rndis-co

RNDIS-CO Summary The RNDIS USB Gadget may be exploited to dump contents of kernel memory space via packet filter update mechanism. Description The RNDISMSGSET usb control transfer request handler - rndissetresponse calls genndissetresp passing a buffer pointer offset by BufOffset + 8. The BufOffs...

razer-lycosa-kernel-lpe-BYOVD-Vulnerability-PoC

Lycosa.sys, Razer: two kernel vulnerabilities reachable by any local user Discovered through https://github.com/416rehman/DeepZero Vendor: Razer Inc. Component: Lycosa.sys, the Razer Lycosa keyboard filter driver, x64 SHA-256: a120a6184ab16864e8a5f1dfd0cd178fca541de463b5cef946e18c34b9b6f716...

CVE-2026-98687

A flaw was found in the Linux kernel's Thunderbolt driver. When processing property requests from peer devices, the driver fails to verify that the response data length does not exceed the allocated buffer size. A malicious peer can exploit this flaw by sending an oversized response packet,...

CVE-2026-98582

A flaw was found in the Linux kernel's ST21NFCA Near Field Communication NFC driver. The driver fails to properly validate the length of received frames when processing escape sequences. An attacker capable of sending crafted NFC frames could exploit this vulnerability to trigger an out-of-bounds...

CVE-2026-98575

A flaw was found in the Linux kernel's PN533 NFC Near Field Communication driver. An attacker capable of connecting a malicious or malfunctioning USB device can supply a crafted response frame with an arbitrary data length value. Because the driver fails to validate this length against maximum...

CVE-2026-86940

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be able to disclose kernel memory...

EUVD-2026-104726

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be able to disclose kernel memory...

CVE-2026-86940

A vulnerability in the afpfs component of macOS Golden Gate 27 allows an application to disclose kernel memory . This issue was addressed by removing the vulnerable code. The fix is included in the macOS Golden Gate 27 release. No exploit details or specific exploit links are provided in the docu...

CVE-2026-86940

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be able to disclose kernel memory...

cve-2026-43687

CVE-2026-43687 — Reverse engineering notes and reproduction Independent reverse engineering of the macOS NFS client access-cache race CVE-2026-43687, plus a working PoC that triggers the race and captures it live with dtrace. The bug is an unsynchronized read of the nfsnode access-cache pointer i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: A out-of-bounds read occurred in the errout section of fbcondosetfont. When fbcondosetfont fails e.g., due to a memory allocation failure within vcresize under heavy memory pressure, it jumps to the errout label to...

CVE-2026-110912

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...

CVE-2026-110912

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...

CVE-2026-110912

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...

CVE-2026-110912

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...

CVE-2026-110912

In DragonFly BSD (through 6.4.2 before 4bb22ff), the ARP input handlers arpintr() and in_arpinput() in sys/netinet/if_ether.c fail to validate the ar_hln and ar_pln fields of incoming ARP packets. Consequently, in_arpreply() uses these attacker-controlled values as memcpy lengths when copying fro...

PT-2026-114755

Name of the Vulnerable Software and Affected Versions DragonFly BSD versions prior to 6.6 Description The ARP input handlers arpintr and in arpinput in sys/netinet/if ether.c fail to validate the hardware address length ar hln and protocol address length ar pln fields of incoming ARP packets...

CVE-2026-90161

A flaw was found in the Linux kernel's erofs filesystem. A local attacker could craft a malicious erofs image containing invalid interlaced ztailpacking pclusters. When this image is processed, it could lead to an out-of-bounds read from kernel memory. This vulnerability may allow an attacker to...

CVE-2026-98322

A flaw was found in the Linux kernel's Netfilter network filtering subsystem. When configuring IPv4 Network Address Translation NAT rules with the netmap feature, the system fails to initialize a temporary memory buffer on the stack. As a result, uninitialized kernel stack data is copied and...

CVE-2026-98200

A flaw was found in the Linux kernel's HP WMI Sensors hp-wmi-sensors driver. Due to a missing lock when reading sensor properties, a race condition can occur when sensor data is freed and replaced during an update while another operation is reading it. A local user could exploit this flaw by...