Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFSDE view.dataoff in UpdateRecordDataRoot,Allocation In the UpdateRecordDataRoot fslog.c:3489 and UpdateRecordDataAllocation fslog.c:3697 cases within doaction, the destination of memmove is Add2Ptre,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In the DeleteIndexEntryAllocation case within doaction, e-size comes from an on-disk INDEXBUFFER entry. When e-size causes e + e-size to exceed hdr + hdr-used, PtrOffsete1...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walks the on-disk refcount record array with: for ; i rfrecords.rlused; i++ rec = &rb-rfrecords.rlrecsi; ... rlrecs resides in a single...

ABL_ROP

Updating ABL serial with ROP: When ran this notebook will load ABL and attempt to update the device's serial number via ROP chain to call memmove. Derived from eShard's https://github.com/eshard/pixel6-boot/blob/main/runablpublic.ipynb whilst following along with...

CVE-2025-62821

Microsoft HEIF Image Extensions msheifstore.dll: Source-buffer under-allocation in CopyPixels path leads to out-of-bounds read and Access Violation DoS When decoding a crafted HEIF image through WIC, the msheif codec allocates a 1-byte source buffer but later attempts to copy a very large amount ...

CVE-2024-26160

CVE-2024-26160 cldflt.sys information disclosure vulnerability There's small writeup about CVE-2024-26160 , what can be found in the February patch KB5034765 , Windows 11 22H2, Windows 11 23H2. The vulnerability has been closed in the March patch KB5035853. Analysis The vulnerability is located i...

CVE-2021-21551

CVE-2021-21551 Proof of concept exploit for CVE-2021-21551, vulnerability comes from user provided addresses being provided as arguments to a memmove call allowing for an arbitary read/write ioctls 0x9B0C1EC4 and 0x9B0C1EC8 as well as the physical address parameter for a MmMapIoSpace call that...

cve-2024-46483

CVE-2024-46483 - Pre-Authentication Heap Overflow in Xlight SFTP server Affected versions Xlight 32 and 64-bit versions = 3.9.4.2 Impact An unauthenticated attacker with access to Xlight SFTP could gain code execution or cause a denial or service. Root Cause Strings sent across the wire in the SF...

freebsd-CVE-2026-7270

Ref https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 CVE-2026-7270 FreeBSD local privilege escalation viaexecargsadjustargs OOB memmove An operator-precedence bug in execargsadjustargs sys/kern/kernexec.c, present since 2013 lets any local user escalate to root on a...

CVE-2023-52356-libtiff-analysis

CVE-2023-52356 – libtiff TIFFReadRGBATileExt Analysis Overview This lab analyzes CVE-2023-52356 in libtiff, focusing on the behavior of TIFFReadRGBATileExt when it receives image coordinates outside the valid image bounds. The analysis includes reproduction of the original crash, debugging with...

CVE-2022-35086

SWFTools commit 772e55a2 was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S...

CVE-2026-99107 ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute is in an extent record, ctx-mrec points to the extent but the function...

CVE-2026-99107 ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute is in an extent record, ctx-mrec points to the extent but the function...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 7.2.13. It arises because ntfsnewattrflags reduces the size of non-in-place attribute records before clearing compressed or sparse states; this causes memmove to copy bytes from subsequent attributes, resulting in a malformed mappi...

Linux Distros Unpatched Vulnerability : CVE-2026-99107

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute i...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146661)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146661 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rlused against rlcount in refcount block validator ocfs2findrefcountrecinrl walk...

PT-2026-128100

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfs attr record resize ntfs new attr flags passes the wrong MFT record to ntfs attr record resize. When the attribute is in an extent record, ctx-mrec points to the extent but the...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6rearrangerthdr assumes that segmentsleft is not larger than the number of addresses described by t...

CLSA-2026-1792171196 lz4: Fix of CVE-2021-3520

CVE-2021-3520: Fix potential memory corruption with negative memmove size...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can cause an integer overflow in the memmove function, resulting in a heap-based buffer overflow in the ntfsattrrecordresize function, as of NTFS-3G version 2021.8.22...