CVE-2026-65349

CVE-2026-65349 — getattrlist OOB Write in vfsattrpackinternal Component: XNU VFS — vfsattrpackinternal getattrlist syscall Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds write to caller buffer Impact: Kernel heap corruption; from kernel conte...

CVE-2026-16147

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

CVE-2026-16147 it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

CVE-2026-16147

The ITE IT82xx2 USB device-controller driver in Zephyr RTOS (drivers/usb/udc/udc_it82xx2.c) contains a use-after-free caused by premature buffer submission during multi-packet OUT transfers. When a full max-packet-size packet arrives before the buffer is complete, the driver both re-arms the endp...

CVE-2026-16147 it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

CVE-2026-16147 it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

EUVD-2026-77777

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

PT-2026-91416

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udc it82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In work handler out the active transfer buffer is obtained with udc buf peek which does not dequeue it; when a full max-packet-size packet arrives but the...

Linux Distros Unpatched Vulnerability : CVE-2026-89724

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose...

CVE-2026-45200

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that woul...

CVE-2026-45200 GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that woul...

EUVD-2026-70857

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that woul...

CVE-2026-45200 GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that woul...

CVE-2026-45200

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that woul...

CVE-2026-45200: Use After Free

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that woul...

PT-2026-85373

Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that woul...

Exploit for Out-of-bounds Read in Apple Ipados

CVE-2026-65349 — getattrlist OOB Write in vfsattrpackinter...

SUSE CVE-2026-80536

In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlogrecoverdoregbuffer replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpyxfsbufoffsetbp, uintbit ribufi.iovbase, nbits...

CVE-2026-80536

CVE-2026-80536 is an out-of-bounds write in the Linux kernel's XFS filesystem , specifically in xlog_recover_do_reg_buffer() during mount-time log recovery. The destination offset and buffer size are both attacker-controlled but only bounded by an ASSERT() that compiles away on production kernels...

CVE-2026-80536 xfs: bounds-check buffer log item's dirty bitmap

In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlogrecoverdoregbuffer replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpyxfsbufoffsetbp, uintbit ribufi.iovbase, nbits...