603 matches found
cve-2026-43687
CVE-2026-43687 — Reverse engineering notes and reproduction Independent reverse engineering of the macOS NFS client access-cache race CVE-2026-43687, plus a working PoC that triggers the race and captures it live with dtrace. The bug is an unsynchronized read of the nfsnode access-cache pointer i...
razer-lycosa-kernel-lpe-BYOVD-Vulnerability-PoC
Lycosa.sys, Razer: two kernel vulnerabilities reachable by any local user Discovered through https://github.com/416rehman/DeepZero Vendor: Razer Inc. Component: Lycosa.sys, the Razer Lycosa keyboard filter driver, x64 SHA-256: a120a6184ab16864e8a5f1dfd0cd178fca541de463b5cef946e18c34b9b6f716...
CVE-2026-110912
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...
CVE-2026-110912
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...
CVE-2026-110912
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...
CVE-2026-110912
In DragonFly BSD (through 6.4.2 before 4bb22ff), the ARP input handlers arpintr() and in_arpinput() in sys/netinet/if_ether.c fail to validate the ar_hln and ar_pln fields of incoming ARP packets. Consequently, in_arpreply() uses these attacker-controlled values as memcpy lengths when copying fro...
CVE-2026-110912
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...
CVE-2026-90161
A flaw was found in the Linux kernel's erofs filesystem. A local attacker could craft a malicious erofs image containing invalid interlaced ztailpacking pclusters. When this image is processed, it could lead to an out-of-bounds read from kernel memory. This vulnerability may allow an attacker to...
rndis-co
RNDIS-CO Summary The RNDIS USB Gadget may be exploited to dump contents of kernel memory space via packet filter update mechanism. Description The RNDISMSGSET usb control transfer request handler - rndissetresponse calls genndissetresp passing a buffer pointer offset by BufOffset + 8. The BufOffs...
CVE-2026-98322
A flaw was found in the Linux kernel's Netfilter network filtering subsystem. When configuring IPv4 Network Address Translation NAT rules with the netmap feature, the system fails to initialize a temporary memory buffer on the stack. As a result, uninitialized kernel stack data is copied and...
CVE-2026-98200
A flaw was found in the Linux kernel's HP WMI Sensors hp-wmi-sensors driver. Due to a missing lock when reading sensor properties, a race condition can occur when sensor data is freed and replaced during an update while another operation is reading it. A local user could exploit this flaw by...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: A out-of-bounds read occurred in the errout section of fbcondosetfont. When fbcondosetfont fails e.g., due to a memory allocation failure within vcresize under heavy memory pressure, it jumps to the errout label to...
CVE-2026-19185
The system-call verifier for i3cdoccc in drivers/i3c/i3chandlers.c validated the outer struct i3ccccpayload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3cccctargetpayload carries its ow...
EUVD-2026-92286
The system-call verifier for i3cdoccc in drivers/i3c/i3chandlers.c validated the outer struct i3ccccpayload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3cccctargetpayload carries its ow...
PT-2026-104750
The system-call verifier for i3c do ccc in drivers/i3c/i3c handlers.c validated the outer struct i3c ccc payload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3c ccc target payload carrie...
CVE-2026-19185: Untrusted Pointer Dereference
The system-call verifier for i3cdoccc in drivers/i3c/i3chandlers.c validated the outer struct i3ccccpayload, the broadcast ccc.data buffer and the targets.payloads array, but did not validate the per-target data buffers those array elements point at. Each struct i3cccctargetpayload carries its ow...
CVE-2026-13043 WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access
A missing authentication vulnerability in the Kernel Memory Access Driver PSKMAD used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of...
CVE-2026-97437
A flaw was found in the Linux kernel's ntfs3 file system driver. Improper bounds checking during directory reading and index lookups can lead to an out-of-bounds memory read. A local attacker could exploit this vulnerability by mounting a specially crafted NTFS image, which could crash the system...
CVE-2026-98032
A flaw was found in the Linux kernel's tracing subsystem. A race condition occurs when concurrent subbuffer resizing takes place while raw trace data is being read. A local user could exploit this flaw to cause a Denial of Service DoS or disclose uninitialized kernel memory due to stale buffer si...
