virtual Local Area Networks VLANs, the kernel allocates...

CVE-2026-98452

A flaw was found in the Linux kernel's Server Message Block SMB client. When opening cached directories, the client fails to validate server responses to compound commands before reading their contents and handling file identifiers. A malicious or compromised SMB server could exploit this flaw by...

CVE-2026-98508

A flaw was found in the Linux kernel's VirtIO GPU driver. This flaw allows a local user to cause a denial of service DoS by triggering a kernel crash. Under memory pressure, the driver fails to verify whether fence memory allocation succeeds during graphics command submission, leading to an...

CVE-2019-2215

CVE-2019-2215 The following issue exists in the android-msm-wahoo-4.4-pie branch of https://android.googlesource.com/kernel/msm and possibly others: There is a use-after-free of the wait member in the binderthread struct in the binder driver at /drivers/android/binder.c. As described in the...

CVE-2022-34715-POC

CVE-2022-34715-POC CVE-2022-34715-POC pcap nfssvr.sys version 10.0.20348.825 0: kd r rax=0000000080000001 rbx=0000000000000000 rcx=ffffde87fe461150 rdx=0000000000000000 rsi=fffff8040811aa50 rdi=0000000000000008 rip=fffff80408067dbb rsp=ffffb400eb3e2630 rbp=ffffb400eb3e26b9 r8=0000001000000020...

CVE-2018-4407

CVE-2018-4407 IOS/macOS kernel crash Usage: python CVE20184407.py IP/CIDR python CVE-20184407.py 192.168.1.1 python CVE20184407.py 192.168.1.0/24 1. find iphone nmap -sS -p 62078 --open 192.168.1.0/24 2. attack python CVE20184407.py iphoneip...

CVE-2022-21907-http.sys

CVE-2022-21907 - Double Free in http.sys driver CVE-2022-21907 - Double Free in http.sys driver Summary An unauthenticated attacker can send an HTTP request with an "Accept-Encoding" HTTP request header triggering a double free in the unknown coding-list inside the HTTP Protocol Stack http.sys to...

CVE-2026-98829

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98783

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add missing ISERR check for ovladaptor platform device platformdeviceregisterdata can fail and return an ERRPTR, but the return value is used without checking, leading to an invalid pointer being stored in ddpcomp.d...

CVE-2026-98756

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

EUVD-2026-103769

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98829 wifi: mac80211: drop oversized fragments to avoid extra_len overflow

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98829

The Linux kernel contains a vulnerability in the mac80211 component where oversized fragments can cause an extra_len overflow . The root cause is that entry->extra_len was narrowed from unsigned int to u16 to reduce memory footprint. When a sequence of large fragments exceeds 65535 bytes, the ...

CVE-2026-98829 wifi: mac80211: drop oversized fragments to avoid extra_len overflow

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98783

The Linux kernel contains a vulnerability in the drm/mediatek driver regarding the ovl_adaptor platform device. The platform_device_register_data() function can fail and return an ERR_PTR, but because the return value is not checked, an invalid pointer is stored in ddp_comp[].dev. This invalid po...

CVE-2026-98783 drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add missing ISERR check for ovladaptor platform device platformdeviceregisterdata can fail and return an ERRPTR, but the return value is used without checking, leading to an invalid pointer being stored in ddpcomp.d...

CVE-2026-98783 drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add missing ISERR check for ovladaptor platform device platformdeviceregisterdata can fail and return an ERRPTR, but the return value is used without checking, leading to an invalid pointer being stored in ddpcomp.d...

EUVD-2026-103868

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add missing ISERR check for ovladaptor platform device platformdeviceregisterdata can fail and return an ERRPTR, but the return value is used without checking, leading to an invalid pointer being stored in ddpcomp.d...

EUVD-2026-103841

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...