CVE-2022-2588

CVE-2022-2588 수정 사항 이 버그는 Linux v5.19에서 다음 커밋을 통해 수정되었습니다. 버그 이 버그는 2014년 Linux v3.17에 다음 커밋을 통해 도입되었습니다. 트리거하려면 User Namespaces가 필요합니다. 이 버그는 route4filter의 연결 리스트에 대한 잘못된 연산으로 인해 발생한 CVE-2021-3715와 매우 유사합니다. CVE-2021-3715에 대한 자세한 내용은 blackhat 발표 자료16페이지에서 확인할 수 있습니다. 다음은 CVE-2022-2588에 대한 간략한 세부...

CVE-2022-2588

CVE-2022-2588 수정 이 버그는 Linux v5.19에서 이 커밋으로 수정되었습니다. 버그 이 버그는 2014년 이 커밋으로 Linux v3.17에서 도입되었습니다. 트리거하려면 User Namespaces가 필요합니다. 이 버그는 CVE-2021-3715와 매우 유사하며, 이는 route4filter의 연결 리스트에 대한 잘못된 연산으로 인해 발생했습니다. CVE-2021-3715에 대한 자세한 내용은 블랙햇 발표 16페이지에서 찾을 수 있습니다. 다음은 CVE-2022-2588에 대한 간략한 설명입니다. 다음은...

CVE-2022-2588

CVE-2022-2588 수정 이 버그는 이 커밋으로 Linux v5.19에서 수정되었습니다. 버그 이 버그는 2014년에 이 커밋으로 Linux v3.17에 도입되었습니다. 트리거하려면 User Namespaces가 필요합니다. 이 버그는 route4filter의 연결 리스트에 대한 부적절한 조작으로 인해 발생한 CVE-2021-3715와 매우 유사합니다. CVE-2021-3715에 대한 자세한 내용은 BlackHat 발표 자료16페이지에서 확인할 수 있습니다. 다음은 CVE-2022-2588에 대한 간략한 세부 사항입니다...

CVE-2026-44639 NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqttcodec.c uses propertyappend to walk the entire linked list for each property added by decodebufproperties. A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet...

EUVD-2026-83047

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqttcodec.c uses propertyappend to walk the entire linked list for each property added by decodebufproperties. A remote unauthenticated client can supply a PUBLISH or SUBSCRIBE packet...

CVE-2026-16148 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16147 it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: cfg80211: Calling cfg80211stopap when switching from P2PGO type If the user-space tools switch from NL80211IFTYPEP2PGO to NL80211IFTYPEADHOC via sendmsgNL80211CMDSETINTERFACE, it does not call the cleanup function cfg80211stopap...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8 includes AppArmor patches that fail to properly acquire a lock when modifying a linked list. An unprivileged local user could exploit this race condition, leading to a Use-After-Free UAF error, and, theoretically, arbitrary code execution...

CVE-2026-13732

A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...

AZL-98550 CVE-2026-13732 affecting package gdb 13.2-11

A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...

CVE-2026-13732

A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...

UBUNTU-CVE-2026-13732

A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...

EUVD-2026-68746

A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...

CVE-2026-13732

A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...

PT-2026-89662

A flaw was found in GDB's STABS debug format parser. The read member functions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main...

PT-2026-83971

Name of the Vulnerable Software and Affected Versions GDB affected versions not specified Description A flaw exists in the STABS debug format parser within the read member functions function in gdb/stabsread.c. The issue stems from a linked list removal bug during the separation of destructor and...

CVE-2026-68228

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Move srcbuf Removal to finishencode During encoder processing, there is a case where the IRQ response could return the buffer back to userspace via v4l2m2mbufdone call. In this time, userspace could que...

EUVD-2026-45468

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in blkcgrstatflush When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's blkcgrstatflush removes another blkg's iostat entries via...

PYSEC-2026-3148 Out of bounds write in TFLite

Impact An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions. Patches We have patched t...