Estudo-de-Caso-CVE-2026-31431-CopyFail

🐧 CVE-2026-31431 — CopyFail: Повышение привилегий в ядре Linux Полное исследование — как была обнаружена, как работает, как тестировать, как воспроизвести в безопасной среде и как исправить критическую уязвимость, затрагивающую почти все дистрибутивы Linux с 2017 года. 🚨 Предупреждение / Отказ от...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy for BIOS version The strlcat function with FORTIFY support triggers a panic because it assumes that the target buffer will overflow, even though the correct target buffer size is provided. In any case,...

DEBIAN-CVE-2026-47555

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause uninitialized kernel memory to be copied back to userspace. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-47555

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause uninitialized kernel memory to be copied back to userspace. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-97612

A flaw was found in the Linux kernel's Multiprotocol Label Switching MPLS networking subsystem. When all labels are removed from an encapsulated packet, the kernel fails to clear internal protocol tracking metadata, leaving stale network header references. An attacker could exploit this flaw by...

AZL-104645 CVE-2026-97612 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear innerprotocol when the last label is popped skbmplspush records the pre-encapsulation network header once, gated on !skb-innerprotocol. skbmplspop never clears that record, so it outlives the encapsulation it...

CVE-2026-90191: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: Fixed the vulnerability in the migratetoram function when there is a copy error. The nouveaudmemcopyone function ensures that the copy push command is sent to the device’s firmware, but it does not track whether the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: VMCI: Fixed a runtime warning from memcpy in dgdispatchashost. Syzkaller encountered a “WARNING in dgdispatchashost” bug. memcpy: A field-spanning write was detected size 56 for a single field “&dginfo-msg” in...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: wl1251: A possible buffer overflow issue in wl1251cmdscan has been fixed. The function wl1251cmdscan calls memcpy without checking the length of the destination buffer. This vulnerability can be mitigated by checking that the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: BPF: Fixed potential improper pointer dereferencing in bpfsysbpf. The bpfsysbpf helper function allows an eBPF program to load another eBPF program from within the kernel. In this case, the argument union bpfattr pointer along...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: added a missing boundary check in vmaccess A missing bounds check in vmaccess can lead to an out-of-bounds read or write in the adjacent memory area. This occurs because the len attribute is not validated before the...

Astra Linux – Vulnerability in advancecomp

It was discovered that Advancecomp v2.3 contains a heap buffer overflow issue due to the interceptormemcpy component at /sanitizercommon/sanitizercommoninterceptors.inc...

Astra Linux – Vulnerability in TIF format

LibTIFF 4.4.0 contains an out-of-bounds write vulnerability in TIFFmemcpy in libtiff/tifunix.c:346, when called from extractImageSection, located at tools/tiffcrop.c:6860. This vulnerability allows attackers to cause a denial-of-service attack through a crafted TIF file. For users who compile...

CVE-2026-84968: Out-of-bounds Read

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended...

PT-2026-86704

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXL HEADERLOG SIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes CXL RAS CAPABILITY LENGTH; the Header Log occupies the trailing 64 bytes at offset 0x18. CXL...

CVE-2026-76840

RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStreamRead in libs/clipboard/src/windows/wfcliprdr.c requests...

wasm3:fuzzer: Global-buffer-overflow in Compile_Memory_CopyFill

Project: https://github.com/wasm3/wasm3.git Detailed Report: https://oss-fuzz.com/testcase?key=6572046036566016 Project: wasm3 Fuzzing Engine: afl Fuzz Target: fuzzer Job Type: aflasanwasm3 Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x55e896aa04a8 Crash State:...

PT-2026-72907

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the peak usb component where the pcan usb fd decode buf function fails to properly validate uCAN receive record lengths when processing records packed in a USB receive...

CVE-2026-68279

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drmdpsidebandparseremotedpcdread reads numbytes from the raw message and then unconditionally does: memcpybytes, &raw-msgidx, numbytes; without checking that idx...