206 matches found
CVE-2026-40369
This is a rewrite and summary of VoidSec’s public technical analysis of CVE-2026-40369, with an added flowchart and defensive notes for my own understanding. All core technical details come from his research. I did not perform independent reverse engineering on this bug. CVE-2026-40369: Defensive...
UBUNTU-CVE-2026-98145
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...
CVE-2026-98145
The Linux kernel contains a vulnerability in the accel/amdxdna driver where a command chain with a command_count of zero improperly passes payload length checks. Because the struct_size calculation only accounts for the header, the fill loop is skipped, resulting in the submission of a zero-lengt...
CVE-2026-98145 accel/amdxdna: reject a command chain that carries no commands
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...
CVE-2026-98145: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...
EUVD-2026-70786
MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fixed 1024-byte buffers using sprintf without length validation. Attackers can supply arbitrarily long MOOS identifiers that overflow the...
CVE-2026-80652
A flaw was found in the Linux kernel's Cryptographic Co-processor CCP driver. A local attacker could trigger a kernel crash, leading to a denial of service DoS, by providing a zero-length certificate chain buffer during a Platform Dynamic Hardware PDH export operation. This issue specifically...
libevent: Libevent: Memory corruption due to use-after-free
A flaw was found in Libevent, an event notification library. A use-after-free vulnerability exists in the evbufferaddbufferreference function when it processes an output buffer with a zero length. This can lead to a dangling pointer, which an attacker could exploit to cause memory corruption or...
SUSE CVE-2026-80652
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...
CVE-2026-80652
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...
UBUNTU-CVE-2026-80652
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...
CVE-2026-80652 crypto: ccp - Treat zero-length cert chain as query for blob lengths
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...
EUVD-2026-67528
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...
CVE-2026-80652
CVE-2026-80652 affects the Linux kernel 's AMD SEV/CCP driver (drivers/crypto/ccp/sev-dev.c ). When handling a PDH export, a zero-length userspace cert chain buffer is not treated as a blob-length query, causing a BUG_ON() crash at arch/x86/mm/physaddr.c due to a physical-address lookup on ZERO_S...
PT-2026-82952
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the crypto CCP module when handling a PDH export. The system fails to properly account for a zero-length userspace cert chain buffer, which should be treated as a...
CVE-2026-63381
A flaw was found in Libevent, an event notification library. A use-after-free vulnerability exists in the evbufferaddbufferreference function when it processes an output buffer with a zero length. This can lead to a dangling pointer, which an attacker could exploit to cause memory corruption or...
USN-8531-1 libexif vulnerabilities
It was discovered that libexif had an integer overflow in its MakerNote decoder when called with a zero-length buffer. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. CVE-2026-32775 It was discovered that libexif had an integer overflow in i...
CVE-2026-59857 Vim: Out-of-bounds Write in SAL Soundfolding
Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spellsoundfoldsal in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are guarded with reslen MAXWLEN, allowing reslen...
kernel: io_uring/rsrc: reject zero-length fixed buffer import
A flaw was found in the Linux kernel's iouring subsystem. A local attacker can exploit a vulnerability in the ioimportfixed function by importing a zero-length fixed buffer. This can lead to an out-of-bounds read from slab memory, potentially resulting in information disclosure or a denial of...
