rndis-co

RNDIS-CO Summary The RNDIS USB Gadget may be exploited to dump contents of kernel memory space via packet filter update mechanism. Description The RNDISMSGSET usb control transfer request handler - rndissetresponse calls genndissetresp passing a buffer pointer offset by BufOffset + 8. The BufOffs...

razer-lycosa-kernel-lpe-BYOVD-Vulnerability-PoC

Lycosa.sys, Razer: two kernel vulnerabilities reachable by any local user Discovered through https://github.com/416rehman/DeepZero Vendor: Razer Inc. Component: Lycosa.sys, the Razer Lycosa keyboard filter driver, x64 SHA-256: a120a6184ab16864e8a5f1dfd0cd178fca541de463b5cef946e18c34b9b6f716...

kernel: iio: event: Fix event FIFO reset race

A flaw was found in the Linux kernel's Industrial I/O IIO event subsystem. A local user can exploit a race condition during the reset of the event FIFO First-In, First-Out buffer. This occurs when another thread accesses a newly allocated file descriptor before the FIFO reset is complete. This ca...

CVE-2026-110912

🩸 CVE-2026-110912 — ARPBleed 🩸 ARP Packet Handling Vulnerability | DragonFly BSD | Security Research 🩸 Overview ARPBleed is the name associated with the reported vulnerability CVE-2026-110912, involving improper handling of Address Resolution Protocol ARP packet length fields in DragonFly BSD...

cve-2026-43687

CVE-2026-43687 — Reverse engineering notes and reproduction Independent reverse engineering of the macOS NFS client access-cache race CVE-2026-43687, plus a working PoC that triggers the race and captures it live with dtrace. The bug is an unsynchronized read of the nfsnode access-cache pointer i...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in errout of fbcondosetfont When fbcondosetfont fails e.g., due to a memory allocation failure within vcresize under heavy memory pressure, it jumps to the errout label to roll back the consol...

CVE-2026-87041

The RTIO submission-queue verifier rtiovrfysqe in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0 accumulated the results of KSYSCALLMEMORY into its validsqe flag with &=. That macro returns nonzero on failure it is built on KSYSCALLVERIFYMSG, which yields !expr, so every buff...

CVE-2026-87041 Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory

The RTIO submission-queue verifier rtiovrfysqe in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0 accumulated the results of KSYSCALLMEMORY into its validsqe flag with &=. That macro returns nonzero on failure it is built on KSYSCALLVERIFYMSG, which yields !expr, so every buff...

CVE-2026-87041 Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory

The RTIO submission-queue verifier rtiovrfysqe in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0 accumulated the results of KSYSCALLMEMORY into its validsqe flag with &=. That macro returns nonzero on failure it is built on KSYSCALLVERIFYMSG, which yields !expr, so every buff...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLABINARY with only a maximum length, so validatenla accepts a payload shorter th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record getsymlinkchunk and the SL handling in parserockridgeinodeinternal process variable-length components of a Rock Ridge “SL” symbolic link record. Each component consists ...

CVE-2026-99204

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System 2 Distributed Lock Manager DLM subsystem. A synchronization issue allows a local user to trigger a use-after-free condition by reading debugfs files while recovery data is concurrently being destroyed and released. This flaw...

SUSE CVE-2026-98969

In the Linux kernel, the following vulnerability has been resolved: net/sched: emtext: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in emtextdump", which zero-initialised the dump-side struct. Sashiko pointed at a...

CVE-2026-84498

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to disclose kernel memory...

CVE-2026-113910

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to disclose kernel...

CVE-2026-84498

A memory handling vulnerability in macOS allows an application to disclose kernel memory . This issue affects macOS Golden Gate versions prior to 27, Sequoia versions prior to 15.8.2, and Tahoe versions prior to 26.7.2. The vulnerability was addressed through improved memory handling. Exploitatio...

EUVD-2026-110161

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to disclose kernel memory...

CVE-2026-84498

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to disclose kernel memory...

CVE-2026-113910

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to disclose kernel...

CVE-2026-113910

A memory initialization issue exists in various Apple platforms due to improper memory handling. This vulnerability may allow an application to disclose kernel memory . Impacted versions include iOS 26.7.2 , iPadOS 26.7.2 , iOS 27.2 , iPadOS 27.2 , macOS Golden Gate 27.2 , macOS Sequoia 15.8.2 , ...